web安全测试&渗透测试之sql注入~~

渗透测试概念:

详见百度百科

http://baike.baidu.com/link?url=T3avJhH3_MunEIk9fPzEX5hcSv2IqQlhAfokBzAG4M1CztQrSbwsRkSerdBe17H6tTF5IleOCc7R3ThIBYNO-q

前言：

安全测试范围极广，开门见山，楼主对这行了解的也不是太深，也是在学习探索阶段，此文，也是对自己学习的总结与记录和简单的分享；这里没有具体工具的使用方法，更多的是原理细节的了解和解决方案的探讨。

code部分:

html+jsp+mysql，实现登录与新增数据功能。

html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>web安全测试之sql注入</title>
</head>
<body bgcolor="#ffffff">
<form action="chkLogin.jsp" method="POST">
  <input type="text" name="user" /><br />
  <input type="password" name="pass" /><br />
  <input type="Submit" value="登录" />
</form>
<form action="insert.jsp" method="POST">
  <input type="text" name="user" /><br />
  <input type="text" name="pwd" /><br />
  <input type="Submit" value="新增" />
</form>
</body>
</html>

jsp1

<%@ page contentType="text/html; charset=utf-8" %>
<%@ page import="java.sql.*" %>
<html>
<head>
<title>chkLogin.jsp</title>
</head>
<body bgcolor="#ffffff">
<%
  String user = request.getParameter("user");
  String pass = request.getParameter("pass");

  Connection con = null;
  PreparedStatement ps = null;
  ResultSet rs = null;
  String sql =null;
  try
  {
    Class.forName("com.mysql.jdbc.Driver");
    con = java.sql.DriverManager.getConnection("jdbc:mysql://192.168.0.157/webTest?useUnicode=true&characterEncoding=utf-8","root","123456");
    sql= "SELECT * FROM user WHERE name=‘"+user+"‘ AND pwd =‘"+pass+"‘";
    ps = con.prepareStatement(sql);
//    ps = con.prepareStatement("SELECT * FROM user WHERE name=? AND pwd =?");
//    ps.setString(1, user);
//    ps.setString(2, pass);
    rs = ps.executeQuery();
    if ( rs.next())
    {

      out.println("登录成功!");
      out.println("sql:"+sql);
    }
    else
    {
      out.println("登录失败!");
      out.println("sql:"+sql);
    }
  }catch(Exception ex)
  {
     out.println("登录异常!");
     out.println("sql:"+sql);
     out.println("Exception:"+ex);
  }finally{
    if ( null != rs)
    {
      rs.close();
      rs = null;
    }
    if ( null != ps)
    {
      ps.close();
      ps = null;
    }
    if ( null != con){
      con.close();
      con = null;
    }
  }
%>
</body>
</html>

jsp2

<%@ page contentType="text/html; charset=utf-8" %>
<%@ page import="java.sql.*" %>
<html>
<head>
<title>chkLogin.jsp</title>
</head>
<body bgcolor="#ffffff">
<%
  String user = request.getParameter("user");
  String pass = request.getParameter("pwd");

  Connection con = null;
  PreparedStatement ps = null;
  ResultSet rs = null;
  String sql =null;
  int r = 0;
  try
  {
    Class.forName("com.mysql.jdbc.Driver");
    con = java.sql.DriverManager.getConnection("jdbc:mysql://192.168.0.157/webTest?useUnicode=true&characterEncoding=utf-8","root","123456");
    sql= "insert into user(name,pwd) values (‘"+user+"‘,‘"+pass+"‘)";
    ps = con.prepareStatement(sql);
//    ps = con.prepareStatement("SELECT * FROM user WHERE name=? AND pwd =?");
//    ps.setString(1, user);
//    ps.setString(2, pass);
    r = ps.executeUpdate();

    if (r>0)
    {

      out.println("添加成功!");
      out.println("sql:"+sql);
    }
    else
    {
      out.println("添加失败!");
      out.println("sql:"+sql);
    }
  }catch(Exception ex)
  {
     out.println("添加异常!");
     out.println("sql:"+sql);
     out.println("Exception:"+ex);
  }finally{
    if ( null != rs)
    {
      rs.close();
      rs = null;
    }
    if ( null != ps)
    {
      ps.close();
      ps = null;
    }
    if ( null != con){
      con.close();
      con = null;
    }
  }
%>
</body>
</html>

登录原理简介：

html->jsp->db

html页面输入两个参数user、pass，按‘登录’按钮，调用chkLogin.jsp；chkLogin.jsp接收html传入两个参数，去数据库user表里面查询，返回不为null，则登录成功，否则登录失败，异常则登录异常。查询使用的方法是executeQuery，sql组装使用的+参数拼接。

正常场景：

数据库用户数据