摘要
文章主要介绍了在SQL注入攻击中的一种新攻击技术—盲注攻击,首先介绍了SQL盲注技术的定义和危害,然后讨论了在错误信息被屏蔽的情况下如何探测SQL注入漏洞,确定SQL注入点,构造正确的注入句法及其利用代码,最后详细阐述了利用UNION SELECT语句来统计数据表的列数和判断列的数据类型的方法和步骤。
This paper presents a new attack technique for SQL Injection Attack-Blind SQL Injection Technique. In this paper, the definition and risk of Blind SQL Injection is first presented. Then, the paper discusses that, when detailed error messages are suppressed, how to identify SQL Injections based on minimal reaction of the server, and how to identify SQL Injection vulnerable parameters, to generate valid injection syntax and to build the required exploit. Finally, one attack model by UNION SELECT is described in detail. This paper tries to make it clear that application level vulnerabilities must be handled by application level solutions, and that relying on suppressed error messages for protection from SQL Injection is eventually useless.
出处
《信息安全与通信保密》
2008年第5期71-73,76,共4页
Information Security and Communications Privacy
