SQL 注入来枚举列

Question

以下查询用于从数据库中获取所有表

1 = select top 1 name 
from sys.tables 
where object_id = (select top 1 object_id 
from (select top 5 object_id 
from sys.tables 
order by object_id
)sq 
order by object_id DESC 
)

如何使用类似的 sys.columns 方法枚举数据库中所有易受攻击的列

谢谢

Answer 1

为什么不简单地使用row_number()代替：

select t.name 
from (select t.*, row_number() over (order by object_id) as seq
from sys.tables t
) t
where seq = 5;