Websocket-based interface using the SQL injection

Yesterday found Websocket front-end protocol used when measuring an item (hereinafter referred to as WS) mass participation, because my brother just a day * line group also Websocket application protocol that uses network measurement, so he comes to understand for a moment, after research found that SQL injection testing, when asked whether sqlmap cousin who support the injection, the answer is no, but cousin gives a solution, we talk later.

What Websocket that?

WebSocket is a protocol H5 began offering a full-duplex communication over a single TCP connection, which enables data exchange between the client and the server easier, in websocketAPI the browser and the server only need to do a handshake, two data transfer can be carried out by each other.

Simulation environment to build

Because sensitive test target, I will use PHP simulate the presence of the injected and test environment.

PHP uses Websocket can use third-party extensions to achieve, such as:

workerman，swoole

Because workerman build up is relatively simple and supports Linux and Windows environments so use Workerman to build.

Workerman official website to download to your kernel package

Check out the official demo code in a PHP project after download at

<?phpuse Workerman\Worker;require_once'./Workerman/Autoloader.php';//创建一个Worker监听2346端口，使用websocket协议通$ws_worker= new Worker("websocket://0.0.0.0:2346");//启动4个进程对外提供服务$ws_worker->count= 4;//当收到客户端发来的数据后返回hello$data给客户端$ws_worker->onMessage= function($connection,$data){//向客户端发送hello$data$connection->send('hello'. $data);};//运行Worker::runAll();

Because Workerman only supports running under phpcli mode and official documents prompted to run on Windows only a single process so $ ws_worker-> count = 4;

This line of code can be deleted

Create a php file fills the test code

At the command line, type php -f server.php test

This shows that our WS server has built a good

I downloaded Websocket use client tools test

A successful interaction

According write a demo interacts with the database and there is a SQL Inject code

ws library table structure info

<?phpuse Workerman\Worker;require_once'./Workerman/Autoloader.php';//数据库连接字符串$username="root";$password="root";$add= "mysql:host=localhost;dbname=ws";$cdb= new PDO($add,$username,$password);//实例化PDO//创建一个Worker监听6666端口，使用websocket协议通讯$ws_worker= new Worker("websocket://0.0.0.0:6666");$ws_worker->onMessage= function($connection,$data){global $cdb;//设置$cdb为全局变量$res= '';$result=$cdb->query("SELECT email FROM info WHERE user = '$data'");while($row=$result->fetch()){$res= $row['email'];}$connection->send('YourSQL is: SELECT email FROM info WHERE user ='.$data);$connection->send('Recevieddata:'.$res);};Worker::runAll();?>