mssql inj help

Discussion in 'Уязвимости' started by -=megahertz=-, 22 Mar 2008.

  1. Kissa2k

    Kissa2k New Member

    Joined:
    1 Jul 2008
    Messages:
    5
    Likes Received:
    0
    Reputations:
    0
    У меня тоже странная проблема..
    Такой запроc 1 or 1=(select top 1 table_name from information_schema.tables)--
    выдает ошибку Incorrect syntax near the keyword 'top'.
    а при запросе
    1 or(1=(select(max(table_name))from[information_schema].tables))--
    получаю
    An aggregate may not appear in the WHERE clause unless it is in a subquery contained in a HAVING clause or a select list, and the column being aggregated is an outer reference.
     
  2. Shadow6120

    Shadow6120 Member

    Joined:
    26 Dec 2008
    Messages:
    13
    Likes Received:
    5
    Reputations:
    0
    А что если пишет
    Incorrect syntax near the keyword 'or'??
     
  3. Kissa2k

    Kissa2k New Member

    Joined:
    1 Jul 2008
    Messages:
    5
    Likes Received:
    0
    Reputations:
    0
    Забыл в конце поставить комментарий?
     
  4. Shadow6120

    Shadow6120 Member

    Joined:
    26 Dec 2008
    Messages:
    13
    Likes Received:
    5
    Reputations:
    0
    Kissa2k, нет конечно, меня интересует, можно ли сделать запрос, дающий тоже самое что и
    -1+OR+1=(SELECT+TOP+1+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES)--
    но без использования OR
     
    #64 Shadow6120, 25 Mar 2009
    Last edited: 25 Mar 2009
  5. Kissa2k

    Kissa2k New Member

    Joined:
    1 Jul 2008
    Messages:
    5
    Likes Received:
    0
    Reputations:
    0
    Можно использовать UNION, но тогда придется подбирать кол-во столбцов в запросе.
     
  6. Shadow6120

    Shadow6120 Member

    Joined:
    26 Dec 2008
    Messages:
    13
    Likes Received:
    5
    Reputations:
    0
    Kissa2k, union тоже фильтруется((((
     
  7. Kakoytoxaker

    Kakoytoxaker Elder - Старейшина

    Joined:
    18 Feb 2008
    Messages:
    1,038
    Likes Received:
    1,138
    Reputations:
    350
    Shadow6120
    Ты и в самом деле думаешь. что фильтруется "or" ?

    Ошибку переведи нормально
    Incorrect syntax near the keyword 'or'

    near--около

    Добавь кавычку,скобку, другую кавычку, смени плюсы, нужное подчеркнуть
     
  8. Gerceg

    Gerceg New Member

    Joined:
    9 Feb 2009
    Messages:
    31
    Likes Received:
    0
    Reputations:
    -5
    Были такие же траблы,решил с помощью вас
     
Loading...