web安全測試&滲透測試之sql注入~~

本文轉載自查看原文 2015-01-09 18:20 22683

滲透測試概念:

詳見百度百科

http://baike.baidu.com/link?url=T3avJhH3_MunEIk9fPzEX5hcSv2IqQlhAfokBzAG4M1CztQrSbwsRkSerdBe17H6tTF5IleOCc7R3ThIBYNO-q

前言：

安全測試范圍極廣，開門見山，樓主對這行了解的也不是太深，也是在學習探索階段，此文，也是對自己學習的總結與記錄和簡單的分享；這里沒有具體工具的使用方法，更多的是原理細節的了解和解決方案的探討。

code部分:

html+jsp+mysql，實現登錄與新增數據功能。

html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>web安全測試之sql注入</title>
</head>
<body bgcolor="#ffffff">
<form action="chkLogin.jsp" method="POST">
  <input type="text" name="user" /><br />
  <input type="password" name="pass" /><br />
  <input type="Submit" value="登錄" />
</form>
<form action="insert.jsp" method="POST">
  <input type="text" name="user" /><br />
  <input type="text" name="pwd" /><br />
  <input type="Submit" value="新增" />
</form>
</body>
</html>

View Code

jsp1

<%@ page contentType="text/html; charset=utf-8" %>
<%@ page import="java.sql.*" %>
<html>
<head>
<title>chkLogin.jsp</title>
</head>
<body bgcolor="#ffffff">
<%
  String user = request.getParameter("user");
  String pass = request.getParameter("pass");

  Connection con = null;
  PreparedStatement ps = null;
  ResultSet rs = null;
  String sql =null;
  try
  {
    Class.forName("com.mysql.jdbc.Driver");
    con = java.sql.DriverManager.getConnection("jdbc:mysql://192.168.0.157/webTest?useUnicode=true&characterEncoding=utf-8","root","123456");
    sql= "SELECT * FROM user WHERE name='"+user+"' AND pwd ='"+pass+"'";
    ps = con.prepareStatement(sql);
//    ps = con.prepareStatement("SELECT * FROM user WHERE name=? AND pwd =?");
//    ps.setString(1, user);
//    ps.setString(2, pass);
    rs = ps.executeQuery();
    if ( rs.next())
    {

      out.println("登錄成功!");
      out.println("sql:"+sql);
    }
    else
    {
      out.println("登錄失敗!");
      out.println("sql:"+sql);
    }
  }catch(Exception ex)
  { 
     out.println("登錄異常!");
     out.println("sql:"+sql);  
     out.println("Exception:"+ex);
  }finally{
    if ( null != rs)
    {
      rs.close();
      rs = null;
    }
    if ( null != ps)
    {
      ps.close();
      ps = null;
    }
    if ( null != con){
      con.close();
      con = null;
    }
  }
%>
</body>
</html>

View Code

jsp2

<%@ page contentType="text/html; charset=utf-8" %>
<%@ page import="java.sql.*" %>
<html>
<head>
<title>chkLogin.jsp</title>
</head>
<body bgcolor="#ffffff">
<%
  String user = request.getParameter("user");
  String pass = request.getParameter("pwd");

  Connection con = null;
  PreparedStatement ps = null;
  ResultSet rs = null;
  String sql =null;
  int r = 0;
  try
  {
    Class.forName("com.mysql.jdbc.Driver");
    con = java.sql.DriverManager.getConnection("jdbc:mysql://192.168.0.157/webTest?useUnicode=true&characterEncoding=utf-8","root","123456");
    sql= "insert into user(name,pwd) values ('"+user+"','"+pass+"')";
    ps = con.prepareStatement(sql);
//    ps = con.prepareStatement("SELECT * FROM user WHERE name=? AND pwd =?");
//    ps.setString(1, user);
//    ps.setString(2, pass);
    r = ps.executeUpdate();
    
    if (r>0)
    {

      out.println("添加成功!");
      out.println("sql:"+sql);
    }
    else
    {
      out.println("添加失敗!");
      out.println("sql:"+sql);
    }
  }catch(Exception ex)
  { 
     out.println("添加異常!");
     out.println("sql:"+sql);  
     out.println("Exception:"+ex);
  }finally{
    if ( null != rs)
    {
      rs.close();
      rs = null;
    }
    if ( null != ps)
    {
      ps.close();
      ps = null;
    }
    if ( null != con){
      con.close();
      con = null;
    }
  }
%>
</body>
</html>