From 5e98693b5a84ac237cdde078c21e96087036ac50 Mon Sep 17 00:00:00 2001 From: InfoSec <1241112575@qq.com> Date: Sun, 7 Aug 2016 08:19:17 +0800 Subject: [PATCH] Add files via upload --- payloads/SQLi/经典SQL语句.txt | 738 ++++++++++++++++++++++++++++++++++ 1 file changed, 738 insertions(+) create mode 100644 payloads/SQLi/经典SQL语句.txt diff --git a/payloads/SQLi/经典SQL语句.txt b/payloads/SQLi/经典SQL语句.txt new file mode 100644 index 0000000..315f90e --- /dev/null +++ b/payloads/SQLi/经典SQL语句.txt @@ -0,0 +1,738 @@ +һ + +1˵ݿ +CREATE DATABASE database-name +2˵ɾݿ +drop database dbname +3˵sql server +--- ݵ device +USE master +EXEC sp_addumpdevice 'disk', 'testBack', 'c:\mssql7backup\MyNwind_1.dat' +--- ʼ +BACKUP DATABASE pubs TO testBack +4˵± +create table tabname(col1 type1 [not null] [primary key],col2 type2 [not null],..) + +еı± +Acreate table tab_new like tab_old (ʹþɱ±) +Bcreate table tab_new as select col1,col2 from tab_old definition only +5˵ɾ± +drop table tabname +6˵һ +Alter table tabname add column col type +עӺ󽫲ɾDB2мϺҲܸı䣬Ψһܸıvarchar͵ijȡ +7˵ Alter table tabname add primary key(col) +˵ɾ Alter table tabname drop primary key(col) +8˵create [unique] index idxname on tabname(col.) +ɾdrop index idxname +עDzɸĵģıɾ½ +9˵ͼcreate view viewname as select statement +ɾͼdrop view viewname +10˵򵥵Ļsql +ѡselect * from table1 where Χ +룺insert into table1(field1,field2) values(value1,value2) +ɾdelete from table1 where Χ +£update table1 set field1=value1 where Χ +ңselect * from table1 where field1 like %value1% ---like﷨ܾ! +select * from table1 order by field1,field2 [desc] +select count as totalcount from table1 +ͣselect sum(field1) as sumvalue from table1 +ƽselect avg(field1) as avgvalue from table1 +select max(field1) as maxvalue from table1 +Сselect min(field1) as minvalue from table1 +11˵߼ѯ +A UNION +UNION ͨ TABLE1 TABLE2ȥκظжһ ALL UNION һʹʱ UNION ALLظС£ÿһв TABLE1 TABLE2 +B EXCEPT +EXCEPTͨ TABLE1 е TABLE2 евظжһ ALL EXCEPT һʹʱ (EXCEPT ALL)ظС +C INTERSECT +INTERSECTֻͨ TABLE1 TABLE2 жевظжһ ALL INTERSECT һʹʱ (INTERSECT ALL)ظС +עʹʵļѯбһµġ +12˵ʹ +Aleft outer join +ӣӣӱƥУҲӱС +SQL: select a.a, a.b, a.c, b.c, b.d, b.f from a LEFT OUT JOIN b ON a.a = b.c +Bright outer join: +()ȰӱƥУҲӱС +Cfull/cross outer join +ȫӣӱƥУӱем¼ +12:Group by: + һűһ ɺ󣬲ѯֻܵõصϢ + صϢͳϢ count,sum,max,min,avg ı׼) + SQLServerзʱtext,ntext,image͵ֶΪ + selecteͳƺеֶΣֶܺͨηһ + +13ݿв + ݿ⣺ sp_detach_db;ݿ⣺sp_attach_db ӱҪ· +14.޸ݿ: +sp_renamedb 'old_name', 'new_name' + + +1˵Ʊ(ֻƽṹ,Դa ±b) (Access) +һselect * into b from a where 1<>1SQlServer +select top 0 * into b from a +2˵(,Դa Ŀb) (Access) +insert into b(a, b, c) select d,e,f from b; + +3˵ݿ֮Ŀ(ʹþ·) (Access) +insert into b(a, b, c) select d,e,f from b in ݿ⡯ where +ӣ..from b in '"&Server.MapPath(".")