Shulou(Shulou.com)05/31 Report--

This article mainly shows you the "sample analysis of WAITFOR DELAY injection in SQL Server", which is easy to understand and clear. I hope it can help you solve your doubts. Let the editor lead you to study and study the "sample analysis of WAITFOR DELAY injection in SQL Server".

WAITFOR DELAY injection of SQL Server

WAITFOR is a flow control statement provided by Transact-SQL in SQL Server. Its function is to wait for a specific time and then continue to execute subsequent statements. It contains a parameter DELAY that specifies the time to wait. If the statement is successfully injected, it will cause the database to return records and Web requests will also respond with a delay of a certain amount of time. Because this statement does not involve situations such as conditional judgment, it is easy to inject successfully. Based on whether there is a delay in the Web request, the penetration tester can determine whether there is an injection vulnerability in the site. At the same time, because the statement does not return specific content, it is also an important detection method of blind injection.

For example, build the following injection statement:

Find.asp?ID=300 WAITFOR DELAY '0VOUR 0MULTHUBE-

Among them, WAITFOR DELAY '0VUL0VOUR 4 seconds-indicates a delay of 4 seconds before the execution continues. In this way, the response of the web page will be delayed by 4 seconds.

PS: because WAITFOR is not a standard statement for SQL, it only applies to SQL Server databases.

The above is all the content of the article "sample Analysis of WAITFOR DELAY injection in SQL Server". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.