SQL INJECTION52 Advanced SQL Injection 공격사례 정리 1 개요1.1 SQL Query1.2 DML & DLL1.3 Metabata1.4 웹 어플리케이션1.5 일반적인 취약한 로그인 쿼리2 SQL Injection 테스트 방법론1) 입력 값 검증2) 정보 수집3) 1=1 Attacks5) OS Interaction6) OS 명령 프롬프트7) 확장된 효과3 회피 기술3.1 개요3.2 IDS “signature” 우회3.3 입력 값 검증 우회 하기3.4 회피와 우회4 SQL Injection 대응 방안4.1 개요4.2 탐지 및 제한시키기4.3 결론※ 참조자료 및 문서 1 개요SQL은 Structured Query Language의 표준이며, 사용자에게 데이터 베이스를 접근 할 수 있게 해준다. 현재 대부분 SQL99가 SQL Language의 표준이다. SQL은.. 2012. 5. 21. sqlifuzzer: Command Line SQL Injection Web Scanner Features of Sqlifuzzer: Payloads/tests for numeric, string, error and time-based SQL injection Support for MSSQL, MYSQL and Oracle DBMS’s Automated testing of ‘tricky’ parameters like POST URL query and mulipart form parameters A range of filter evasion options: case variation, nesting, double URL encoding, comments for spaces, ‘like’ for ‘equals’ operator, intermediary characters, null and CRLF.. 2012. 4. 17. Time Based Blind SQL Injection I am not going to talk about Blind SQL injection since this is fully documented across different web sites, check References section at the end of this blog. The reason I am writing this blog is for two main purposes: 1. Bug Hunting: To explain the process I followed to discover a "not-easy-to-find" vulnerability. 2. Exploit form scratch: To release a tool to extract data from the Data base via .. 2012. 3. 20. False SQL Injection and Advanced Blind SQL Injection ######################################################################### # # # Exploit Title: False SQL injection and advanced blind SQL injection # # Date: 21/12/2011 # # Author: wh1ant # # # ######################################################################### 이 문서는 SQL injection 공격이 웹 방화벽이나 기타 보안 솔루션 방어 우회가 가능하다는걸 공개하기 위해 작성하였다. 한국 웹 방화벽을 대상으로 테스트 한 결과 대부분의 SQL injection 필터링 우회가 가능하였다. 이.. 2011. 12. 30. SQL Injection Scanning Update - Filter Evasions Detected As we reported in the previous [Honeypot Alert] WordPress/Joomla/Mambo SQL Injection Scanning Detected alert - we have identified an increase in mass SQL Injection scanning targeting various community components. While this scanning is still ongoing, we have identified a slight variation if the attack methodology used. Here are examples from today's web server logs: GET /index.php?option=com_acp.. 2011. 12. 16. 이전 1 2 3 4 5 6 ··· 11 다음 728x90