&"\data.mdb" &"' where.. + +4˵Ӳѯ(1a 2b) +select a,b,c from a where a IN (select d from b ) : select a,b,c from a where a IN (1,2,3) + +5˵ʾ¡ύ˺ظʱ +select a.title,a.username,b.adddate from table a,(select max(adddate) adddate from table where table.title=a.title) b + +6˵Ӳѯ(1a 2b) +select a.a, a.b, a.c, b.c, b.d, b.f from a LEFT OUT JOIN b ON a.a = b.c + +7˵ͼѯ(1a ) +select * from (SELECT a,b,c FROM a) T where t.a > 1; + +8˵between÷,betweenƲѯݷΧʱ˱ֵ߽,not between +select * from table1 where time between time1 and time2 +select a,b,c, from table1 where a not between ֵ1 and ֵ2 + +9˵in ʹ÷ +select * from table1 where a [not] in (ֵ1,ֵ2,ֵ4,ֵ6) + +10˵ŹɾѾڸûеϢ +delete from table1 where not exists ( select * from table2 where table1.field1=table2.field1 ) + +11˵ı⣺ +select * from a left inner join b on a.a=b.b right inner join c on a.a=c.c inner join d on a.a=d.d where ..... + +12˵ճ̰ǰ +SQL: select * from ճ̰ where datediff('minute',fʼʱ,getdate())>5 + +13˵һsql 㶨ݿҳ +select top 10 b.* from (select top 20 ֶ,ֶ from order by ֶ desc) a, b where b.ֶ = a.ֶ order by a.ֶ +ʵ֣ +ݿҳ + + declare @start int,@end int + + @sql nvarchar(600) + + set @sql=select top+str(@end-@start+1)++from T where rid not in(select top+str(@str-1)+Rid from T where Rid>-1) + + exec sp_executesql @sql + + +ע⣺topֱӸһʵӦֻĽĴRidΪһʶУtopоֶΣǷdzкôġΪԱ topֶ߼ģѯĽʵʱеIJһ£߼епܺݱеIJһ£ѯʱȲѯ + +14˵ǰ10¼ +select top 10 * form table1 where Χ + +15˵ѡÿһbֵͬжӦaļ¼Ϣ(÷̳ÿа,ÿƷ,Ŀɼ,ȵ.) +select a,b,c from tablename ta where a=(select max(a) from tablename tb where tb.b=ta.b) + +16˵ TableAе TableBTableCевظжһ +(select a from tableA ) except (select a from tableB) except (select a from tableC) + +17˵ȡ10 +select top 10 * from tablename order by newid() + +18˵ѡ¼ +select newid() + +19˵ɾظ¼ +1),delete from tablename where id not in (select max(id) from tablename group by col1,col2,...) +2),select distinct * into temp from tablename + delete from tablename + insert into tablename select * from temp +ۣ ֲǣݵƶʺϴݲ +3),磺һⲿеݣijЩԭһֻһ֣жϾλãֻһȫ룬ҲͲöظֶΣɾظֶ + +alter table tablename +--һ +add column_b int identity(1,1) + delete from tablename where column_b not in( +select max(column_b) from tablename group by column1,column2,...) +alter table tablename drop column column_b + +20˵гݿеı +select name from sysobjects where type='U' // Uû + +21˵ге +select name from syscolumns where id=object_id('TableName') + +22˵ʾtypevenderpcsֶΣtypeֶУcaseԷʵֶѡselect еcase +select type,sum(case vender when 'A' then pcs else 0 end),sum(case vender when 'C' then pcs else 0 end),sum(case vender when 'B' then pcs else 0 end) FROM tablename group by type +ʾ +type vender pcs + A 1 + A 1 + B 2 + A 2 +ֻ B 3 +ֻ C 3 + +23˵ʼtable1 + +TRUNCATE TABLE table1 + +24˵ѡ1015ļ¼ +select top 5 * from (select top 15 * from table order by id asc) table_ order by id desc + + + +11=11=2ʹãSQLʱõĽ϶ + +where 1=1 DZʾѡȫ where 1=2ȫѡ +磺 +if @strWhere !