SQL花式延时/布尔注入与PHP白名单函数利用方法

SQL注入攻防实战全解析:从攻击原理到六层纵深防御体系 SQL注入作为Web安全领域的经典漏洞,其核心原理在于攻击者能够将恶意SQL代码“注入”到应用程序的数据库查询中,从而非授权操作数据库。这项技术的危害性在于它直接威胁数据安全,可能导致数据泄露、篡改甚至服务器被控制。从技术价值看,理解SQL注入是构建安全应用的基础,它迫使开发者严格遵循“数据与代码分离”的安全编码范式。在实际应用场景中,无论是电商、金融还是企业OA系统,任何涉及数据库交互的Web应用都可能面临此类风险。本文以实战为导向,深入剖析联合查询、布尔盲注、时间盲注等主流攻击手法,并系统性地构建了从预 阅读详情

0x01 冗长的前奏:

    来源于两道CTF题目,引发自闭中的一点点思考。

    想中止这一切菜鸡的挣扎。

(顺便分享一篇大佬的SQL注入文章https://blog.youkuaiyun.com/nzjdsds/article/details/86767711)

 

 

0x02 CTF中的强行时间盲注

2-1题目情况:

  

 

 

2-2题目思路

    先尝试常规方法

admin' and '1'='1 提示密码错误

admin' andd '1'='1 提示数据库操作失败

说明是字符型,没有过滤空格、单引号,我们的语句是生效的。

 

但发现or if sleep benchmark会被替换成QWQ~卖萌,就没法任意的登录了

(过滤or的坑还在于,information_shcema中有 or )

通过fuzz,测试得出|竖线也会被替换成QWQ~

 

    尝试绕过(利用可能删除SQL语句中的尖括号,重拼接敏感单词)

发现写成 o<a>r 会变成 or

自动删去<a> ,规则是完整尖括号,中间字母开头,例如<abcdefgh12345>都会整个删掉,<1abc>则不删。

原理大概是,为了防止html标签进入数据库,在出库显示的时候,直接html注入,或者xss了,所以做的过滤。

 

    即使成功拼接出了or,还提示数据库错误,无法万能密码登录

    想想语句,大概是 select * from user where username='xxx' and password='xxx'

这样的语句,只好盲注,但发现sleep()不能用。

 

 

2-3 不用sleep的延时注入

  rpad函数

主要MySQL、Oracle中

rpad(str1,length,str2)

如select rpad('abc',10,'z');

abc只有3位,要用7位'z'去凑齐10位length

结果如下:

此函数也有从头截断功能,若需要从abcdef中截取abc,只需要Length为3<

SQL注入攻防全解析:从原理到实战的纵深防御体系 SQL注入是一种利用Web应用与数据库交互时,将用户输入的数据与代码指令混淆执行的攻击方式。其核心原理在于程序未对用户输入进行妥善处理,直接将其拼接到SQL语句中,导致数据库引擎将输入数据误解析为代码执行。这种攻击技术价值在于其直接性、高危害性和持久性,是数据泄露和系统破坏的常见入口。在应用场景上,无论是电商、社交还是企业管理系统,只要涉及数据库交互,都可能面临SQL注入风险。本文聚焦于参数化查询和输入验证两大核心防御技术,通过PHP、Java、Python等主流语言的实战代码,详细拆解了如何通过预编译语句 阅读详情

相关推荐

SQL注入之路之二:布尔型(boolean)盲注

简单描述什么是布尔型盲注以及对与布尔型盲注如何进行注入,通过使用SQLmap自动化工具和人工结合burp suite两种方式讲述如何进行简单注入,并通过对DVWA靶场进行实操来验证手工结合burp suite实现布尔型注入的合理性

weixin_62715196的博客 1946

sql注入-布尔盲注

布尔盲注(Boolean Blind SQL Injection)是一种SQL注入攻击技术,用于在无法直接获得查询结果的情况下推断数据库信息;它通过发送不同的SQL查询来观察应用程序的响应,进而判断查询的真假,并逐步推断出有用的信息。接着我们以DVWA靶场中的为例子进行解释;可以看到该靶场只能显示数据库中是否存在该ID,并不会显示其他数据,那么此时我们就无法直接获得查询结果的情况下推断数据库信息,因此联合查询已经无法满足要求,那么我们就可以使用布尔盲注或其他的注入思想突破。

WolvenSec的博客 3860

webug-布尔注入

布尔注入是盲注之一,进行sql语句注入后,选择的数据并不能返回到前端。只能利用其他方法来判断,还是简单介绍下学到的知识点。 left(database(),n)    database() 数据库名称 left()函数表示截取数据库左侧n个字符 substr(a,b,c)      从字符串a的b位置开始截取c个字符,当b为负数时截取位置是从字符串a右端向左数b个字符 mid(a,b,c) ...

