sql高级注入,advanced_sql_injection

Advanced SQL Injection In SQL Server

Applications

Chris Anley [chris@ngssoftware.com]

[Abstract] ............................................................................................................................ 3

[Introduction] ...................................................................................................................... 3

[Obtaining Information Using Error Messages] ................................................................. 7

[Leveraging Further Access]............................................................................................. 12

[Defences] ......................................................................................................................... 21

[References] ...................................................................................................................... 24

Appendix A - 'SQLCrack' ................................................................................................. 25

This document discusses in detail the common 'SQL injection' technique, as it applies to

communicate with databases and by security professionals whose role includes auditing

these web applications.

return a single 'result set'. SQL statements can modify the structure of databases (using

Data Definition Language statements, or 'DDL') and manipulate the contents of databases

specifically discussing Transact-SQL, the dialect of SQL used by Microsoft SQL Server.

SQL Injection occurs when an attacker is able to insert a series of SQL statements into a

The reason for this is that the insertion of the 'single quote' character 'breaks out' of the

single-quote delimited data. The database then tried to execute 'hn' and failed. If the

attacker specified input like this:

difficulties with this method as a solution. First, not all user-supplied data is in the form

of strings. If our user input could select an author by 'id' (presumably a number) for