基于SQL注入的渗透性测试技术研究  

Research on penetration testing based on SQL injection

作　　者：余静[1] 高丰[1] 徐良华[1] 朱鲁华[1] 

机构地区：[1]江南计算技术研究所,江苏无锡214083

出　　处：《计算机工程与设计》2007年第15期3577-3579,共3页Computer Engineering and Design

摘　　要：为了提高数据库系统的安全性,及时发现、防范网站中可能存在的SQL注入漏洞,分析了基于SQL注入的渗透性测试技术,在此基础上提出了渗透性测试的原型系统,给出了主要的功能,通过对动网论坛的渗透性测试分析比较了原型系统的效能。实验表明,该原型系统能较好发现系统的SQL注入的脆弱点,从而帮助管理员提升系统的安全性。In order to improve the security of database system and find the SQL injection vulnerabilities in time, some key penetration testing techniques are discussed and based on which the prototype system of penetration testing is introduced, Then the main functions are given and finally through penetration testing on the objects, efficiency of the prototype system is compared and analyzed. The experiment shows that the prototype system can find SQL injection vulnerabilities effectually and help the administrator to enhance the security.

关 键 词：渗透测试 SQL注入 代码注入 函数注入 缓冲区溢出 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]