设置 SQL 注入蜜罐
我刚刚无意中发现了一个容易受到 SQL 注入攻击的网站 ( 此站点是否容易受到 SQL 注入攻击？）。
这让我对某些网站上尝试过的内容以及攻击尝试的频率感到好奇。
因此，我认为在我的服务器上设置一个蜜罐来查看“黑客”是否/多久/使用什么技术尝试访问我的 SQL 数据会很酷。
我可以想到一些基本的东西来吸引他们，比如：
/login.php / asp url
/adminlogin.php / asp url
searchform
?id=111 url
尝试注入一些 SQL 时，带有一些假 SQL 错误的
。有人有更多/更好的建议/想法/任何设置用于 SQL 注入的蜜罐吗？
I just stumbled on a website vulnerable to an SQL injection attack by mistake ( Is this site vulnerable to an SQL injection attack? ).
That made me curious about what is tried and how often an attack attempt comes by on some website.
So I'm thinking it would be cool to setup a honeypot on my server to see if / how often / using what techniques 'crackers' try to get access to my SQL data.
There are some basic things I can think of to lure them, like:
/login.php / asp url
/adminlogin.php / asp url
A searchform
?id=111 url
with some fake SQL errors when trying to inject some SQL.
Anybody has some more / better suggestion / ideas / whatever to set up a honeypot for SQL injection?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您想设置蜜罐，请参阅这篇文章，它提供了可注入的示例数据。
http://www.webappsec.org/projects/articles/091007.shtml
您可以在此处下载安装文件： http://www.webappsec.org/projects/articles /091007.zip
See this article if you want to setup a honey pot, it's got sample data that's injectable.
http://www.webappsec.org/projects/articles/091007.shtml
You can download the installation files here: http://www.webappsec.org/projects/articles/091007.zip
使用具有已知漏洞的示例页面来构建您的模型。大多数注入器及其工具的驱动都将有字符串进行测试，他们知道这些字符串将在易受攻击的应用程序空间的子集上运行。
例如：
CVE-2011-1546 详细介绍了攻击者可能在 Google 上找到的此类漏洞。 CVE 存储库充满了此类报告，因此您有大量页面可以作为示例构建。
完成蜜罐设置后，在谷歌上对其进行索引。让它与其他任何东西隔离，你就得到了一个基本的 sql 注入蜜罐。
Use an example page that has known vulnerabilities to build your mock up. Most of the drive by injectors and their tools are going to have strings to test for that they know will work on subsets of the vulnerable application space.
For instance:
CVE-2011-1546 details one such vuln on something an attacker is likely to find on google. The CVE repos is full of reports such as that, so you've got plenty of pages to build from as examples.
Once you're done getting your honeypot setup, index it on google. Keep it isolated from anything else, and you've got a rudimentary sql injection honeypot.