如何自动测试网站的 SQL 注入漏洞
这是一个基本计划。我很高兴能够取得任何类似成功的成果，这是一个 Uni 项目。伪代码很棒。
- 抓取网站。
- 在每个页面上搜索表单。
- 提交每份表格而不填写详细信息将导致失败。
- 在表单的第一个字段中填写“--”。
- 提交表格并将响应与失败（由 3 引出）进行比较。
- 如果响应（由 5 引发）不同（与失败），则假设存在漏洞。
- 如果相同（响应 = 失败），则返回到 4，但移至下一个字段。
- 如果没有更多字段，请移至另一页。
...
但是，6. 显然既是应用程序的关键部分又是错误的。例如，页面可能会像这样响应
Error: '-- is not a valid user name.
在第 4 阶段中的位置。响应是
Error: is not a valid user name.
或
Error: username must be a minimum of 6 characters.
Here's a basic plan. I'm happy to produce anything resembling success, it's a Uni project. Pseudo code is great.
- Spider the site.
- Search for forms on each page.
- Submit each form without filling in the details to elicit a guaranteed fail.
- Fill in the first field on the form with '-- .
- Submit the form and compare the response to the fail (elicited by 3).
- If response (elicited by 5) is different (than fail) then assume vulnerability.
- If same (response = fail) then return to 4. but move to the next field.
- If no more fields remain, move to another page.
...
However, 6. is clearly both the critical part of the application and wrong. For example, a page might respond like this
Error: '-- is not a valid user name.
Where in stage 4. the response was
Error: is not a valid user name.
Or
Error: username must be a minimum of 6 characters.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
看起来在 (4) 处，您想首先尝试发送一些良性值，以便您可以看到在正常情况下返回的页面类型。
例如，生成一个随机的三字母“用户名”并提交。您可能会收到类似“错误：bfw 不是有效的用户名”的响应。或“错误：用户名太短”。
完成此操作后，您可以发送尝试 SQL 注入的字符串，看看结果是否有本质上的不同。因此，如果您发送
'--并获得与发送随机良性“用户名”时相同的结果，则它可能不易受到攻击。另一方面，如果您收到的响应不同，并且包含类似“警告，您的 SQL 第 1 行有错误...”之类的文本，那么它可能容易受到攻击。 （不过，它不必发出警告让您断定它容易受到攻击。即使是通用错误页面，如果它与您从良性数据获得的响应有很大不同，也可能表明存在漏洞。）It seems like at (4), you want to try sending some benign values first so you can see what type of page is returned under normal conditions.
For example, generate a random three-letter "user name" and submit it. You'll probably get a response like "Error: bfw is not a valid user name". or "Error: username too short".
Once you've done that, you can send your string attempting SQL injection and see if the result is qualitatively different. So if you send
'--and get the same result as you did when you sent your random benign "username", it's probably not vulnerable. On the other hand, if you get a response back that's different and includes text like "Warning, you have an error in your SQL at line 1..." then it's probably vulnerable. (It doesn't have to spit out warnings for you to conclude it's vulnerable, though. Even a generic error page might indicate vulnerability if it's substantially different to the response you got from your benign data.)Justin Clarke 的“SQL 注入攻击和防御”。
提供了许多测试来发现和确认 SQL 注入漏洞，这是我对第 65 页的总结。
错误触发
“发送
'或'--并期望接收错误。”错误消息或 500 服务器错误表明存在漏洞。整齐地包含
'或'--的响应（如用户'或'--不可用）密码...）可能不容易受到攻击，除非它是堆栈跟踪。始终为 true 条件
“发送
1' 或 '1'='1或1') 或 ('1'='1并期望收到 当响应代码为 200 并且响应中未收到攻击字符串时，可以假定站点存在漏洞。包含单词“error”或攻击字符串的页面表明存在抵抗力，就像500.
没有条件
“发送
value” 或 '1'='2或value') 或 ('1'='2并期望易受攻击的应用程序就好像它只收到值一样进行响应。"始终为 false 条件
"
1' 和 '1'='2或1' ) 和 ('1'='2。如果成功，则不会从表中返回任何行。"Microsoft SQL Server 连接
"
1' 或 'ab'='a '+'b或1') 或 ('ab'='a'+'b。如果成功，则返回相同信息作为始终为真的条件"
MySQL 连接
"
1' 或 'ab'='a' 'b或1') 或 ('ab'=' a' 'b如果成功，则返回相同的结果。信息作为始终为真的条件"
Oracle 连接
"
1' 或 'ab'='a'||'b或1') 或 ('ab' ='a'||'b如果成功，则返回相同的结果。信息作为始终真实的条件”
本书中包含了更多示例。
"SQL Injection Attacks and Defense" by Justin Clarke.
Offers a number of tests to discover and confirm SQL injection vulnerabilities, here's my summary of page 65.
Error triggering
"Send
'or'--and expect to receive an error."An error message or 500 server error indicates vulnerability. Responses tidily containing
'or'--(as in user'or'--is not available with that password...) probably aren't vulnerable unless its a stack-trace.Always true condition
"Send
1' or '1'='1or1') or ('1'='1and expect to receive every entry in the database."A site can be assumed to be vulnerable when the response code is 200 and the attack string is not received in the response. Pages containing the word 'error' or the attack string indicate resistance, as does a 500.
No condition
"Send
value' or '1'='2orvalue') or ('1'='2and expect a vulnerable app to respond as though it had only receivedvalue."Always false condition
"
1' and '1'='2or1') and ('1'='2. If successful, it returns no rows from the table."Microsoft SQL Server concatenation
"
1' or 'ab'='a'+'bor1') or ('ab'='a'+'b. If successful, it returns the sameinformation as an always true condition"
MySQL concatenation
"
1' or 'ab'='a' 'bor1') or ('ab'='a' 'b. If successful, it returns the sameinformation as an always true condition"
Oracle concatenation
"
1' or 'ab'='a'||'bor1') or ('ab'='a'||'b. If successful, it returns the sameinformation as an always true condition"
Further examples are included throughout the book.