JSP下Statement存在SQL注入攻击漏洞验证

最新推荐文章于 2023-05-10 15:21:48 发布

echosun1996

最新推荐文章于 2023-05-10 15:21:48 发布

阅读量1.0k

点赞数

分类专栏：网络安全

本文链接：https://blog.csdn.net/echosun1996/article/details/78393259

版权

1 篇文章 0 订阅

订阅专栏

环境配置：mysql下

create database demo;

use demo;
create table user(username varchar(100),password varchar(100));

insert into user values("test","test");

 
  send.jsp 
 

   <%@ page language="java" contentType="text/html; charset=UTF-8" 
 

   pageEncoding="UTF-8"%> 
 

   <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 
 

   <html> 
 

   <head> 
 

   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 
 

   <title>Insert title here</title> 
 

   </head> 
 

   <body> 
 

   <form action="hack.jsp" method="post"> 
 

   <ul> 
 

   <li>模拟sql注入攻击</li> 
 

   <li>用户名 <input type="text" name="username" /></li> 
 

   <li>密码 <input type="password" name="password" /></li> 
 

   <li><input type="submit" value="提交" /> <input type="reset" 
 

   value="重置" /></li> 
 

   </ul> 
 

   </body> 
 

   </html> 
 

 
  hack.jsp 
 

   <%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8" 
 

   pageEncoding="UTF-8"%> 
 

   <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 
 

   <html> 
 

   <head> 
 

   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 
 

   <title>Insert title here</title> 
 

   </head> 
 

   <body> 
 

<%

   String username=request.getParameter("username"); 
 

   String password=request.getParameter("password"); 
 

   try { 
 

   Class.forName("com.mysql.jdbc.Driver"); 
 

   } catch (ClassNotFoundException e) { 
 

   e.printStackTrace(); 
 

}

   Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456"); 
 

   Statement statement=connection.createStatement(); 
 

   ResultSet resultSet=statement.executeQuery("select * from user where username='"+username+"'and password='"+password+"'"); 
 

   if(resultSet.next()) 
 

{

   out.print("<p>用户名:"+resultSet.getString(1)+" 密码"+resultSet.getString(2)+"</p></br>"); 
 

   out.print("登陆成功"); 
 

}

   else 
 

   out.print("用户名或密码错误"); 
 

%>

   </body> 
 

   </html> 
 

 
  攻击方式 
 

   用户名或密码输入： 
 

   'or 1=1 or' 
 

   即可登陆成功。提示信息： 
 

   用户名:test 密码test 
 

   登陆成功 
 

 
  优化方法 
 

   使用 
  PreparedStatement来避免SQL攻击，如下，问题解决。 
 

   <%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8" 
 

   pageEncoding="UTF-8"%> 
 

   <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 
 

   <html> 
 

   <head> 
 

   <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 
 

   <title>Insert title here</title> 
 

   </head> 
 

   <body> 
 

<%

   String username=request.getParameter("username"); 
 

   String password=request.getParameter("password"); 
 

   try { 
 

   Class.forName("com.mysql.jdbc.Driver"); 
 

   } catch (ClassNotFoundException e) { 
 

   e.printStackTrace(); 
 

}

   Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456"); 
 

 
  PreparedStatement preparedStatement=connection.prepareStatement("select * from user where username=? and password=?"); 
 

 
  preparedStatement.setString(1, username); 
 

 
  preparedStatement.setString(2, password); 
 

   ResultSet resultSet=preparedStatement.executeQuery(); 
 

   if(resultSet.next()) 
 

{

   out.print("<p>用户名:"+resultSet.getString(1)+" 密码"+resultSet.getString(2)+"</p></br>"); 
 

   out.print("登陆成功"); 
 

}

   else 
 

   out.print("用户名或密码错误"); 
 

%>

   </body> 
 

   </html> 
 

 
 send.jsp 

  <%@ page language="java" contentType="text/html; charset=UTF-8" 

  pageEncoding="UTF-8"%> 

  <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 

  <html> 

  <head> 

  <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 

  <title>Insert title here</title> 

  </head> 

  <body> 

  <form action="hack.jsp" method="post"> 

  <ul> 

  <li>模拟sql注入攻击</li> 

  <li>用户名 <input type="text" name="username" /></li> 

  <li>密码 <input type="password" name="password" /></li> 

  <li><input type="submit" value="提交" /> <input type="reset" 

  value="重置" /></li> 

  </ul> 

  </body> 

  </html> 

 
 hack.jsp 

  <%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8" 

  pageEncoding="UTF-8"%> 

  <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 

  <html> 

  <head> 

  <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 

  <title>Insert title here</title> 

  </head> 

  <body> 

<%

  String username=request.getParameter("username"); 

  String password=request.getParameter("password"); 

  try { 

  Class.forName("com.mysql.jdbc.Driver"); 

  } catch (ClassNotFoundException e) { 

  e.printStackTrace(); 

}

  Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456"); 

  Statement statement=connection.createStatement(); 

  ResultSet resultSet=statement.executeQuery("select * from user where username='"+username+"'and password='"+password+"'"); 

  if(resultSet.next()) 

{

  out.print("<p>用户名:"+resultSet.getString(1)+" 密码"+resultSet.getString(2)+"</p></br>"); 

  out.print("登陆成功"); 

}

  else 

  out.print("用户名或密码错误"); 

%>

  </body> 

  </html> 

 
 攻击方式 

  用户名或密码输入： 

  'or 1=1 or' 

  即可登陆成功。提示信息： 

  用户名:test 密码test 

  登陆成功 

 
 优化方法 

  使用 
 PreparedStatement来避免SQL攻击，如下，问题解决。 

  <%@ page language="java" import="java.sql.*" contentType="text/html; charset=UTF-8" 

  pageEncoding="UTF-8"%> 

  <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 

  <html> 

  <head> 

  <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 

  <title>Insert title here</title> 

  </head> 

  <body> 

<%

  String username=request.getParameter("username"); 

  String password=request.getParameter("password"); 

  try { 

  Class.forName("com.mysql.jdbc.Driver"); 

  } catch (ClassNotFoundException e) { 

  e.printStackTrace(); 

}

  Connection connection=DriverManager.getConnection("jdbc:mysql://localhost/demo","root","123456"); 

 
 PreparedStatement preparedStatement=connection.prepareStatement("select * from user where username=? and password=?"); 

 
 preparedStatement.setString(1, username); 

 
 preparedStatement.setString(2, password); 

  ResultSet resultSet=preparedStatement.executeQuery(); 

  if(resultSet.next()) 

{

  out.print("<p>用户名:"+resultSet.getString(1)+" 密码"+resultSet.getString(2)+"</p></br>"); 

  out.print("登陆成功"); 

}

  else 

  out.print("用户名或密码错误"); 

%>

  </body> 

  </html> 

关注

专栏目录