Injection technology--universal Password injection

"Experimental Purpose"

1) Understanding the principle of "universal password"

2) Learn the use of "Universal password"

"Experimental principle"

When a user authenticates a user name and password, the Web site needs to query the database. Querying the database is the execution of the SQL statement. For this BBS forum, when the user logs on, the database query operation (SQL statement) executed in the background is [Select user_id,user_type,email from Userswhere user_id= ' username ' and password= ' password ']. Because the Web site background in the database query does not filter the single quotation marks, when entering the user name [admin] and the universal password [2 ' or ' 1], the executed SQL statement is [Select User_id,user_type,email from Userswhere User_id= ' admin ' and password= ' 2 ' or ' 1 '. Also, because the logical operator in the SQL statement has precedence, [=] takes precedence over [And],[and] over [or], and it applies transitivity. Therefore, this SQL statement is parsed in the background, divided into two sentences [Select user_id,user_type,email from Userswhere user_id= ' admin ' and password= ' 2 '] and [' 1 '], A logical OR operation of two bool values, constant true. The query result of the SQL statement is true, which means that authentication is successful and can be logged into the system.

"Experimental Steps"

First, the use of universal password injection

1.1 Select a forum with vulnerabilities

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/77/C2/wKiom1ZtnF_w5FEAAAB8msg79nE492.png "style=" float: none; "title=" 11.png "alt=" Wkiom1ztnf_w5feaaab8msg79ne492.png "/>

1.2 Enter the user name "admin", password "2 ' or ' 1", you can enter the forum

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/77/C1/wKioL1ZtnGWyiCHQAAB38o6L1lY395.png "style=" float: none; "title=" 22.png "alt=" Wkiol1ztngwyichqaab38o6l1ly395.png "/>

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M02/77/C1/wKioL1ZtnGjgup0ZAADg-BBLT8o228.png "style=" float: none; "title=" 33.png "alt=" Wkiol1ztngjgup0zaadg-bblt8o228.png "/>

This article from "Hong Seven Public" blog, reproduced please contact the author!

Injection technology--universal Password injection