// reads the data from account.
resultSet = statment.executeQuery (“select * from account where accountId
= '“+ request.getParameter (“id”) +” '”);
// circulates, finished until resultSet
while (resultSet.next())
{
// reads the value from resultSet to output to the page.
out.print (resultSet.getInt(1)+ "|"); // takes out the first row value, because is the digital type institute
By is getInt();
out.print (resultSet.getString(2)+ "|"); // takes out the second row value, because is the string of character class
, therefore is getString();
out.print (resultSet.getString(3)+ "|");
out.print (“<br/>”); // page outputs line feeds
}
%>
</body>
</html>
2. crack's use
(bad wolf safety net provides Figure 1)
This was in the database records. The later yellow is the essential sentence, red for input part.
Everybody attention looks at resultSet = statment.executeQuery (“select * from account
where accountId = '“+ request.getParameter (“id”) +” '”);
Here request.getParameter (“id”) is gains GET to pass on senate's id parameter, is also
mysqlInject.jsp? id=1 here id. Like this SQL sentence turned select * from
account where accountId = '1 '. If performs to transform?
2.1 crack's examinations
We wrote id mysqlInject.jsp? id=1' that the SQL sentence turns select * from
account where accountId = '1 ' ', such words SQL sentence has been wrong on the bulletin, because of SQL sentence value
Is needs 2 to contain the mark, for instance ' and”, if is only the digit may anything not write. If does not report the wrong description program replace,
The filtration or other methods protected.
Then we may continue to examine, mysqlInject.jsp? id=1' and ''= ' that the SQL sentence changes
Has become select * from account where accountId = '1 ' and ''= '', should return positively
Often.
Some people said why I do return not normally? Some 2 kind of reasons, first was the procedure filters the malicious character; Second is a regulation
The foreword sentence and I write dissimilar select * from account where accountId = 1 ' and ''= '.
This question will talk about under.
2.2 Union inquiries guess this inquiry row quantity
Here some people will say that guessed what this inquiry row quantity will have to use? If is only the examination does not certainly have, but you want to enter one
A step use that had the big use, behind the article will talk about, patience.
If understands SQL the human should know the UNION inquiry? The UNION inquiry is inquires jointly, carries out the second inquiry
The sentence will return to the value and this inquiry merge.
Everybody thinks, if what condition can need with this inquiry value merge? Needs to unite the inquiry the enumeration and this
Inquiry's enumeration is equal. If does not want to wait will be unable to merge, will then be wrong on the bulletin. Through this characteristic intelligent you should
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * Next>>
|
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course