> For the complete documentation index, see [llms.txt](https://docs.cooku222.kr/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cooku222.kr/security/web-hacking/lord-of-sql-injection/lord-of-sqlinjection-nessie.md). # \[Lord Of SQLInjection] nessie

#### 특징 \- mssql 적용 \- master, sys, information, prob, wiatfor 등이 막힘 \- 메타데이터의 접근과 time based sql injection(시간 지연)을 방지 \- id가 admin인 행의 pw를 구해야함 \- mssql 에서 쿼리 오류 시 출력해주는 오류 구문을 가지고 Error Based SQL Injection 실행 #### First Try ``` [URL]?id=a' having 1=1 -- ```

\- select id from prob\_nessie where id=’a’ having 1=1만 실행 됨 \- 위와 같은 에러 발생 #### 이유 \- having 구문은 group by 절이 필요한데, group by 절을 입력하지 않아 쿼리 오류가 발생함 \- 인위적으로 id가 admin인 행의 pw를 유발하면 됨 #### Second Try \- pw 부분에서 Type Confusion 오류를 유발시켜 본다. ``` [도메인 값]?id=admin&pw=1' or id='admin' and pw=1 -- ```

→ pw 값이 출력이 되는데, 이를 브라우저 url에 담아서 전송하면 문제를 해결할 수 있다. #### Third Try ``` [URL]?id=admin&pw=115d8d1a422f1f3e ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.cooku222.kr/security/web-hacking/lord-of-sql-injection/lord-of-sqlinjection-nessie.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.