SQL注入之二次注入(sql-lab第24關)
阿新 • • 發佈:2020-12-23
什麼是二次注入
二次注入可以理解為,攻擊者構造的惡意資料儲存在資料庫後,惡意資料被讀取並進入到SQL查詢語句所導致的注入。防禦者可能在使用者 輸入惡意資料時對其中的特殊字元進行了轉義處理,但在惡意資料插入到資料庫時被處理的資料又被還原並存儲在資料庫中,當web程式呼叫儲存在資料庫中的惡意資料並執行SQL查詢時,就發生了SQL二次注入。
二次注入原理分為兩步
二次注入,可以概括為以下兩步:
第一步:插入惡意資料
進行資料庫插入資料時,對其中的特殊字元進行了轉義處理,在寫入資料庫的時候又保留了原來的資料。
第二步:引用惡意資料
開發者預設存入資料庫的資料都是安全的,在進行查詢的時候,直接從資料庫中取出惡意資料,沒有進行進一步的檢驗的處理。
二次注入的過程
找到注入點
然後構造注入語句
以sql-lab第24關為例:
可以看到一個輸入框——》註冊一個新使用者
可以看到有一個abcd使用者,密碼是abcd
username:abcd’#(單引號來閉合前面的單引號,#註釋後面內容)
password:1234
登入:
username:abcd’#
password:1234
登入後出現如下效果:you are logged in
檢視一下
後臺程式碼
new_user.php
<?php include '../sql-connections/sql-connect.php' ; ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> <title><?php echo $feedback_title_ns; ?> </title> </head> <body bgcolor="#000000"> <div align="right"> <a style="font-size:.8em;color:#FFFF00" href='index.php'><img src="../images/Home.png" height='45'; width='45'></br>HOME</a> </div> <font size="3" color="#FFFF00"> <div style="text-align:center"> <form name="mylogin" method="POST" action="login_create.php"> <h2 style="text-align:center;background-image:url('../images/Less-24-new-user.jpg');background-repeat:no-repeat;background-position:center center"> <div style="padding-top:300px;text-align:center;color:#FFFF00;"><?php echo $form_title_ns; ?></div> </h2> <div align="center"> <table style="margin-top:50px;"> <tr> <td style="text-align:right"> <font size="3" color="#FFFF00"> <strong>Desired Username:</strong></font> </td> <td style="text-align:left"> <input name="username" id="username" type="text" value="" /> </td> </tr> <tr> <td style="text-align:right"> <font size="3" color="#FFFF00"> <strong>Password:</strong> </font> </td> <td style="text-align:left"> <input name="password" id="password" type="password" value="" /> </td> </tr> <tr> <td style="text-align:right"> <font size="3" color="#FFFF00"> <strong>Retype Password:</strong> </font> </td> <td style="text-align:left"> <input name="re_password" id="re_password" type="password" value="" /> </td> </tr> <tr> <td colspan="2" style="text-align:right"> <input name="submit" id="submit" type="submit" value="Register" /><br/><br/> </td> </tr> </table> </div> </form> </div> </body> </html>
index.php
<?PHP session_start(); if (isset($_SESSION['username']) && isset($_COOKIE['Auth'])) { header('Location: logged-in.php'); } ?> <?php //including the Mysql connect parameters. include("../sql-connections/sql-connect.php"); ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> <title>Less-24 - Second Degree Injections </title> </head> <body bgcolor="#000000"> <div style="text-align:center"> <form name="login" method="POST" action="login.php"> <h2 style="text-align:center;background-image:url('../images/Less-24.jpg');background-repeat:no-repeat;background-position:center center"> <div style="padding-top:300px;text-align:center;color:#FFFF00;"><?php echo $form_title_in; ?></div> </h2> <div align="center"> <table style="margin-top:50px;"> <tr> <td style="text-align:right"> <font size="3" color="#FFFF00"> <strong>Username:</strong> </td> <td style="text-align:left"> <input name="login_user" id="login_user" type="text" value="" /> </td> </tr> <tr> <td style="text-align:right"> <font size="3" color="#FFFF00"> <strong>Password:</strong> </td> <td style="text-align:left"> <input name="login_password" id="login_password" type="password" value="" /> </td> </tr> <tr> <td colspan="2" style="text-align:right"> <input name="mysubmit" id="mysubmit" type="submit" value="Login" /><br/><br/> <a style="font-size:.8em;color:#FFFF00" href="forgot_password.php">Forgot your password?</a><font size="3" color="#FFFF00"> ||</font> <a style="font-size:.8em;color:#FFFF00" href="new_user.php">New User click here?</a> </td> </tr> </table> </div> </form> </div> </body> </html>
