如何利用“EXEC @sql”？
我的同事的代码不安全，并允许用户上传要在服务器上运行的 SQL 文件。 他删除了文件中的任何关键字，例如“EXEC”、“DROP”、“UPDATE”、“INSERT”、“TRUNC”
我想通过利用他的方法向他展示他的错误。 EXEC ( @sql )
我的第一次尝试将是 'EXEXECEC (N''SELECT ''You DRDROPOPped the ball Bob!'')'
但他可能会过滤掉所有这些循环输出。
有没有办法可以利用我同事的代码？或者过滤掉关键词就够了吗？
编辑：我让他检查他的代码。如果代码包含关键字，他不会执行它。我仍在尝试找出如何使用二进制转换来利用它。
My co-worker is being unsafe with his code and is allowing a user to upload an SQL file to be run on the server.
He strips out any key words in the file such as "EXEC", "DROP", "UPDATE", "INSERT", "TRUNC"
I want to show him the error of his ways by exploiting his EXEC ( @sql )
My first attempt will be with 'EXEXECEC (N''SELECT ''You DRDROPOPped the ball Bob!'')'
But he might filter that all out in a loop.
Is there a way I can exploit my co-worker's code? Or is filtering out the key words enough?
Edit: I got him to check in his code. If the code contains a keyword he does not execute it. I'm still trying to figure out how to exploit this using the binary conversion.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
告诉你的同事他是个白痴。
执行混淆的 SQL 查询，例如：
select @sql = 0x44524f5020426f627350616e7473这将需要根据其余代码的外观进行一些调整，但想法是将代码编码为十六进制并执行它（或者更确切地说，让它被执行）。还有其他方法可以混淆要注入的代码。
你那里有一个巨大的安全漏洞。有趣的是，这甚至不需要重新发明。阻止此类事情发生的正确方法是创建并使用具有正确权限的帐户（例如：只能对表 x、y 和 z 执行
select查询）。Tell your co-worker he's a moron.
Do an obfuscated SQL query, something like:
select @sql = 0x44524f5020426f627350616e7473This will need some tweaking depending on what the rest of the code looks like, but the idea is to encode your code in hex and execute it (or rather, let it be executed). There are other ways to obfuscate code to be injected.
You've got a huge security hole there. And the funny part is, this is not even something that needs to be reinvented. The proper way to stop such things from happening is to create and use an account with the correct permissions (eg: can only perform
selectqueries on tables x, y and z).看看 ASCII 编码/二进制攻击 ...
应该让你的朋友相信他注定要失败..;)
这里有一些关于如何编码字符串的帮助..
在 SQL 中将字符串转换为十六进制
Have a look at ASCII Encoded/Binary attacks ...
should convince your friend he is doomed.. ;)
And here some help on how to encode the strings ..
Converting a String to HEX in SQL