He aha te mea te werohanga o SQL?

Kei te tipu haere piki haere te maha o ngā pae me ngā whārangi i runga i te tukutuku. Tangohia hoki te whanaketanga o te hunga katoa e taea. A maha whakamahi ngā Tukutuku tauhou waehere haumaru, me te koroheke. A hanga ana e ia he rota o loopholes mō kaimahi me mūrere. Atu he ratou. Ko tētahi o nga whakaraeraetanga tino matarohia - SQL-werohia.

He bit o ariā

e mohio ana tokomaha iwi e te whakamahi i te nuinga o ngā pae me ngā ratonga i runga i te whatunga te rokiroki SQL pātengi raraunga. Ko te tenei reo uiui hanganga e taea ki a koe te whakahaere me te whakahaere i te rokiroki o ngā raraunga. He maha putanga rerekē o te pātengi raraunga pūnaha whakahaere pātengi raraunga - Oracle, MySQL, Postgre. Ahakoa o te ingoa me te momo, te whakamahi i ratou i te raraunga uiui taua. Ko reira konei e takoto te whakaraerae pea. Ki te rahua ki te hapai i tika, me te humarie tono te kaiwhakawhanake, ka taea e te hoariri te tango painga o tenei, ka whakamahi i founga motuhake ki te riro te uru ki te pātengi raraunga, me ka - a ki te whakahaere pae katoa.

Hei karo taua āhuatanga, e hiahia ana koe ki te tika arotau te waehere me ki aroturuki āta i roto i te tikanga i roto i nei kei te tukatuka i te tono.

Tirohia hoki SQL-werohia

Hei whakapumautia te aroaro o te whakaraeraetanga i roto i te whatunga he taimaha o oti pūnaha pūmanawa aunoa. Ko e taea ki te kawe i roto i te haki ohie ā. Ki te mahi i tenei, haere ki tetahi o nga pae whakamātautau me i te pae wāhitau ki te ngana ki te meinga i te hapa pātengi raraunga. Hei tauira, he hōtuhi i runga i te pae e kore e taea te hapai i te tono, me te kore e mahi ki te whakapai ia ratou.

Hei tauira, i reira nekiy_sayt / index.php? Id = 25

Ko te huarahi māmā - ki te hoatu 25 i muri i te faahitiraa a unga i te tono. Ki te puta kahore hapa ranei, i runga i te pae me te tātari e whawha tika tono katoa, ranei kei te monokia i roto i te tautuhinga o ratou putanga. Ki te tāuta i te whārangi kua ki te raruraru, na te whakaraerae ki te SQL-werohia he.

I muri ka kitea ia i roto i, ka taea e koe te tamata ki te pehea e o te reira.

Hei whakatinana i tenei hiahia whakaraeraetanga ki te mohio he iti e pā ana ki ngā kapa SQL-uiui. Ko tētahi o ratou - UNION. hopoi mai te reira i huihui e rave rahi hua uiui ki tetahi. Na e taea tatou te tātai i te maha o ngā āpure i roto i te tepu. TAUIRA rapu tuatahi ko:

• nekiy_sayt / index.php? id = 25 UNION Tīpakohia 1.

I roto i te nuinga o te wā, kia whakaputa i tenei record he hapa. Tenei te tikanga e kore e rite ki te 1. te maha o mara te kupu, te kōwhiri i te kōwhiringa o te 1 nui ranei, he reira taea ki te whakatū i to ratou maha tangohia:

• nekiy_sayt / index.php? id = 25 UNION Tīpakohia 1,2,3,4,5,6.

Ko, ina e kore puta i te hapa, te auraa e ki te maha o ngā āpure mate'i.

He he ano hoki te otinga kē ki tenei raruraru. Hei tauira, ka he maha nui o mara - 30, 60 100. ranei tenei whakahau GROUP BY. rōpū te reira i te hua o te uiui i runga i tetahi papa whenua, mo te tauira id:

• nekiy_sayt / index.php? id = 25 GROUP BY 5.

Ki te kore i riro te hapa, ka atu te mara i te 5. Ko te kupu, whakakapi kōwhiringa i te whānui tika whanui, he reira taea ki te tātai i te maha o ratou mau.

