SQL 注入受损站点？
这可能听起来像是一个奇怪的问题，但是有没有什么地方可以下载一个容易受到 sql 注入攻击的网站（url 类型不是登录绕过）？
我正在制作一个漏洞扫描器，我想学习一些 SQLi，以便我可以将其包含在我的项目中。
谢谢，不需要太华丽。足够练习了。
This may sound like a weird question but is there any where I can download a website that is vulnerable to sql injection the url kind not login bypass?
I'm making a vulnerability scanner and I want to learn some SQLi so i can include it in my project.
Thanks, it doesn't need to be fancy. Just enough to practice on.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
OWASP WebGoat 是常见的示例。包括 SQL 注入漏洞。
OWASP WebGoat is the usual example. Includes SQL injection vulnerabilities.
不，您无法下载他们的网站来测试注入漏洞。您需要下载他们的整个数据库和配置才能执行您所说的操作。如果您想善意地检查各个站点的安全性，您必须向他们询问他们的系统并为您自己建模。 OWASP 适用于最近未更新补丁的系统，就像tackline 的评论一样——它是第一个端口。
No, you cannot download their site to test for injection vulnerabilities. You need to download their whole DB and configs to do what you are saying. If you want to benevolently go checking the security of various sites, you have to ask them about their system and model it on your own. OWASP works on systems not recently updated with patches, like the comment of tackline-its a first port.
OWAPS 的 WebGoat 是一个易于受到攻击的应用程序，它是对现实世界漏洞的模拟。 The Whitebox 是现实世界漏洞的集合，它有 2 个 Web 应用程序被废弃，因为应用程序如此不安全。它还面临一系列挑战，其中存在从现实世界应用程序中获取的易受攻击的代码片段。该项目存在现实世界中的 SQL 注入以及更严重的漏洞。
尝试使用 Wapiti（开源）或 Acunetix ($) 或 NTOSpider($$$) 扫描易受攻击的应用程序。然后尝试使用应用程序，创建博客文章等，然后再次扫描。
另请查看 该死的脆弱 Linux 和 Google 贾尔斯堡。
OWAPS's WebGoat is an application that is built to be vulnerable to attack, it is a simulation of real world vulnerabilities. The Whitebox is a collection of real world vulnerabilities, it has 2 web applications that where abandoned because the applications where so insecure. It also has a set of challenges there are vulnerable code snips taken from real world applications. This project has real world sql injection as well more serious vulnerabilities.
Try scanning the vulnerable apps with Wapiti (open source) or Acunetix ($) or NTOSpider($$$). Then try using the applications, create blog posts ect, and then scan it again.
Also check out Damn Vulnerable Linux and Google Jarlsburg.