SQL Injection topic-Sort posts

SQL injection is accessed from the normal WWW port, and it seems to be no different from the general web page access, so the current Municipal firewall does not alert SQL injection, if the Administrator does not check IIS logs, it may be invisible for a long time.
With the development of the B/S mode application, this mode is used to write the application Program More and more programmers. However, due to the low entry threshold in this industry, the programmer's level and experience are also uneven. A considerable number of programmers are writing Code The validity of user input data is not determined, so that the application has security risks. You can submit a piece of database query code and obtain the desired data based on the results returned by the program. This is called SQL injection, that is, SQL injection.
SQL injection is accessed from the normal WWW port, and it seems to be no different from the general web page access, so the current Municipal firewall does not alert SQL injection, if the Administrator does not check IIS logs, it may be invisible for a long time.
However, the SQL injection method is quite flexible, and many unexpected situations may occur during the injection process. It is the fundamental difference between a master and a cainiao to analyze the specific situation and construct clever SQL statements to obtain the desired data.
Full access to SQL Injection Vulnerabilities-Quick Start
SQL injection is accessed from the normal WWW port, and it seems to be no different from the general web page access, so the current Municipal firewall does not alert SQL injection, if the Administrator does not check IIS logs, it may be invisible for a long time.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449834.aspx
Full access to SQL Injection Vulnerabilities-advanced
The general steps of SQL injection: first, determine the environment, find the injection point, and determine the database type. Second, reconstruct the original appearance of the SQL statement in mind based on the injection parameter type.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449870.aspx
Full access to SQL Injection Vulnerabilities-advanced
After reading the introductory and advanced articles, you can practice a little bit to crack common websites. However, if you cannot guess the table name or the program author filters out some special characters, how can you improve the injection success rate? How can we improve the efficiency of guessing?
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449883.aspx
SQL injection attacks per day
Simple SQL Injection principles and general attack steps, Article The author wants to learn about SQL injection attacks in a day.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449901.aspx
Advanced SQL Injection in SQL Server Applications
This document details the SQL injection technology, which is applicable to the popular IIS + ASP + sqlserver platform. It discusses which SQL statements can be injected into applications through various methods, and records attack-related data validation and database locking.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449913.aspx
Compile a common asp SQL Injection Protection Program
If you write a common SQL anti-injection program, HTTP requests are similar to get and post requests. Therefore, you only need to filter out invalid characters in the parameter information of all post or get requests in the file, therefore, we can filter HTTP request information to determine whether it is being attacked by SQL injection.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449925.aspx
Use the instr () function to prevent SQL injection attacks
I have been learning ASP for some time. I have been writing my own program for the past few days and have encountered many problems. I have to consider some of the current vulnerabilities, for example, 'or and 1 = 1 and so on! Let's talk about how to block this vulnerability today! Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449932.aspx
Principles and Prevention Measures of SQL injection attacks
ASP programming threshold is very low, it is easy for beginners to get on the road. In a short period of time, new users often have been able to compile dynamic websites that seem to be perfect. In terms of functions, the experts can do the same, and the new users can do the same.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449940.aspx
Cross-Site SQL Injection
Learn how to get the desired content from the database.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449948.aspx
Prevent SQL injection attacks
SQL injection attacks are designed to exploit vulnerabilities, running SQL commands on the target server and other attacks dynamically generate SQL commands without verifying user input data is the main cause of the successful SQL injection attack.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449951.aspx
Prevention of SQL injection attacks in Dreamweaver
In terms of security, the most common concern for new users is the SQL injection vulnerability. Using nbsi 2.0 to scan some asp websites on the Internet, you can find SQL Injection Vulnerabilities in many ASP websites. Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449953.aspx
PHP and SQL injection attacks
SQL injection attacks are the most common means for hackers to attack websites. If your site does not use strict user input tests, it is often vulnerable to SQL injection attacks. SQL injection attacks are usually implemented by submitting bad data or query statements to the site data library, which may expose, change, or delete records in the database. Next we will talk about how SQL injection attacks are implemented and how to prevent them.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449956.aspx
Zero Distance from SQL injection attacks
Once and again SQL injection and intrusion, once and again the website is hacked. In that case, vulnerabilities are inevitable. Is there no way to solve them? This article explains the principles of SQL injection and provides some preventive methods.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449959.aspx
SQL Injection Technology and cross-site scripting attack detection
In the last two years, security experts should pay more attention to attacks at the network application layer. No matter how strong firewall rule settings you have or how often you fix vulnerabilities, if your network application developers do not follow the security code for development, attackers will access your system through port 80.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449961.aspx
Entry-level cainiao: SQL injection attacks
Generally, a smaller news site program in China has the "" & request vulnerability. The following describes the attack methods.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449963.aspx
Three-Step Blocking SQL Injection Vulnerability
There are good ways to defend against SQL injection. Step 1: many new users download SQL universal anti-injection system programs from the Internet and use them in the header of the page to prevent manual injection tests.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449965.aspx
SQL Injection practice-use "DBO" to obtain SQL Management and System Permissions
If a syntax error occurs when "DBO" is displayed for a column whose data type is int, you can use the method described below to obtain system management permissions, if a syntax error occurs when "ABC" is used to convert a column whose data type is int, you cannot use the following description to obtain system permissions.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449967.aspx
Two anti-SQL Injection filtering Codes
A Simple Method for SQL Injection Protection, embedding filtering code in the Web Page Based on the security measures that are considered.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449969.aspx
Blue rain design whole site SQL Injection Vulnerability
In the following article, the SQL injection vulnerability that has never been found in Nowa system modification vulnerabilities! It's only strange that the Blue rain didn't solve the injection problem when modifying the program! This cannot blame me! Who told programmers not to pay attention to security issues?
