First, the concept of SQL injection
1. SQL injection is a method of adding SQL code to input parameters
2. An attack method that is passed to the sql server for parsing and execution
Example: The username of a website is name='admin'. When executed, select name from users where name='admin'
Then enter name='' or '1=1' when entering. In fact, what is executed in the database is select name from users where name='' or '1=1' is true, and the user name is valid
Second, the generation of SQL injection
1. Web developers cannot guarantee that all input is filtered
2. The attacker uses the input data sent to the SQL server to construct executable SQL code
3. The database has not been properly configured for security
For points 1 and 2, the attacker can use the get request, post request, cookie information, corresponding http header information, etc. to input data to achieve the purpose of the attack
3. Looking for SQL Injection Vulnerabilities
1. Raise exceptions by constructing exceptions, for example: input special characters where only integers are supported to cause sql exceptions
2. Find sensitive information through get request, post request, cookie information, corresponding http header information, etc.
3. Detect the corresponding abnormality in the server
Fourth, carry out sql injection attack
1. Digital injection. Attack by using the digital input in the where judgment statement in the database.
For example: select name from users where name='' or '1=1'. result is always true
2. String injection. Attack using mysql's annotation method
a, #Comment method.
Enter: admin'# in the input box of the user name, and fill in the password arbitrarily.
What is executed in the database is: select * from name='admin'#'and password=xxxxx'. #Comment out all the following, and only judge name=admin when judging
b, -- hdka method, two horizontal bars + space + any character. Everything after the space is treated as a comment during execution
Enter: admin'-- in the input box of the user name, and fill in the password arbitrarily.
What is executed in the database is: select * from name='admin'-- 'and password=xxxxx'. #Comment out all the following, and only judge name=admin when judging