Security testing-SQL injection

1. Tool Testing:

Using Sqlmap for scanning

2. Manual testing:

Observes whether the value of the parameter is a numeric type. If the digital type is tested digitally, skip to the 4th step for character testing (for example, if a that indicates a character type, if 2 appears as a digital test)

The measured parameter is added to the test statement "and 1=1", that is, the address bar is filled with "Http://www.exmaple.com/page.xxx?name=value and 1=1", if the correct page is returned to do the next step, otherwise skip to 4th.

After the measured parameter is added to the test statement "and 1=2" (here is the nth parameter for example), the other parameters remain the same, namely: the Address bar is filled with "http://www.exmaple.com/page.xxx?" Name=value and 1=2 ", if you return to the correct page, do the next step, otherwise there is an injection vulnerability, complete the test

Add the measured parameter to the test statement "' and ' 1 ' = ' 1", i.e.: fill in the Address bar "Http://www.exmaple.com/page.xxx?" Name=value ' and ' 1 ' = ' 1 ', if the correct page is returned, do the next step, otherwise there is an injection vulnerability, complete the test

Add the measured parameter to the test statement "' and ' 1 ' = ' 2", i.e.: fill in the Address bar "Http://www.exmaple.com/page.xxx?" Name=value ' and ' 1 ' = ' 2 ', if the correct page is returned there is no vulnerability, otherwise there is an injection vulnerability, complete the test

Execute command:

Sqlmap–r Sql1.txt–threads 10

http://blog.csdn.net/zgyulongfei/article/details/41017493/

MYSQL5 series above has a feature, the table of the information schema

Sqlmap–r sql1.txt–threads--dbs

–CURRENT-DB: Getting the current database

–current-user: Get Current user

Solution:

Ⅰ, restricting database access (required)

Ⅱ, use preprocessing to execute SQL statements, bind to variables in all incoming SQL statements. In this way, the user splicing in the variable, no matter what the content, will be used as a substitute symbol "?" The value of the substitution, the database will not be a malicious user splicing in the data, as part of the SQL statement to parse.

User-related systems (web, app, M-side) should be unified access login

Security testing-SQL injection