我只会装360的博客 983

《网络安全自学教程》- SQL注入之布尔盲注原理+步骤+实战操作

这篇文章为大家解析布尔盲注实现原理,结合实战案例讲解布尔盲注使用步骤

wangyuxiang946的博客 1万+

S32K144之芯片锁死解锁——关闭debug端口

S32K144之芯片锁死及解锁 经常捣鼓单片机就会发现,时常会因为某些操作不当导致芯片锁死情况的发生,通过Jlink我们可以读到芯片的ID,但是无法进行Debug,这很是让人苦恼。 基于S32K144的芯片锁死,一般有如下几种可能: 1、时钟配置异常,过高的配置时钟频率以及不配置时钟,都有可能造成芯片保护锁死,我就曾经因为不注意把时钟配置代码注释掉,导致芯片锁死。 2、我是微软雅黑烧写断电,如果在...

weixin_41935674的博客 1万+

智能驾驶域控(ADCU)方案介绍

本文主要对智能驾驶域控(ADCU)方案相关知识进行总结,以加深理解,及方便后续查漏补缺。

liuxu324的博客 1574

python 抖音采集_python爬取抖音视频的实例详解

import requestsimport jsonimport reimport osfrom pprint import pprint as ppimport queueclass DouYin:header = {'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*...

weixin_35795675的博客 1864

阿里云导出的镜像raw转换成vmdk格式工具

阿里云导出的镜像raw转换成vmdk格式工具 1.安装java环境,安装教程不介绍了 2.raw2vmdk软件下载: 在我的链接里面: 3.使用 打开cmd.bat软件: java -jar raw2vmdk.jar (原镜像)C:\\images\\raw\\disk.img (转换的镜像)D:\\images\\vmdk\\disk.vmdk 4.vmware打开vmdk文件 ...

3845

AD9361快速锁定实战:Profile寄存器配置与频率调谐算法解析

本文深入解析了AD9361射频收发器的快速锁定(Fast Lock)功能,重点阐述了其核心机制——Profile寄存器配置。通过剖析16字节Profile结构,详细讲解了频率调谐算法,包括LO_DIV、LO_INT、LO_FRAC等关键参数的计算,以及如何通过查表获取优化的环路滤波器参数。文章提供了完整的Python算法示例和FPGA实现要点,旨在帮助工程师实现毫秒级甚至微秒级的频率切换,满足跳频通信等高性能应用需求。

weixin_29196315的博客 229

大语言模型在金融风险预警中的推理应用探索

金融行业一直面临着各种风险,如信用风险、市场风险、操作风险等。准确及时的风险预警对于金融机构的稳定运营和投资者的利益保护至关重要。传统的金融风险预警方法主要基于结构化数据和统计模型,虽然在一定程度上能够识别风险,但对于非结构化数据的处理能力有限,难以捕捉到复杂的风险因素和潜在的风险趋势。大语言模型作为自然语言处理领域的重要突破,具有强大的语言理解和生成能力,能够处理各种形式的文本数据。

AI天才研究院 1169

Amesim应用篇-电芯等效电路模型标定

为了使计算模型更加准确,在有电芯实验测试数据的情况下,依据现有的实验数据对Amesim中的电池等效电路模型进行标定。标定的目的是为了获得更加符合项目实际情况的电芯等效电路模型,标定完的电芯可以用于搭建PACK模型,也可以用于其他虚拟实验。本文以充电标定为例,进行介绍。放电标定与充电一致。

2201_75375391的博客 1213

【2025CSPJ普及组】T4. 多边形

【2025CSPJ普及组】T4. 多边形【题目描述】小 R 喜欢玩小木棍。小 R 有 n 根小木棍,第i(1≤i≤n) 根小木棍的长度为 ai。

lybc2019的博客 849

Data-Structures-and-Algorithm-Analysis-in-Java.pdf

作者: Weiss, Mark A. 出版社: Addison Wesley Data Structures and Algorithm Analysis in Java is an “advanced algorithms” book that fits between traditional CS2 and Algorithms Analysis courses. In the old ACM Curriculum Guidelines, this course was known as CS7. This text is for readers who want to learn good programming and algorithm analysis skills simultaneously so that they can develop such programs with the maximum amo...

深度学习工具包 DeepLearningToolbox

深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/rasmusbergpalm/deeplearntoolbox/trend.png)](https://bitdeli.com/free "Bitdeli Badge")

霍尼韦尔SoftMaster使用说明

霍尼韦尔SoftMaster使用说明

VB摄像头监控

该VB模块可对摄像头捕获的画面进行录像等,可在创建的窗口进行控制

上一篇: 【CTF】关于SQL盲注的细节
下一篇: C++基础学习(1)
publicStr
博客等级 码龄9年 40粉丝 17原创
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付:10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值