Tenei tauira SQL-werohia - no te tīmata te hunga e hiahia ana ki te tamata ratou i roto i te whakamātautau o tona pae. He mea nui ki te mahara e mo te whakaurunga ki tetahi atu tuhinga e wātea ana o te Code Kirimina.

Ko te momo matua o te werohia

Whakatinana whakaraeraetanga i te SQL-werohanga i roto i te maha o taatou. Next Ko nga tikanga tino rongonui:

• Ko te UNION te uiui te SQL werohia. He tauira ohie o tenei momo kua uiui e runga ake. Kei te kitenga reira e tika ana ki te hapa i roto i te arowhai raraunga taumai, kahore e nei tātarihia.

• hāngai ana Hapa-SQL werohia. Ka rite ki te ingoa titau, whakamahi hoki tenei momo te hapa, te tuku kīanga titoa syntactically hē. Na reira ko te mōhio o te pane whakautu, tātari e taea te kawea i roto i muri SQL-werohia.

• Tāpae ka uiui te te SQL werohia. takoto ana tēnei whakaraeraetanga e te raveraa i tono whai. Kei te āhuatanga i te reira e te tua i te mutunga o te tohu ";". Kei te maha whakatinanahia tenei huarahi ki te uru i te whakatinanatanga o lau ka tuhituhi raraunga pūnaha whakahaere ranei mahi, ki te tukua te reira mau haamaitairaa.

Pūmanawa mō te rapu SQL-whakaraeraetanga

He reira hoki SQL-werohia, te hōtaka te tikanga i rua wāhanga - he pae matawai mō ngā whakaraeraetanga taea, me te whakamahi i ratou ki te riro te uru ki raraunga. Vai nei te tahi taputapu mō tüäpapa tata mohiotia katoa. Ratou taumahinga nui whakahaere arowhai paetukutuku ki te anganga koutou SQL-werohia.

Sqlmap

matawai Tino kaha e mahi ki te nuinga o pātengi. tautoko reira ngā tikanga o te whakatinanatanga o te SQL-werohia. He te kaha ki te ite i aunoa i te momo o te hae kupuhipa papatanga me te papakupu. Hakari a mahi tukunga kōnae me te download i te tūmau.

whakamana tāutatanga i runga i Linux te whakamahi i te whakahau:

• git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev,
• cdsqlmap-dev /,
• --wizard ./sqlmap.py.

He wātea ana hei kōwhiringa ki te rārangi whakahau me te atanga kaiwhakamahi whakairoiro hoki Windows.

jSQL Werohanga

jSQL Werohanga - he taputapu ripeka-pūhara mō te whakamatautau i te whakamahi o whakaraeraetanga SQL. Tuhituhia i roto i Java, te tikanga kia pera te pūnaha tāuta JRE. Taea ki te hapai i KIMI tono, POST, pane, pihikete. He he atanga kauwhata watea.

Ko te tāutanga o tenei mōkihi pūmanawa ko e whai ake:

wget https://github.com/`curl -s https: //github.com/ron190/jsql-injection/releases | grep-E -o '/ron190/jsql-injection/releases/download/v[0-9]{1,2}.[0-9]{1,2}/jsql-injection-v[0-9] . {1,2} [0-9] {1,2} .jar '| upoko-n 1`

Whakarewa Ko mā te whakamahi i te java whakahau -jar ./jsql-injection-v*.jar

I roto i te tikanga ki te tīmata i te pae whakamātautau i runga i SQL-whakaraeraetanga, e hiahia ana koe ki te tomo i te wāhitau i roto i te mara runga. He motuhake mō te GET me POST ratou. Ki te hua pai, ka puta te rārangi o ngā ripanga e wātea ana i roto i te matapihi i mahue. Ka taea e koe te tiro ia ratou, ka ako etahi ngā mōhiohio matatapu.

ripa «whārangi Kaiwhakahaere» whakamahia ki te kitea te awhi whakahaere. I reira e te tikanga o ngā tātauira motuhake rapu aunoa i te pūnaha tuhi kaiwhakamahi faingamālie. Mai i ratou e taea te tiki e koe i te hae tika o te kupuhipa. Otiia he ia i roto i te maatauranga o te hōtaka.

I muri te kimi i te whakaraeraetanga me werohia uiui e tika ana katoa, ka tukua te taputapu te tūmau ki te whakaki i roto i to koutou kōnae ranei, hei kōrero, te tiki i te reira i reira.

