Share an example process of SQL injection

SQL injection is very harmful. This article records the entire process of an SQL injection instance. Let’s take a look at how harmful it is.

Initial injection--bypass verification, log in directly

The company website login box is as follows:

Yes I saw that in addition to the account and password, there is also an input box for the company name. According to the form of the input box, it is not difficult to infer that the SQL is written as follows:

SELECT * From Table WHERE Name='XX' and Password='YY' and Corp='ZZ'

I found that the first two do some checks, and the third The input box was ignored, and the loophole is here! When the injection starts, enter the following content in the input box:

Fill in the user name randomly and leave the password blank. In this case, after clicking the login button Logged in successfully. We will find the reason if we look at the final SQL:

SELECT * From Table WHERE Name='SQL inject' and Password='' and Corp='' or 1=1--'

As can be seen from the code, the first half of the single quotes are closed, and the second half of the single quotes are commented with "--", There is an additional condition "1=1" in the middle that is always true, which results in the successful login of any character. The harm of Sql injection is not just anonymous login.

Intermediate injection--obtain information with the help of exceptions.

Now we write in the third input box: “‘ or 1=(SELECT @@version) –”. As follows:

The background SQL becomes like this:

SELECT * From Table WHERE Name='SQL inject' and Password='' and Corp='' or 1=(SELECT @@VERSION)--'

The judgment condition becomes 1=(SELECT @@VERSION), this writing method will definitely results in an error, but the error is exactly what we want. After clicking to log in, the following information appears on the page:

Conversion failed when converting the nvarchar value &#39;Microsoft SQL Server 2008 (SP3) - 10.0.5500.0 (X64) Sep 21 2011 22:45:45 Copyright (c) 1988-2008 Microsoft Corporation Developer Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) &#39; to data type int.

Something terrible happened. The server's operating system and SQL Server version information were actually displayed through errors.

Expansion of harm--obtain all library names, table names, and field names of the server

Next, we enter the following information in the input box: "t' or 1=(SELECT top 1 name FROM master..sysdatabases where name not in (SELECT top 0 name FROM master..sysdatabases))--", it was found that the third input box has a word length limit, but this client The restrictions are in vain and can be removed directly through Google Chrome.

Click to log in, the returned information is as follows:

Conversion failed when converting the nvarchar value 'master' to data type int.

The database name "master" is displayed through an exception! By changing the serial numbers in the above SQL statement in turn, you can get the names of all databases on the server.

Next, enter the following information: "b' or 1=(SELECT top 1 name FROM master..sysobjects where xtype='U' and name not in (SELECT top 1 name FROM master..sysobjects where xtype='U'))--"

The return information is as follows:

Conversion failed when converting the nvarchar value 'spt_fallback_db' to data type int.

We got the first table name in the master database: "spt_fallback_db ”, same as above, changing the serial number in sequence can get all the table names of the library.

Now we take the "spt_fallback_db" table as an example and try to get all the field names in the table. Enter the following code in the input box: "b' or 1=(SELECT top 1 master..syscolumns.name FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master ..sysobjects.name='spt_fallback_db');"

So, I got the error message as follows:

"Conversion failed when converting the nvarchar value 'xserver_name' to data type int.";

In this way, the first field name "xserver_name" comes out, change the serial number in sequence, and Can traverse all field names.

Ultimate goal--obtain data in the database

As we write this, we know that all databases, tables, and fields can be obtained through SQL injection. In order to prevent this article from completely becoming an injection Tutorial, the code for obtaining data will no longer be described, and the purpose of this article has been achieved. What does SQL injection mean? means that all data in the database can be stolen.

After knowing this danger, can anyone still ignore SQL injection vulnerabilities?

Conclusion

Regarding security, this article can summarize the following points:

1. Always be vigilant about the content entered by the user.

2. Only client-side verification equals no verification.

3. Never expose server error messages to users.

In addition, I would like to add a few points:

1. SQL injection can achieve its purpose not only through the input box, but also through Url .

2. In addition to the server error page, there are other ways to obtain database information.

3. You can simulate injection behavior through software. This method can steal information much faster than you think.

4. The vulnerability has nothing to do with the language platform. It is not that asp has injection vulnerabilities but asp.net does not have injection vulnerabilities. Everything depends on whether the designer is careful.

【Related Recommendations】

1. Special Recommendation:"php programmer tools Download the V0.1 version of "Box"

2. How to prevent sql injection? Introducing 5 ways to prevent sql injection

3. Share five famous SQL injection vulnerability scanning tools

4. Share an article of use Example explanation of SQL injection vulnerability drag library

The above is the detailed content of Share an example process of SQL injection. For more information, please follow other related articles on the PHP Chinese website!