当前位置:网站首页>SQL injection - secondary injection and multi statement injection
SQL injection - secondary injection and multi statement injection
2022-07-07 05:05:00 【In a word, the Trojan horse (the growth road of Wang an Xiaobai)】
The secondary injection
One 、 Definition of secondary injection
Simply put, secondary injection is the user input that has been stored in the database , Go in when reading again SQL Injection in query statement .
Two 、 The principle of secondary injection
First step : Insert malicious data
When inserting data into the database for the first time , Only special characters are escaped , When writing to the database, the original data is retained , But the data itself contains malicious content .
The second step : Reference malicious data
After saving into the database , Developers believe that the data is credible , The next time you need to query , Propose malicious data directly from the database , No further inspection and treatment , Will cause sql Secondary injection data of
3、 ... and 、 Demonstration of the principle of secondary injection
1. open http://localhost/sqlilabs/Less-24/ , Is a user login page , Input admin;admin Log in
2. First, we click to register a new user
username:admin'# password:456
3. Change the password of the current user again Change it to :777
4. Return to the main page to log in admin account number , Use the original password :admin , Found an error
5. In the login admin account number , Use the one just changed admin'# Password :777, Found successful login
6. stay Navicat View database table in
Multi statement injection
One 、 Prerequisites for multi statement injection
Source code usage mysqli_multi_query(); Multi statement query function , You can execute multiple at a time sql sentence , But in reality , Such as PHP In order to prevent SQL Mechanism , The functions that are often used to call the database are mysqli_ query() function , It can only execute one statement , What follows the semicolon will not be executed , Therefore, it can be said that the use conditions of stack injection are very limited , Once it can be used , It may pose a great threat to the website .
边栏推荐
- File upload vulnerability summary
- 动态生成表格
- U++ 元数据说明符 学习笔记
- 深入解析Kubebuilder
- QT控件样式系列(一)之QSlider
- [hand torn STL] list
- STM32 encapsulates the one key configuration function of esp8266: realize the switching between AP mode and sta mode, and the creation of server and client
- npm ERR! 400 Bad Request - PUT xxx - “devDependencies“ dep “xx“ is not a valid dependency name
- ASP. Net MVC - resource cannot be found error - asp Net MVC – Resource Cannot be found error
- c语言神经网络基本代码大全及其含义
猜你喜欢
随机推荐
Leetcode(46)——全排列
If you ask me about R code debugging, I will tell you head, STR, help
一个酷酷的“幽灵”控制台工具
【Android Kotlin协程】利用CoroutineContext实现网络请求失败后重试逻辑
QT控件样式系列(一)之QSlider
第一篇论文的写作流程
Run the command once per second in Bash- Run command every second in Bash?
AttributeError: module ‘torch._ C‘ has no attribute ‘_ cuda_ setDevice‘
C语言中函数指针与指针函数
PLC模拟量输出 模拟量输出FB analog2NDA(三菱FX3U)
[Android kotlin collaboration] use coroutinecontext to realize the retry logic after a network request fails
JS input and output
全国气象数据/降雨量分布数据/太阳辐射数据/NPP净初级生产力数据/植被覆盖度数据
01机器学习相关规定
Leetcode notes
Basic knowledge of road loss of 3GPP channel model
使用知云阅读器翻译统计遗传学书籍
装饰器基础学习02
LabVIEW在打开一个新的引用,提示内存已满
AOSP ~Binder 通信原理 (一) - 概要