FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Update 【02】SQL 漏洞原理与实际案例介绍.md · AshMOB/JavaCodeAudit@36390fb · GitHub

  1. AshMOB
  2. JavaCodeAudit

Repository navigation

Commit 36390fb

Browse files
cn-panda
committed
Update 【02】SQL 漏洞原理与实际案例介绍.md
1 parent 27c0926 commit 36390fb

1 file changed

Lines changed: 28 additions & 30 deletions

File tree

‎【02】SQL 漏洞原理与实际案例介绍/【02】SQL 漏洞原理与实际案例介绍.md‎

Lines changed: 28 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,11 @@ https://github.com/cn-panda/JavaCodeAudit
6868

6969
修改连接数据库的账号密码：
7070

71-
![image-20191127160610862](/Users/panda/Library/Application Support/typora-user-images/image-20191127160610862.png)
71+
![2.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/2.png?raw=true)
7272

7373

7474

75-
![image-20191127160707546](/Users/panda/Library/Application Support/typora-user-images/image-20191127160707546.png)
75+
![3.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/3.png?raw=true)
7676

7777
项目是一个简单的查询用户信息的实现，在 servlet 层接受到请求后，调`UserInfoServiceImpl`，`UserInfoServiceImpl`在调用`UserInfoDaoImpl`，`UserInfoDaoImpl`去操作数据库，然后封装 `UserInfo` 对象，再把` UserInfo` 对象返回给` UserInfoService`，最后 service 层再返回给 servlet 层，最终把查询的内容显示到` info.jsp `页面。
7878

@@ -118,13 +118,11 @@ public UserInfo UserInfoFoundDao(String id){
118118

119119
可以看到在 sql 语句中，存在着拼接的String类型变量`id`，且没有进行任何的过滤处理，直接带入执行。这也就导致了 SQL 注入，如下图，带入参数`and 1=1`：
120120

121-
![image-20191127195213966](/Users/panda/Library/Application Support/typora-user-images/image-20191127195213966.png)
121+
![4.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/4.png?raw=true)
122122

123123
监视 MySQL 的执行记录，如下图所示：
124124

125-
![image-20191127195319942](/Users/panda/Library/Application Support/typora-user-images/image-20191127195319942.png)
126-
127-
125+
![5.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/5.png?raw=true)
128126