='' +begin +set @strSQL = 'select count(*) as Total from [' + @tblName + '] where ' + @strWhere +end +else +begin +set @strSQL = 'select count(*) as Total from [' + @tblName + ']' +end + +ǿֱд +δҵĿ¼ +set @strSQL = 'select count(*) as Total from [' + @tblName + '] where 1=1 '+ @strWhere 2ݿ +--ؽ +DBCC REINDEX +DBCC INDEXDEFRAG +--ݺ־ +DBCC SHRINKDB +DBCC SHRINKFILE + +3ѹݿ +dbcc shrinkdatabase(dbname) + +4תݿûѴûȨ +exec sp_change_users_login 'update_one','newname','oldname' +go + +5鱸ݼ +RESTORE VERIFYONLY from disk='E:\dvbbs.bak' + +6޸ݿ +ALTER DATABASE [dvbbs] SET SINGLE_USER +GO +DBCC CHECKDB('dvbbs',repair_allow_data_loss) WITH TABLOCK +GO +ALTER DATABASE [dvbbs] SET MULTI_USER +GO + +7־ +SET NOCOUNT ON +DECLARE @LogicalFileName sysname, + @MaxMinutes INT, + @NewSize INT + +USE tablename -- Ҫݿ +SELECT @LogicalFileName = 'tablename_log', -- ־ļ +@MaxMinutes = 10, -- Limit on time allowed to wrap log. + @NewSize = 1 -- 趨־ļĴС(M) + +Setup / initialize +DECLARE @OriginalSize int +SELECT @OriginalSize = size + FROM sysfiles + WHERE name = @LogicalFileName +SELECT 'Original Size of ' + db_name() + ' LOG is ' + + CONVERT(VARCHAR(30),@OriginalSize) + ' 8K pages or ' + + CONVERT(VARCHAR(30),(@OriginalSize*8/1024)) + 'MB' + FROM sysfiles + WHERE name = @LogicalFileName +CREATE TABLE DummyTrans + (DummyColumn char (8000) not null) + +DECLARE @Counter INT, + @StartTime DATETIME, + @TruncLog VARCHAR(255) +SELECT @StartTime = GETDATE(), + @TruncLog = 'BACKUP LOG ' + db_name() + ' WITH TRUNCATE_ONLY' + +DBCC SHRINKFILE (@LogicalFileName, @NewSize) +EXEC (@TruncLog) +-- Wrap the log if necessary. +WHILE @MaxMinutes > DATEDIFF (mi, @StartTime, GETDATE()) -- time has not expired + AND @OriginalSize = (SELECT size FROM sysfiles WHERE name = @LogicalFileName) + AND (@OriginalSize * 8 /1024) > @NewSize + BEGIN -- Outer loop. +SELECT @Counter = 0 + WHILE ((@Counter < @OriginalSize / 16) AND (@Counter < 50000)) + BEGIN -- update + INSERT DummyTrans VALUES ('Fill Log') DELETE DummyTrans + SELECT @Counter = @Counter + 1 + END + +SELECT 'Final Size of ' + db_name() + ' LOG is ' + + CONVERT(VARCHAR(30),size) + ' 8K pages or ' + + CONVERT(VARCHAR(30),(size*8/1024)) + 'MB' + FROM sysfiles + WHERE name = @LogicalFileName +DROP TABLE DummyTrans +SET NOCOUNT OFF + +8˵ij +exec sp_changeobjectowner 'tablename','dbo' + +9洢ȫ + +CREATE PROCEDURE dbo.User_ChangeObjectOwnerBatch +@OldOwner as NVARCHAR(128), +@NewOwner as NVARCHAR(128) +AS + +DECLARE @Name as NVARCHAR(128) +DECLARE @Owner as NVARCHAR(128) +DECLARE @OwnerName as NVARCHAR(128) + +DECLARE curObject CURSOR FOR +select 'Name' = name, + 'Owner' = user_name(uid) +from sysobjects +where user_name(uid)=@OldOwner +order by name + +OPEN curObject +FETCH NEXT FROM curObject INTO @Name, @Owner +WHILE(@@FETCH_STATUS=0) +BEGIN +if @Owner=@OldOwner + +begin + set @OwnerName = @OldOwner + '.' + rtrim(@Name) + exec sp_changeobjectowner @OwnerName, @NewOwner +end +-- select @name,@NewOwner,@OldOwner + +FETCH NEXT FROM curObject INTO @Name, @Owner +END + +close curObject +deallocate curObject +GO + + +10SQL SERVERֱѭд +declare @i int +set @i=1 +while @i<30 +begin + insert into test (userid) values(@i) + set @i=@i+1 +end + +±ҪЛ]мijɿÿL0.1ĻAϣʹü: + + Name score + + Zhangshan 80 + + Lishi 59 + + Wangwu 50 + + Songquan 69 + +while((select min(score) from tb_table)<60) + +begin + +update tb_table set score =score*1.01 + +where score<60 + +if (select min(score) from tb_table)>60 + + break + + else + + continue + +end + + + +ݿ- + + +1.ϱʻ: +Select * From TableName Order By CustomerName Collate Chinese_PRC_Stroke_ci_as //ٵ + +2.ݿ: +select encrypt('ԭʼ') +select pwdencrypt('ԭʼ') +select pwdcompare('ԭʼ','ܺ') = 1--ͬͬ encrypt('ԭʼ') +select pwdencrypt('ԭʼ') +select pwdcompare('ԭʼ','ܺ') = 1--ͬͬ + +3.ȡرֶ: +declare @list varchar(1000), +@sql nvarchar(1000) +select @list=@list+','+b.name from sysobjects a,syscolumns b where a.id=b.id and a.name='A' +set @sql='select '+right(@list,len(@list)-1)+' from A' +exec (@sql) + +4.鿴Ӳ̷: +EXEC master..xp_fixeddrives + +5.ȽA,BǷ: +if (select checksum_agg(binary_checksum(*)) from A) + = + (select checksum_agg(binary_checksum(*)) from B) +print '' +else +print '' + +6.ɱе¼̽: +DECLARE hcforeach CURSOR GLOBAL FOR SELECT 'kill '+RTRIM(spid) FROM master.dbo.sysprocesses +WHERE program_name IN('SQL profiler',N'SQL ¼̽') +EXEC sp_msforeach_worker '?' + +7.¼: +ͷN¼ +Select Top N * From +------------------------------- +NM¼(ҪID) +Select Top M-N * From Where ID in (Select Top M ID From ) Order by ID Desc +---------------------------------- +Nβ¼ +Select Top N * From Order by ID Desc + +1һűһ¼ĵһֶ RecID ֶΣ дһSQL䣬 ҳĵ3140¼ + + select top 10 recid from A where recid not in(select top 30 recid from A) + +дijЩ⣬recidڱд߼ + + select top 10 recid from A whereǴвңselect top 30 recid from Aݱвңе˳пܺݱеIJһ£͵²ѯIJDZõݡ + + + +1order by select top 30 recid from A order by ricid ֶβͻ + +2ǸӲѯҲselect