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449972.aspx
The whole process of SQL Injection penetrating a website of a network security company
I wrote this article not to tell you how to perform intrusion, but to remind you that "intrusion is accidental, but security is not inevitable." Do not neglect some small operational details.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449973.aspx
SQL Injection defense
SQL Injection modifies the website database through the web page. It can directly add users with administrator permissions to the database to ultimately obtain system administrator permissions. Hackers can use the administrator privilege to obtain files on the website or add Trojans and malicious programs on the webpage, which brings great harm to the website and the netizens who access the website. details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449976.aspx
Ultimate prevention of SQL Injection Vulnerabilities
In fact, the SQL injection vulnerability is not terrible. You can take full measures by understanding the principles and patience! The following are four functions that are sufficient for your defense against all SQL injection vulnerabilities! You can understand the code. Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449979.aspx
SQL Injection and ASP Trojan upload
After SQL injection, how to upload Trojans has always been a headache. Here I provide another method for uploading Trojans.
1. During SQL injection, xp_mongoshell is used to write an ASP file that can write files to the server.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449983.aspx
How to protect the database during SQL Injection
SQL injection is an effective policy to prevent database attacks. Attackers inject an SQL statement into another statement, which usually damages your database. Web sites with database interfaces are usually vulnerable to SQL injection because they are based on dynamic SQL.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449986.aspx
Design the whole site SQL injection vulnerability in tianchen
From the perspective of a security worker, the author has made a detailed test on the SQL injection vulnerability of the entire site designed in the morning.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449988.aspx
SQL injection attacks and Prevention
I have never studied ASP or PHP programming in a system, or access, SQL Server, MySQL, or other databases in a system. So I am not a programmer, although I often do something similar to a programmer.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449991.aspx
Use vbs to write attack scripts for port 80 such as SQL Injection
I accidentally opened a vbs script when I rummaged through the machine last night. Suddenly I found a previously unknown object named test. sendrequest ("http: //" & g_sserver & "/testfiles/browser. ASP "), although the object has not been seen, but the meaning is obvious: Send HTTP request.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449992.aspx
C # Check strings to prevent SQL injection attacks
These days, it seems that SQL injection attacks are in full swing in csdn discussions... I will try again .. as shown in the following figure, the checkparams function can receive arbitrary parameters. If a parameter contains a string, the function checks the string. For example, there is a set of parameters (such as array, which in short implements icollection ), checks the string elements in the set.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449994.aspx
Analysis of SQL Injection 80004005 and other error messages
This article describes in detail some common causes for the Microsoft Data Access Component (MDAC) to receive the error 0x800040005. MDAC includes ActiveX Data Objects, ole db, and Remote Data Service (RDS ). This article also discusses other error messages, including 80040e21, 80040e14, and 80040e10.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3449996.aspx
Forum on SQL injection and intrusion into dynamic Web SQL
The latest version is 7.0 + SP2. It should be said that the security is already high. Therefore, it is difficult to break through the script itself. However, we can indirectly "get" the dynamic network through some external means. At present, the combination of IIS + ASP + SQL2000 is quite common. However, when a website uses a large number of ASP script programs, it is inevitable that there will be no leakage. If an SQL injection point exists on a host and the host is installed with the dynamic SQL version, you can basically conclude that this dynamic network is yours. Next let's take a look at the instance. Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3450001.aspx
Using SQL Injection for 2 minutes
When talking about the light, the snow, and the knives, it can be said that they are all well-known and well-known. These are the works of Xiao Rongge. Every time I mention my brother Rong, my admiration is like a flood of rivers and rivers ~~~~ (Coming again !) The new SQL injection tool has been released by Mr. Rong, who worships us. This time, the black friends who like to use SQL injection to intrude into the website are blessed. Xiao Rongge's tool is strong! I used it to deal with our local information port. From the search for injection vulnerabilities to the success of injection attacks, through accurate timing, it took only 3 minutes and 40 seconds, strong! Believe it? Let's take a look at my intrusion process.
Details>
Http://blog.csdn.net/wufeng4552/archive/2008/12/05/3450005.aspx