129127
完整的把我们带入的参数给传了进去。
130128

@@ -134,11 +132,11 @@ public UserInfo UserInfoFoundDao(String id){
134132
id=2 union select 1,2,3,group_concat(username),group_concat(password) from admin--
135133
```
136134

137-
![image-20191127195616949](/Users/panda/Library/Application Support/typora-user-images/image-20191127195616949.png)
135+
![6.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/6.png?raw=true)
138136

139137
MySQL 执行记录如下：
140138

141-
![image-20191127195645267](/Users/panda/Library/Application Support/typora-user-images/image-20191127195645267.png)
139+
![7.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/7.png?raw=true)
142140

143141
## 0x03 修复方案
144142

@@ -280,73 +278,73 @@ https://gitee.com/oufu/ofcms/releases
280278

281279
然后打开 idea，点击`import Project`，选择` Import project from external model`中的 Maven
282280

283-
![image-20191128200219579](/Users/panda/Library/Application Support/typora-user-images/image-20191128200219579.png)
281+
![8.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/8.png?raw=true)
284282

285283

286284

287285
然后一路默认
288286

289-
![image-20191128200509393](/Users/panda/Library/Application Support/typora-user-images/image-20191128200509393.png)
287+
![9.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/9.png?raw=true)
290288

291-
![image-20191128200522311](/Users/panda/Library/Application Support/typora-user-images/image-20191128200522311.png)
289+
![10.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/10.png?raw=true)
292290

293291
![image-20191128200543346](/Users/panda/Library/Application Support/typora-user-images/image-20191128200543346.png)
294292

295-
![image-20191128200553472](/Users/panda/Library/Application Support/typora-user-images/image-20191128200553472.png)
293+
![11.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/11.png?raw=true)
296294

297295

298296

299297
然后在`ofcms-admin/src/main/resources/dev/conf/`文件夹下打开`db.properties`，修改数据的账号密码
300298

301-
![image-20191128200719160](/Users/panda/Library/Application Support/typora-user-images/image-20191128200719160.png)
299+
![12.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/12.png?raw=true)
302300

303301
然后修改根目录下的 `pom.xml`，搜索 `mysql`，然后修改成自己机器上的装的版本，最后点击` import changes`
304302

305-
![image-20191128201011063](/Users/panda/Library/Application Support/typora-user-images/image-20191128201011063.png)
303+
![13.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/13.png?raw=true)
306304

307305

308306

309307
然后下载需要的 jar 包资源：
310308

311-
![image-20191128201138715](/Users/panda/Library/Application Support/typora-user-images/image-20191128201138715.png)
309+
![14.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/14.png?raw=true)
312310

313311
配置Tomcat 服务，点击 run-->edit configurations
314312

315-
![image-20191128201219662](/Users/panda/Library/Application Support/typora-user-images/image-20191128201219662.png)
313+
![15.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/15.png?raw=true)
316314

317-
![image-20191128201317202](/Users/panda/Library/Application Support/typora-user-images/image-20191128201317202.png)
315+
![16.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/16.png?raw=true)
318316

319317
然后选择 Tomcat 的安装目录：
320318

321-
![image-20191128201359941](/Users/panda/Library/Application Support/typora-user-images/image-20191128201359941.png)
319+
![17.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/17.png?raw=true)
322320

323321
端口按照本地情况修改：
324322

325-
![image-20191128201442520](/Users/panda/Library/Application Support/typora-user-images/image-20191128201442520.png)
323+
![18.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/18.png?raw=true)
326324

327325
然后配置 Deployment
328326

329-
![image-20191128201505918](/Users/panda/Library/Application Support/typora-user-images/image-20191128201505918.png)
327+
![19.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/19.png?raw=true)
330328

331329
选择 ofcms-admin:war
332330

333-
![image-20191128201526664](/Users/panda/Library/Application Support/typora-user-images/image-20191128201526664.png)
331+
![20.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/20.png?raw=true)
334332

335333
修改名字为`/ofcms-admin`
336334

337-
![image-20191128201541544](/Users/panda/Library/Application Support/typora-user-images/image-20191128201541544.png)
335+
![21.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/21.png?raw=true)
336+
337+
![22.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/22.png?raw=true)
338338

339339
最后打开 MySQL，创建一个名为 ofcms 的数据库，导入`fcms/doc/sql`下的 sql 文件即可。
340340

341341
然后启动项目
342342

343-
![image-20191128204708155](/Users/panda/Library/Application Support/typora-user-images/image-20191128204708155.png)
343+
![23.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/23.png?raw=true)
344344

345345
即可访问该项目：
346346

347-
![image-20191128204614625](/Users/panda/Library/Application Support/typora-user-images/image-20191128204614625.png)
348-
349-
347+
![24.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/24.png?raw=true)
350348

351349
站点地址：http://localhost:8080/ofcms-admin/
352350

@@ -381,7 +379,7 @@ public void create() {
381379

382380
在后台中找到该段代码对应的功能：
383381

384-
![image-20191129140424919](/Users/panda/Library/Application Support/typora-user-images/image-20191129140424919.png)
382+
![25.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/25.png?raw=true)
385383

386384
抓包传入一句测试的语句：
387385

@@ -390,11 +388,11 @@ update of_cms_link set link_name='panda' where link_id = 4
390388

391389
```
392390

393-
![image-20191129140317344](/Users/panda/Library/Application Support/typora-user-images/image-20191129140317344.png)
391+
![26.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/26.png?raw=true)
394392

395393
查看 SQL 执行记录：
396394

397-
![image-20191129140342507](/Users/panda/Library/Application Support/typora-user-images/image-20191129140342507.png)
395+
![27.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/27.png?raw=true)
398396

399397
完完全全的可以控制 update 型的 SQL 注入语句，因此可以利用以下语句进行注入：
400398

@@ -403,7 +401,7 @@ update of_cms_link set link_name=updatexml(1,concat(0x7e,(user())),0) where link
403401

404402
```
405403

406-
![image-20191129140756239](/Users/panda/Library/Application Support/typora-user-images/image-20191129140756239.png)
404+
![28.png](https://github.com/cn-panda/JavaCodeAudit/blob/master/%E3%80%9002%E3%80%91SQL%20%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E4%B8%8E%E5%AE%9E%E9%99%85%E6%A1%88%E4%BE%8B%E4%BB%8B%E7%BB%8D/img/28.png?raw=true)
407405

408406
### 4、修复方案
409407

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL