注：仅供安全研究与学习之用，若将工具做其他用途，由使用者承担全部法律及连带责任，作者及发布者不承担任何法律及连带责任。
|
声明：该公众号分享的安全工具和项目均来源于网络，仅供安全研究与学习之用，如用于其他用途，由使用者承担全部法律及连带责任，与工具作者和本公众号无关。 |
现在只对常读和星标的公众号才展示大图推送，建议大家把猫鼠信安“设为星标”，否则可能看不到了！
1、SQL注入漏洞简介
2、SQL注入的条件
3、审计方法
4、JAVA中执行SQL的几种方式
（1）使用JDBC的java.sql.Statement执行SQL语句
//注册驱动Class.forName("oracle.jdbc.driver.0racleDriver")//获取连接
Connection conn = DriverManager.getConnection(DBURL,DBUser,DBPassWord);
//创建 Statement 对象
Statement state = conn.createStatement);
//执行 SQL
String sql="SELECT*FROM user WHERE id="+id+"";
state. executeQuery(sql);
Class.forName("com.mysql.cj,jdbc.Driver");
coon = DriverManager.getConnection("jdbc:mysql://192.168.88.20:3306/iwebsec?&useSSL=false&serverTimezone=UTC","root","root)";
String id ="2";
String sql ="select* from user where id ="+id;
ps = conn.createStatement();
rs = ps.executeQuery(sql);
while(rs.next())
{
System.out.println("id:"+rs,getlnt("id")+"usermame:"+rs.getString("username")+"password:"+rs.getString("password");
}
（2）使用JDBC的java.sql.PreparedStatement执行SQL语句
//注册驱动
Class. forName("oracle.jdbc.driver.0racleDriver");
//获取连接
Connection conn =DriverManager.getConnection(DBURL,DBUser,DBPasWord);
//实例化 PreparedStatement对象
String sql= "SELECT * FROM user WHERE id= ?";
PreparedStatement preparedStatement = connection.prepareStatement(sql)
//设置占位符为 id变量
preparedStatement.setlnt(1,id);
//执行 SQL语句
ResultSet resultSet = preparedStatement.executeOuery();
（3）使用MyBatis执行SQL语句
package org.mybatis.example;
public interface BlogMapper{
@Select("select * from Blog where id =#(id")
Blog selectBlog(int id);
}
<?xml version="1.0" encoding="UTF-8" 2>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN""http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="org.mybatis.example.BlogMapper">
<select id-"selectBlog" parameterType="int" resultType="Blog">
select * from Blog where id =#(id
</select>
</mapper>
public class mybaitstest{
SqlSessionFactory sessionFactory = null;
SqlSession sqlSession = null;
{String resource = "com/mybatis/mybatisConfigxml";
//加载mybatis 的配置文件(它加关联的映射文件)
Reader reader = null;
try{
reader = Resources.getResourceAsReader(resource);
}catch (IOException e) {
e.printStackTrace();
}
//构建 sqlSession 的工厂
sessionFactory = new SqlSessionFactoryBuilder().build( reader);
//创建能执行映射文件中 SQL 的 sSession，默认为手动提交事务，如果使用自动提交
则加上参数 truce
sqlSession = sessionFactory.openSession(true);
}
public void testSelectUser(){
String statement = "com.mybatis.userMapper" + ".getUser";
User user = sqlSession.selectOne(statement,"2");
System.out,println(user);
}
public static void main(String[] args) throws lOException {
new mybaitstest().testSelectUser );
}
}
<?xml version="1.0" encoding="UTF-8">
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3maper.dtd">
<mapper namespace=".mybatis.userMapper">
<!-- 据id查询一个User 对象 -->
<select id-"getUser" resultlype="com.mybatis.sql.User">
select * from users where id=#{id}
</select>
</mapper>
<?xml version="1.0"encoding="UTF-8"?>
<!DOCTYPE configuration PUBLIC "-//mybatis.org//DTD Config 3.0//EN" "http://mybatis.org/dtd)mybatis-3-config.dtd">
<configuration>
<!--设置 Mybatis 打印调试 sql -->
<settings>
<seting name="loglmpl" value="STDOUT LOGGING"/>
</settings>
<environments default="development">
<!- development:开发环境 work:工作模式 ->
<environment id="development">
<transactionManager type="JDBC" />
<!数据连接方式->
<dataSource type="POOLED">
<property name="driver" value="com.mysql.cj,jdbc.Driver" >
<property name="url" value="jdbc:mysql://192.168.88.20:3306/test?serverTimezone=UTC" >
<property name="username" value="root" >
<property name="password" value="root" />
</dataSource>
</environment>
</environments>
<!- 注册表映射文件 ->
<mapper>
<mapper resource="com/mybatis/userMapper.xml">
<mappers>
</mappers>
</contiguration>
5、常见SQL注入漏洞代码
（1）SQL语句参数直接动态拼接
private static final String DBDriver = "oracle,jdbc.driver.0racleDriver";//驱动
private static final String DBURL = "dbc:oracle:thin:@127.0.0.1:1521:XE";//URL 命名规则;jdbc:oracle:thin:@IP 地址:端口号:数据库实例名
private static final String DBUser = "IWEBSEC";
private static final String DBPassWord = "IWEBSEC";
Connection con = null;
Statement st = null;
ResultSet res = null;
try{
//连接
Class.forName(DBDriver);//加载数据库驱动
con = DriverManager.getConnection(DBURL,DBUser, DBPassWord);//连接
st = con.createStatement0):
String id=request.getParameter("id");
res = st.executeQuery("SELECT* FROM"IWEBSEC"."user" WHERE "id"="+id);
while(res.next0)
{
int p = res.getInt("id");
String n = res.getString("username");
String s = res.getString("password");
}
catch (Exception e){
out.println(e);
}
（2）预编译有误
Class.forName("com.mysql.cj;jdbe.Driver");
conn = DriverManager.getConnection("jdbc:mysql://192.168.88.20:3306/iwebsec?&useSSL=false&serverTimezone=UTC","root","root");
String usemame="user%' or '1'='1'#";
String id ="2";
String sql="SELECT*FROM user where id =?";
if (!CommonUtils.isEmptyStr(usemame))
sql+="and usemame like "%" + userame + "%";
System.out.println(sql);
PreparedStatement preparedStatement = conn.preparesStatement(sql);preparedStatement.setString(l,id);
rs = preparedStatement.executeQuery(0)
（3）order by注入
Clas.forName("com.mysql.cjdbc.Driver");
conn = DriverManager.getConnection("jdbc:mysql://192.168.88.20:3306/websec?&useSSL=false&serverTimezone=UTC","root","root");
String id ="2 or 1=";
String sql = "SELECT * FROM user "+" order by "+id;
System.out.printin(sql);
PreparedStatement preparedStatement = conn.prepareStatement(sql);
rs = preparedStatement.executeQuery();
（4）#和_模糊查询
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论