SQL injection attack and Defense 2nd Edition Summary of how to determine SQL injection vulnerability

After reading the "SQL Injection attack and defense 2nd version", found that the original can also black site, just a word: too cool.

Briefly summarize the intrusion steps:

1. Determine if there is a SQL Injection Vulnerability

2. Determine the database type

3, the combination of SQL statements, the implementation of infiltration

4, get the highest privileges, how to play on how to play

Learn the SQL injection vulnerability that requires material:

Browser X1

Wamp Integration Pack X1

PHP Script a X1

Database A X1

　　

PHP Script content:

1  <? PHP2      //Get Data3$id=Empty ($_get[' id '])?"NULL": $_get[' id '];4$name=Empty ($_get[' name '])?"NULL": $_get[' name '];5      //connecting to a database6$connect=Mysql_connect ('localhost','Root','123456');7      //Select Database8mysql_select_db ('New', $connect);9      //Combining SQL statementsTen$sql="SELECT *  fromOnewhereId={$id}orName='{$name}'"; One      //Execute SQL statement A$result=mysql_query ($sql); -      //Show Data Results -       while($row=mysql_fetch_array ($result)) { theecho "<Pre>"; - Print_r ($row); -echo "</Pre>"; -}

View Code

Creating databases and data tables

1 --Create a database2 CreateDatabasesif existsnew;3 --Create a data table4 Create TableOne (5Idint  not NULLAuto_incrementPrimary Key,6Namevarchar(Ten) not NULL,7Pwdvarchar(Ten) not NULL,8Priceint  not NULL9) engine=MyISAMdefaultCharSet=UTF8;

View Code

Here are 5 ways to determine if there is a SQL injection vulnerability

1. Judging by operator

2. Judging by connection string

3, according to the inline SQL judgment

4, according to the SQL comment character to judge

5. Judging by Time delay

The following example is a test to determine if there is a SQL injection.

One, according to the < operator > Determine whether there is a SQL vulnerability. The implementation steps are as follows:

Normal operation Flow:

1. Enter the address in the browser

　　　　　　

SQL statement:SELECT * from one where id=1 or name= ' NULL '

2, view the browser output, will find the data ID 1 is output

Non-functioning process, using operators:

1. Enter the address in the browser

SQL statement:SELECT * from one where id=4-1 or name= ' NULL '

2, view the browser output results, will find that the ID 3 data is output. Because SQL performs the 4-1 operation.

B. Based on < string > Determine if there is a SQL vulnerability. The implementation steps are as follows:

Normal operation Flow:

1. Enter the address in the browser

SQL statement:SELECT * from one where id=null or name= ' Hello '

2, check the browser output, will find the name of Hello data is output

Non-normal running smooth, using string connection

1. Enter the address in the browser

SQL statement:SELECT * from one where id=null or name= ' he ' Llo '

2, view the browser output results, will find the name of Hello data is output. Because SQL performs the following: string connection operation.

Third, according to the < string inline > Determine whether there is a SQL Injection vulnerability. The implementation steps are as follows:

Normal operation Smooth:

1. Enter the address in the browser

SQL statement:SELECT * from one where id=null or name= ' Hello '

2, view the browser output results, will find the name of Hello data is output.

Non-normal operation process:

1. Enter the address in the browse

SQL statement:SELECT * from one where id=null or name= ' he ' llo ' or ' 1 ' = ' 1 '

2, view the browser output results, will find all the data is output.

Iv. using <sql notation > to determine if there is a SQL Input Vulnerability

Normal operation Flow:

1. Enter the address in the browser

SQL statement:SELECT * from one where id=3 or name= ' NULL '

2, view the browser output, will find the data ID 3 is displayed

Non-normal operation process:

1. Enter the address in the browser

SQL statement:SELECT * from one where id=3--or name= ' NULL '

2, view the browser output, will find the data ID 3 is displayed

V. Use < time delay > Determine if there is a SQL Injection Vulnerability

Normal operation Flow:

1. Enter the address in the browser

SQL statement:SELECT * from one where id=3 or name= ' NULL '

2, view the browser output, will find the data ID 3 is displayed

Non-normal operation process:

1. Enter the address in the browser

　　　　　　

SQL statement:SELECT * from one where id=3 or sleep (ten) or name= ' NULL '

2, when the browser returns results, there will be a noticeable delay

Note: The database used for this test is a MySQL database, and the SQL statements are for MySQL. Other databases test the same way, as long as the idea is correct all OK.

Note: Sqlmap tools heard very good, you can try.

SQL injection attack and Defense 2nd Edition Summary of how to determine SQL injection vulnerability