你们有 SQL 注入测试“Ammo”吗？
当阅读有关 SQL 注入和 XSS 的内容时，我想知道你们是否有一个字符串可以用来识别这些漏洞和其他漏洞。
可以将其放入网站数据库中以黑盒检查该字段是否安全的字符串。 （将对一些内部工具进行大型测试）
粗略的例子，想知道你们是否知道更多？
"a' 或 '1'='1"
"center'> < script>alert('test')< /script>"
编辑：在SO上发现了一个很好的XSS问题
When reading about SQL Injection and XSS i was wondering if you guys have a single string that could be used to identify those vulnerabilities and others.
A string that could be thrown into a website database to black box check if that field is safe or not. (going to do a large test on a few inhouse tools)
Rough example, wondering if you guys know of more?
"a' or '1'='1"
"center'> < script>alert('test')< /script>"
EDIT: Found a nice XSS question on SO
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我发现了一些不错的 Firefox 插件可以做到这一点。
XSS Me
SQL 注入我
I've found some nice firefox addons that do the trick.
XSS Me
SQL Inject Me
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet 有很多测试 SQL 注入的示例。
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet has lots of examples for testing SQL injection.
http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/< /a>
包括大多数数据库的版本，包括绕过标准转义的十六进制技巧。
http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/
Includes versions for most DBs, including Hex tricks that bypass standard escaping.
老实说，有一些工具可以很好地测试 SQL 注入，但老实说，它们并不能理想地完全取代手动测试和代码审查。
要使用您的示例，有些情况下“or (1=1)”不起作用，但“or/**/ (1=1);--”起作用。
有时，调整某些字符串会提供不同的结果，具体取决于字符编码和一般创造力等因素。 还值得一提的是，有时您的 Web 应用程序中也无法免受第三方工具的影响。 永远不要低估人们的创造力，尤其是当您拥有公共网站时。
这是一个非常好的备忘单。
为了进行测试，我使用 Paros，它有一个有趣的网站扫描工具，您也可以运行它这也发现了一些问题。
这个问题重复了SQL注入漫画。
Honestly there are some tools that are pretty good a testing for SQL Injection, but honestly they don't fully replace manual testing and code review ideally.
To use your example there are situations where "or (1=1)" doesn't work but "or/**/ (1=1);--" does.
Sometimes tweaking certain strings will provide different results, depending on things like character encoding and general creativity. It also bears mentioning that sometimes you aren't safe from 3rd party tools in your web application as well. Never underestimate the creativity of people, especially if you have a public website.
This is a pretty good cheatsheet.
To do my testing I use Paros, it has an interesting website scanning tool that you can also run that finds some problems as well.
This question bears the repeating of this SQL Injection cartoon.
有关示例，请参阅 OWASP 站点。
See the OWASP site for examples.