top 30 recid from A where recid>-1 + +2ѯе¼֪ж,Լṹ +set @s = 'select top 1 * from T where pid not in (select top ' + str(@count-1) + ' pid from T)' + +print @s exec sp_executesql @s + +9ȡǰݿеû +select Name from sysobjects where xtype='u' and status>=0 + +10ȡijһֶ +select name from syscolumns where id=object_id('') + +select name from syscolumns where id in (select id from sysobjects where type = 'u' and name = '') + +ַʽЧͬ + +11鿴ijһصͼ洢̡ +select a.* from sysobjects a, syscomments b where a.id = b.id and b.text like '%%' + +12鿴ǰݿд洢 +select name as 洢 from sysobjects where xtype='P' + +13ѯûݿ +select * from master..sysdatabases D where sid not in(select sid from master..syslogins where name='sa') + +select dbid, name AS DB_NAME from master..sysdatabases where sid <> 0x01 + +14ѯijһֶκ +select column_name,data_type from information_schema.columns +where table_name = '' + +15ͬݿ֮ݲ + +--ӷ + +exec sp_addlinkedserver 'ITSV ', ' ', 'SQLOLEDB ', 'Զ̷ipַ ' + +exec sp_addlinkedsrvlogin 'ITSV ', 'false ',null, 'û ', ' ' + +--ѯʾ + +select * from ITSV.ݿ.dbo. + +--ʾ + +select * into from ITSV.ݿ.dbo. + +--Ժʹʱɾӷ + +exec sp_dropserver 'ITSV ', 'droplogins ' + + + +--Զ/(openrowset/openquery/opendatasource) + +--1openrowset + +--ѯʾ + +select * from openrowset( 'SQLOLEDB ', 'sql '; 'û '; ' ',ݿ.dbo.) + +--ɱر + +select * into from openrowset( 'SQLOLEDB ', 'sql '; 'û '; ' ',ݿ.dbo.) + + + +--ѱرԶ̱ + +insert openrowset( 'SQLOLEDB ', 'sql '; 'û '; ' ',ݿ.dbo.) + +select *from ر + +--±ر + +update b + +set b.A=a.A + + from openrowset( 'SQLOLEDB ', 'sql '; 'û '; ' ',ݿ.dbo.)as a inner join ر b + +on a.column1=b.column1 + +--openquery÷Ҫһ + +--ȴһӴӷ + +exec sp_addlinkedserver 'ITSV ', ' ', 'SQLOLEDB ', 'Զ̷ipַ ' + +--ѯ + +select * + +FROM openquery(ITSV, 'SELECT * FROM ݿ.dbo. ') + +--ѱرԶ̱ + +insert openquery(ITSV, 'SELECT * FROM ݿ.dbo. ') + +select * from ر + +--±ر + +update b + +set b.B=a.B + +FROM openquery(ITSV, 'SELECT * FROM ݿ.dbo. ') as a + +inner join ر b on a.A=b.A + + + +--3opendatasource/openrowset + +SELECT * + +FROM opendatasource( 'SQLOLEDB ', 'Data Source=ip/ServerName;User ID=½;Password= ' ).test.dbo.roy_ta + +--ѱرԶ̱ + +insert opendatasource( 'SQLOLEDB ', 'Data Source=ip/ServerName;User ID=½;Password= ').ݿ.dbo. + +select * from ر + +SQL Server + +SQL Server + +1.