SQLi Dumper v.7

Tenei hōtaka - ngāwari ki te whakamahi taputapu mō te te kimi me te whakatinana i whakaraeraetanga SQL. hua reira hāngai te UN te i runga i te pera-ka karanga Roka. Ka taea te kitea to ratou rārangi i runga i te Internet. Dorca hoki SQL-werohia - he tauira motuhake o pātai rapu enei. Ki te to ratou awhina, ka taea e kitea e koe pae pea whakaraerae i roto i tetahi pūkaha rapu.

Utauta mō te whakangungu

Itsecgames.com i runga i te pae i reira ko te huinga motuhake o taputapu e taea whakaatu te tauira me pehea ki te mahi i werohia SQL me te whakamatautau i te reira. I roto i te tikanga ki te whai hua, he mea e tika ana ki te tiki me te tāuta. Kei roto i te pūranga te huinga o ngā kōnae, i te mea te hanganga o te pae. Hei tāuta ka hiahia te reira i roto i te pūnaha ngā o huinga o tūmau Apache tukutuku, MySQL ko PHP.

Wetewetea i te pūranga i roto i te kōpaki tūmau tukutuku, whai koe ki te haere ki te wāhitau tomo ka tāuta i tēnei pūmanawa. He whārangi ki te rēhita kaiwhakamahi. Here e hiahia ana koe ki te tomo koutou mōhiohio, me te pāwhiri «Waihanga». Te neke i te kaiwhakamahi ki te mata hou, faauru te pūnaha koe ki te tīpako tetahi o nga take whakamātautau. I roto ia ratou i reira e whakaahuatia e rua i te werohia, a he tokomaha atu tūemi whakamātautau.

Ko reira utu whakaaro he tauira o te momo SQL-werohia GET / Rapu. Here e hiahia ana koe ki te tīpako i te reira, ka pāwhiri «Hack». I mua ka puta te kaiwhakamahi, me te peehia rapu string o te pae kiriata. Ka taea e Ki te kōmaka kiriata kia roa. Ko reira e 10. anake Hei tauira, ka taea e koe te tamata ki te tomo i te Iron te tangata. ka tohu te reira i te kiriata, ka mahi i te pae, me te tepu kei reira. Na to tatou ki te tirohia, ki te whiriwhiringa pūāhua motuhake hōtuhi, i roto i ngā faahitiraa. Ki te mahi i tenei, tāpiri 'i roto i te pae wāhitau. " Ano, me mahi tenei i muri i taitara o te kiriata. Ka hoatu i te pae i te Hapa hapa: E koe he hapa i roto i to koutou wetereo SQL; tirohia te buka haapiiraa e hāngai ki tō putanga tūmau MySQL mo te wetereo tika ki te whakamahi i tata '%' 'i te rārangi 1, e kī e te pūāhua tonu e kore e whawha tika. Na ka taea e koe te tamata ki te whakauru i tō tono. Engari me tuatahi tatou tātai i te maha o ngā āpure. Kei te whakamahia te reira mo tenei tikanga e, whakaurua nei i muri i te kōrero: http://testsites.com/sqli_1.php?title=Iron+Man 'kia e 2 - & mahi = rapu.

Tenei whakahau whakaatu mōhiohio e pā ana ki te kiriata, e te, te maha o ngā āpure he nui atu i 2. parau te tohuwehe rua te tūmau e me whiua te tahi atu tono anake. Na to tatou ki te kōmaka i roto i, e maka ana te whakanui ake faufaa rite te roa rite kore te te hapa tā. I roto i te mutunga, huri i te reira i roto i taua i te mara e kia 7.

Na te reira te wā ki te tiki te tahi mea whai hua i roto i o te turanga. E paku whakarerekē i te tono i roto i te pae wāhitau, ka kawe mai i te reira ki te puka: http://testsites.com/sqli_1.php?title=Iron+Man 'uniana tīpako 1, pātengi raraunga (), kaiwhakamahi (), 4, kupuhipa, 6, 7 i ngā kaiwhakamahi - & mahi = rapu. Ka rite ki te hua o tona whakatinanatanga e whakaatu te aho ki te Hashes kupuhipa, e taea te ngāwari tahuri ki tohu mahinongofua mā te whakamahi i tetahi o nga ratonga ipurangi. He äwhä he iti, me te tangohia ake tetahi ingoa mara ki te takiuru, ka taea e koe te riro te uru ki te urunga o te tangata atu, pērā i admin o te pae.