login.php
<html>
<head>
</head>
<body bgcolor="#000000">
<font size="3" color="#FFFF00">
<div align="right">
<a style="font-size:.8em;color:#FFFF00" href='index.php'><img src="../images/Home.png" height='45'; width='45'></br>HOME</a>
</div>
<?PHP
session_start();
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
function sqllogin(){
$username = mysql_real_escape_string($_POST["login_user"]);
$password = mysql_real_escape_string($_POST["login_password"]);
$sql = "SELECT * FROM users WHERE username='$username' and password='$password'";
//$sql = "SELECT COUNT(*) FROM users WHERE username='$username' and password='$password'";
$res = mysql_query($sql) or die('You tried to be real smart, Try harder!!!! :( ');
$row = mysql_fetch_row($res);
//print_r($row) ;
if ($row[1]) {
return $row[1];
} else {
return 0;
}
}
$login = sqllogin();
if (!$login== 0)
{
$_SESSION["username"] = $login;
setcookie("Auth", 1, time()+3600); /* expire in 15 Minutes */
header('Location: logged-in.php');
}
else
{
?>
<tr><td colspan="2" style="text-align:center;"><br/><p style="color:#FF0000;">
<center>
<img src="../images/slap1.jpg">
</center>
</p></td></tr>
<?PHP
}
?>
</body>
</html>
pass_change.php
<html>
<head>
</head>
<body bgcolor="#000000">
<?PHP
session_start();
if (!isset($_COOKIE["Auth"]))
{
if (!isset($_SESSION["username"]))
{
header('Location: index.php');
}
header('Location: index.php');
}
?>
<div align="right">
<a style="font-size:.8em;color:#FFFF00" href='index.php'><img src="../images/Home.png" height='45'; width='45'></br>HOME</a>
</div>
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
if (isset($_POST['submit']))
{
# Validating the user input........
$username= $_SESSION["username"];
$curr_pass= mysql_real_escape_string($_POST['current_password']);
$pass= mysql_real_escape_string($_POST['password']);
$re_pass= mysql_real_escape_string($_POST['re_password']);
if($pass==$re_pass)
{
$sql = "UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass' ";
$res = mysql_query($sql) or die('You tried to be smart, Try harder!!!! :( ');
$row = mysql_affected_rows();
echo '<font size="3" color="#FFFF00">';
echo '<center>';
if($row==1)
{
echo "Password successfully updated";
}
else
{
header('Location: failed.php');
//echo 'You tried to be smart, Try harder!!!! :( ';
}
}
else
{
echo '<font size="5" color="#FFFF00"><center>';
echo "Make sure New Password and Retype Password fields have same value";
header('refresh:2, url=index.php');
}
}
?>
<?php
if(isset($_POST['submit1']))
{
session_destroy();
setcookie('Auth', 1 , time()-3600);
header ('Location: index.php');
}
?>
</center>
</body>
</html>
$sql = "UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass' ";abcd'#
上面這條語句就會變成:
update users set password='aaaa' where username='abcd'# and password=xxxx
#把後面語句全部註釋掉了
先插入資料——》再引用插入資料
防禦:
過濾危險字元
採用PDO程式設計