sql - SQL注入枚举列

Question

以下查询用于从数据库中获取所有表

1 = select top 1 name 
    from sys.tables 
    where object_id = (select top 1 object_id 
                       from (select top 5 object_id 
                             from sys.tables 
                             order by object_id
                            )sq 
                       order by object_id DESC 
                      )

如何使用 sys.columns 的类似方法枚举数据库中所有易受攻击的列

谢谢

标签： sqlcode-injection

Answer 1

为什么不简单地使用row_number()：

select t.name 
from (select t.*, row_number() over (order by object_id) as seq
      from sys.tables t
     ) t
where seq = 5;