asp网站SQL注入与网站定向爆破全过程

Dim Tmp
Tmp = Request("test")
IF Len(Tmp) > 9 then
    Response.Write "fuck you!"
    Response.End
ElseIF IsNumber(Tmp) = False Then
    Response.Write "fuck you!"
    Response.End
ElseIF Instr(Tmp, "+") > 0 Then
    Response.Write "fuck you!"
    Response.End
ElseIF Instr(Tmp, "-") > 0 Then
    Response.Write "fuck you!"
    Response.End
ElseIF Instr(Tmp, ".") > 0 Then
    Response.Write "fuck you!"
    Response.End
Else
    Response.Write "ok!"
End IF

Dim Tmp, I
Tmp = Request("test")
Tmp = Replace(Tmp, "'", "'")
Tmp = Replace(Tmp, """", """")
Tmp = Replace(Tmp, chr(10), "")
Tmp = Replace(Tmp, chr(13), "")
Response.Write "ok!"

CREATE TABLE [dbo].[Users](

[Id] [uniqueidentifier] NOT NULL,

[UserId] [int] NOT NULL,

[UserName] [varchar](50) NULL,

[Password] [varchar](50) NOT NULL,

 CONSTRAINT [PK_Users] PRIMARY KEY CLUSTERED

(

[Id] ASC

)WITH (PAD_INDEX  = OFF, STATISTICS_NORECOMPUTE  = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS  = ON, ALLOW_PAGE_LOCKS  = ON) ON [PRIMARY]

) ON [PRIMARY]

INSERT INTO [Test].[dbo].[Users]([Id],[UserId],[UserName],[Password])VALUES (NEWID(),1,'name1','pwd1');
INSERT INTO [Test].[dbo].[Users]([Id],[UserId],[UserName],[Password])VALUES (NEWID(),2,'name2','pwd2');
INSERT INTO [Test].[dbo].[Users]([Id],[UserId],[UserName],[Password])VALUES (NEWID(),3,'name3','pwd3');
INSERT INTO [Test].[dbo].[Users]([Id],[UserId],[UserName],[Password])VALUES (NEWID(),4,'name4','pwd4');
INSERT INTO [Test].[dbo].[Users]([Id],[UserId],[UserName],[Password])VALUES (NEWID(),5,'name5','pwd5');

select COUNT(*) from Users where Password = 'a' and UserName = 'b' or 1=1—'这里有人将UserName设置为了 “b' or 1=1 –”.

class Program
{
    private static string connectionString = "Data Source=.;Initial Catalog=Test;Integrated Security=True";

    static void Main(string[] args)
    {
        Login("b", "a");
        Login("b' or 1=1--", "a");
    }

    private static void Login(string userName, string password)
    {
        using (SqlConnection conn = new SqlConnection(connectionString))
        {
            conn.Open();
            SqlCommand comm = new SqlCommand();
            comm.Connection = conn;
            //为每一条数据添加一个参数
            comm.CommandText = "select COUNT(*) from Users where Password = @Password and UserName = @UserName";
            comm.Parameters.AddRange(
            new SqlParameter[]{                       
                new SqlParameter("@Password", SqlDbType.VarChar) { Value = password},
                new SqlParameter("@UserName", SqlDbType.VarChar) { Value = userName},
            });

            comm.ExecuteNonQuery();
        }
    }
}

DBCC FreeProccache

select total_elapsed_time / execution_count 平均时间,total_logical_reads/execution_count 逻辑读,
usecounts 重用次数,SUBSTRING(d.text, (statement_start_offset/2) + 1,
         ((CASE statement_end_offset
          WHEN -1 THEN DATALENGTH(text)
          ELSE statement_end_offset END
            - statement_start_offset)/2) + 1) 语句执行 from sys.dm_exec_cached_plans a
cross apply sys.dm_exec_query_plan(a.plan_handle) c
,sys.dm_exec_query_stats b
cross apply sys.dm_exec_sql_text(b.sql_handle) d
--where a.plan_handle=b.plan_handle and total_logical_reads/execution_count>4000
ORDER BY total_elapsed_time / execution_count DESC;

private static void TestMethod()
{
    using (SqlConnection conn = new SqlConnection(connectionString))
    {
        conn.Open();
        SqlCommand comm = new SqlCommand();
        comm.Connection = conn;
        //使用exec动态执行SQL　
        //实际执行的查询计划为(@UserID varchar(max))select * from Users(nolock) where UserID in (1,2,3,4)　　
        //不是预期的(@UserID varchar(max))exec('select * from Users(nolock) where UserID in ('+@UserID+')')   
        comm.CommandText = "exec('select * from Users(nolock) where UserID in ('+@UserID+')')";
        comm.Parameters.Add(new SqlParameter("@UserID", SqlDbType.VarChar, -1) { Value = "1,2,3,4" });
        //comm.Parameters.Add(new SqlParameter("@UserID", SqlDbType.VarChar, -1) { Value = "1,2,3,4); delete from Users;--" });
        comm.ExecuteNonQuery();
    }
}

exec sp_executesql N'exec(''select * from Users(nolock) where UserID in (''+@UserID+'')'')',N'@UserID varchar(max) ',@UserID='1,2,3,4' 可以看到SQL语句并没有参数化查询。 如果你将UserID设置为”1,2,3,4); delete from Users;—-

”,那么执行的SQL就是下面这样：exec sp_executesql N'exec(''select * from Users(nolock) where UserID in (''+@UserID+'')'')',N'@UserID varchar(max) ',@UserID='1,2,3,4); delete from Users;--'