ַ + +1,datalength(Char_expr) ַַ,Ŀո +2,substring(expression,start,length) ȡӴַ±Ǵӡ1startΪʼλãlengthΪַȣʵӦlen(expression)ȡ䳤 +3,right(char_expr,int_expr) ַұߵint_exprַleft֮෴ +4,isnull( check_expression , replacement_value )check_expressionգtreplacement_valueֵգͷcheck_expressionַ + +5,Sp_addtypeԶx +磺EXEC sp_addtype birthday, datetime, 'NULL' + +6,set nocount {on|off} + +ʹصĽвй Transact-SQL ӰϢ洢аһЩ䲢ʵʵݣڴ˿ܡSET NOCOUNT ִлʱãڷʱáSET NOCOUNT Ϊ ON ʱؼʾ Transact-SQL Ӱ + + + +SET NOCOUNT + +Ϊ OFF ʱؼ + +ʶ + + + +SQLѯУfromԸűͼ256SQLг Order by,ѯʱ򣬺ȡSQLУһֶε8000nvarchar(4000),nvarcharUnicode롣 + + + +SQLServer2000 + +ͬƼʵֲ + +һ Ԥ + +1.,ķһͬwindowsû,ͬ,ΪļеЧû------û--Ҽû--½û--һadministratorĵ½windowsûSynUser2.ڷ,½һĿ¼,ΪĿļĴĿ¼,: + +ҵĵ--D:\ ½һĿ¼,Ϊ: PUB + +--Ҽ½Ŀ¼------ѡ"ļ"--ͨ"Ȩ"ŦþûȨ,֤һдû(SynUser) жԸļеȨ + + + +--ȷ3.SQL(SQLSERVERAGENT)û(/ķ) + +ʼ------ + +--ҼSQLSERVERAGENT----½--ѡ"˻"--ѡһдwindows¼ûSynUser--""û4.SQL Server֤ģʽ,ʱȨ(/ķ) + +ҵ + +--ҼSQLʵ----ȫ--֤--ѡ"SQL Server Windows"--ȷ5.ڷͶķϻע + +ҵ + +--ҼSQL Server--½SQL Serverע...--һ--õķ,ҪעԶ̷ ----һ--ʹ,ѡڶ"SQL Server֤"--һ--û루SynUser--һ--ѡSQL Server,ҲԴһ--һ--6.ֻIP,ü,Ϊע˲ʵʩûõ (Ӷ,,ڶķõĻ,ǷIP) + +ʼ----Microsoft SQL Server--ͻʵù + +------ѡ"tcp/ip"--SQL--Ӳ--SQLipַ--޸SQLĶ˿,ȡѡ"̬˿",ӦĶ˿ں + + ʽ + +1÷ + +ҵڷBCDִ²: + +(1) []˵[]Ӳ˵ѡ[÷ķͷַ]÷ͷַ(2) [һ] ѡַ ѡѷԼΪַsqlķѡԼ(3) [һ] ÿļ + +Ĭ\\servername\Pub + +(4) [һ] Զ + +ѡ:,÷ַݿ÷÷ + +,ʹĬãƼ + +(5) [һ] ÷ַݿƺλ Ĭֵ(6) [һ] ÷ ѡΪķ(7) [һ] ѡҪݿͷ(8) [һ] ѡעᶩķ(9) [һ] 2 + +BCD + +(1)[]˵[]Ӳ˵ѡ[͹](2)ѡҪݿ⣬Ȼ󵥻[](3)[]ʾԻе[һ]ϵͳͻᵯһԻ򡣶ԻϵǸƵ͡ѡһҲĬϵĿշ(ҿȥ)(4)[һ]ϵͳҪָԶĸ÷ݿ,SQLSERVERڲͬݿ orACLEACCESS֮ݸơ + +ѡ"SQL SERVER 2000"ݿ + +(5)[һ]ϵͳ͵һµĶԻҲѡҪı + +ע: ǰѡ񷢲 һֻѡı + +(6)ѡ񷢲ƺ(7)Զ巢 ṩѡ: + + ҽԶɸѡ,ĺͻԶ + + ָʽ Զķʽ + +(8)[һ] ѡɸѡķʽ(9)[һ] ѡǷ1)ѡ,ҪڷӶķ + +: []->[]->[÷ķͷַ]->[ķ] + +ڶķʱֵʾ:ķ + +ȻҪ½취 + +[ҵ]->[]->[]->[]->[ѡ] ѡ2)ѡ,öķʱʾ(10)[һ] ÿ (11)[һ] + +ɳĴ󴴽ݿҲͱһݿ + + + +srv1...authorֶ:id,name,phone, srv2...authorֶ:id,name,telphone,adress + + + +Ҫ + +srv1...authorӼ¼srv1...author¼srv1...authorphoneֶθ£srv1...authorӦֶtelphone + +--*/ + + + +--µĴ--1. srv1 ϴӷ,Ա srv1 в srv2,ʵͬexec sp_addlinkedserver 'srv2','','SQLOLEDB','srv2sqlʵip' exec sp_addlinkedsrvlogin 'srv2','false',null,'û','' + +go + +--2. srv1 srv2 ̨, msdtc(ֲʽ),ΪԶ + +ҵĵ--------Ҽ Distributed Transaction Coordinator------ΪԶ + +go + + + + + +--Ȼ󴴽һҵʱͬ洢̾ + + + +ҵ + +----SQL Server--Ҽҵ--½ҵ--""ҵ--""--½--""벽--""ѡ"Transact-SQL ű(TSQL)" --"ݿ"ѡִݿ--""Ҫִе: exec p_process --ȷ--""--½--""--""ѡҵִа--ѡ"" --""ʱ䰲 + + + +ȻSQL Agent,ΪԶ,ҵᱻִ + + +÷: + +ҵĵ--------Ҽ SQLSERVERAGENT------ѡ"Զ"--ȷ. + + +--3.ʵͬķ2,ʱͬ + + + +--srv1дµͬ洢 + +create proc p_process + +as + +--޸Ĺ + +update b set name=i.name,telphone=i.telphone + +from srv2..dbo.author b,author i + +where b.id=i.id and + +(b.name <> i.name or b.telphone <> i.telphone) + + + +--insert srv2..dbo.author(id,name,telphone) + +select id,name,telphone from author i + +where not exists( + +select * from srv2..dbo.author where id=i.id) + + + +--ɾѾɾ(ҪĻ) + +delete b + +from srv2..dbo.author b + +where not exists( + +select * from author where id=b.id) + +go