基于差异备份的Cookie注入挂马技术及调查方法研究  

The Research of Trojan Horse Technology and Investigation Method on Differential Backup and Cookie Injection

作　　者：徐国天[1] 

机构地区：[1]中国刑警学院计算机犯罪侦查系,辽宁沈阳110854

出　　处：《信息网络安全》2012年第5期10-14,共5页Netinfo Security

基　　金：公安部应用创新计划项目[2011YYCXXJXY119]

摘　　要：文章分析了SQL注入的成因,并结合一款ASP注入防火墙的源代码,分析了注入防火墙的基本原理,并结合具体的Sniffer报文分析了Cookie注入技术。该文通过一个实际案例重点研究了差异备份的挂马技术,总结出针对各种日志进行关联分析,并获得攻击线索的方法,即根据行为特征确定攻击源方法。The cause of SQL injection had been studied in detail.In this paper, a asp injection firewall was used to study, the fundamental principle was analyzed. Through a sniffer packet,cookie injection technique had been studied. Trojan horse technology on differential backup was analyzed. The correlation analysis method was summarized. The method based on behavioral characteristics to determine the source of the attack had been studied.

关 键 词：差异备份 COOKIE 挂马 调查 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]