Ko te hua he momo werohia momo taimaha, i runga i nei ki te mahi. Kia mahara te reira e kia te tono o enei pūkenga i roto i te kupenga i runga i ngā pae tūturu i te hara toihara.

Werohanga me te PHP

Ka rite ki te tikanga, te PHP-waehere me te he kawenga mō te tono tukatuka tika e haere mai ana i te kaiwhakamahi. Na reira, i tenei taumata e hiahia ana koe ki te hanga i te korero ki SQL-werohia i PHP.

Tuatahi, kia hoatu a he torutoru aratohu ohie, i runga i te pūtake o te mea e tika ana ki te rave i te reira.

• Me te tukatuka tonu Raraunga i mua i te whakanohoia ki te pātengi raraunga. Ka taea te mahi i tēnei rānei mā te whakamahi i ngā kīanga ngā, mā te whakarite ā-uiui ranei. Here, rawa e tango ki pūkete e he ului ki te momo e hiahiatia ana e te nga uara tau,;
• Karohia ue'i ngā hanganga mana.

Na he iti e pā ana ki te ture o te whakahiato pātai i roto i te MySQL ki te tiaki ki SQL-werohia.

I roto i te tuhi ki runga tetahi kīanga ki te uiui ko reira nui ki te wehe i te raraunga i te kupu matua SQL.

• * Tīpakohia MEI tepu HEA ingoa = Zerg.

I roto i tenei whirihoranga, kia whakaaro te pūnaha e Zerg - te ingoa o tetahi mara, na e hiahia ana koe ki te rāihe i te reira i roto i kōrero.

• Tīpakohia * MEI tepu HEA ingoa = 'Zerg'.

Heoi, i reira he wā ina kei te uara ano korukī.

• Tīpakohia * MEI tepu HEA ingoa = 'Côte d'Ivoire'.

Here hapai i anake wahi o Côte d, a taea te toenga e mohio a rite te rōpū, e, o te akoranga, e kore. Na reira, puta he hapa. Na e hiahia ana koe i tenei ahua o raraunga āta. Ki te mahi i tenei, te whakamahi i te rītahamuri - \.

• Tīpakohia * MEI tepu HEA ingoa = 'cat-d \' Ivoire '.

e pā ana katoa o te runga ake ki te rarangi. Ki te tango te mahi wahi ki te maha, ka kore e hiahia te reira i tetahi korukī ngā rītaha ranei. Heoi, kia hiahiatia ratou ki panaia arahi ki te momo raraunga e hiahiatia ana.

He tūtohutanga e me kia whakanohoia te ingoa mara i roto i backquotes. Ko tenei tohu i te taha ki maui o te papapātuhi, me ki te tire "~". Ko tenei ki te whakarite kia tika MySQL taea te wehewehe i te ingoa o te mara i to koutou kupu matua.

mahi Hihiri ki raraunga

Tino maha, ki te tiki i tetahi raraunga i te pātengi raraunga mā te whakamahi i pātai, hanga hihiri. Hei tauira:

• Tīpakohia * MEI tepu HEA maha = '$ tau'.

Here, haere te tau $ tāupe te rite whakatau i te uara o te parae. Eaha te tupu, ki te riro te reira 'Côte d'Ivoire'? Hapa.

Hei karo i tēnei raruraru, o te akoranga, ka taea e koe te whakauru i te "korukī makutu" tautuhinga. Tena ko tenei ka kia hipoki nga raraunga wahi e tika ana, me te kore e tika. I tua atu, ki te te te waehere e ringa tuhituhi, ka taea e koe te whakapau i te atu te wa iti ki te waihanga ātete ki hangai te pūnaha iho.

Hoki te tua motuhake o te rītaha taea te whakamahi i mysql_real_escape_string.

$ Tau = mysql_real_escape_string ($ tau);

$ Tau = mysql_real_escape_string ($ tau);

$ Uiui = "kōkuhu ki tepu (tau, tau, te piha haapiiraa) uara ( '$ tau', '$ tau', 11)".

