SQL盲注入快速攻击方法研究  

Research of the Fast Attack Method for the SQL Blind Injection

作　　者：张令通[1] 罗森林[2] 

机构地区：[1]云南大理学院工程学院,云南大理671003 [2]北京理工大学信息系统及安全对抗实验中心,北京100081

出　　处：《信息网络安全》2013年第5期15-18,共4页Netinfo Security

摘　　要：为了给检测SQL注入漏洞提供理论依据和技术支持,通过对SQL注入攻击技术的研究和对SQL注入漏洞的本质特征的分析,提取了可动态配置内部参数的SQL攻击模板集,并以此模板集为基础,结合盲注入技术和多线程技术提出了一种SQL快速攻击方法,并建立了一套SQL盲注入快速攻击原型系统。系统利用SQL注入攻击模板集实施攻击行为,利用多线程技术提高系统攻击效率。实验结果表明,系统可以快速准确地实现攻击目的,获取后台数据库数据,可以很好地应用于检测Web应用程序存在的漏洞。To provide the theoretical basis and technical support for the detection of leaks for the SQL injection, by studying the attack technology of the SQL injection and analyzing the essential characteristics of leaks for the SQL injection, this paper extracts the attack template set of SQL, which can dynamically configure interior parameters. Based on the template set, we propose a fast attack method of SQL, and establish a set of fast attack prototype system of the SQL blind injection, combining with blind injection technology and multi-threading technology. The system uses the attack template set of the SQL injection to launch an attack and apply the multi-threading technology to improve attack efficiency. The experimental results show that the system, which can be well applied to detect the possibility of leaks existing in the application programs of Web, can accurately realize the attack goal and obtain the data of backstage database.

关 键 词：SQL注入攻击 攻击模板集 关键字匹配 SQL语法结构 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]