Ahakoa nui haere te waehere me i rōrahi, ano pea e mahi i te reira nui haumaru.

puriwāhi

Puriwāhi - he ahua o tohu mo e whakaae te pūnaha e ko te wahi e hiahia ana koe ki te fetongi he mahi motuhake tenei. Hei tauira:

$ Sate = $ mysqli-> te faaineine ( "Tīpakohia District MAI Tau HEA Ingoa =?");

$ Sate-> bind_param ( "s", $ tau);

$ Sate-> mahia ();

Ko tēnei wāhanga o te waehere e te tauira tono whakangungu, me te ka herea te tau tāupe, a puta ia te reira. Tēnei huarahi e āhei ki a koutou wahia te uiui tukatuka me tona whakatinanatanga. Ko te kupu, e taea te ora i te reira i te whakamahi o te waehere kino e SQL-.

He aha kaha te hoariri

Pūnaha Protection - he tauwehe rawa nui, e kore e taea te mahue. O te akoranga, ka waiho māmā ki te whakahoki i te pae kāri pakihi ohie. A ki te mea te mea he tomokanga nui, mahi, forum? He aha e nga nunu'a ki te kore koe e whakaaro e pā ana ki te haumarutanga?

Tuatahi, ka taea e te Hacker whati i te tapatahi o te turanga e rua, me te tango i te reira tino. A, ki te kahore e te kaiwhakahaere o te pae hoster ranei te hanga i te tārua, ka whai koe nga wa pakeke. Runga ake katoa, he maoho, hangai te pae kotahi, e taea te haere ki te atu whakairi i roto i te tūmau taua.

Next ko te tahae o te mōhiohio whaiaro o ngā manuhiri. Me pēhea te ki te whakamahi i - mea katoa e iti anake e te whakaaro o te Hacker. Otiia i roto i tetahi take, e kore e nga hopearaa kia tino ahuareka. Rawa, ki te roto ngā mōhiohio pūtea.

Ano, Ka taea e te hoariri te hanumi pātengi raraunga koe, a ka tukinotia moni mo tona hoki.

kaiwhakamahi e apee i runga i mo o te kaiwhakahaere o te pae, te tangata kahore e ratou he, e taea hoki e ngaahi nunu'a kino rite meka tinihanga taea.

mutunga

whakaratohia ngā mōhiohio katoa i roto i tenei tuhinga e mō ngā take mōhiohio anake. Whakamahia reira Me anake ki te whakamātau i ō rātou ake kaupapa ina kitea reira whakaraeraetanga, me te whakatutuki a ratou.

Hoki te atu i roto i-hohonu ako o tikanga o pehea ki te whakahaere i SQL-werohia, he mea e tika ana ki te tīmata ki te kaha rangahau tūturu me ngā āhuatanga o te reo SQL. Ka rite ki pātai haaputuhia, kupumatua, momo raraunga, me te whakamahi o reira katoa.

e kore e taea te mahi ano hoki i waho he mahara ki te mahi o ngā mahi PHP me huānga HTML. Te whakamahi tuatahi ngā whakaraerae mō te werohia - he aho wāhitau, me ngā mara rapu. Ako mahi PHP, ka feruri i te tikanga o te whakatinanatanga, me ngā āhuatanga i roto i te pehea, ki te karo i hape.

Ko te aroaro o maha taputapu pūmanawa rite-hanga tukua hoki i roto i-hohonu tātari i runga i te pae mohiotia whakaraeraetanga. Ko tētahi o nga hua tino rongonui - Kali linux. Tenei whakapakoko o te pūnaha whakahaere Linux-e hāngai ana, e kei te maha nui o ngā taputapu, me ngā hōtaka e taea te kawe i roto i te tātari whānui o te kaha pae.

He aha e hiahia ana koe ki te mohio me pehea ki te hack te pae? E mea ohie roa - he mea e tika ana ki te kia mōhio o te whakaraeraetanga pea o koutou kaupapa paetukutuku ranei. Rawa, ki te he te reira i te taonga ipurangi ki utu online, te wahi e taea te faaoti i te raraunga kaiwhakamahi utu i te hoariri.

Hoki ako ngaio o ngā kaimahi haumarutanga mōhiohio tīariari, ka taea ki te tirohia i roto i te pae no te he momo o paearu, me te hohonu. Tīmata i te kuware HTML-werohanga a ki engineering pāpori me te hītinihanga.