一種自動(dòng)SQL注入攻擊檢測(cè)與利用系統(tǒng)的研究實(shí)現(xiàn).pdf

1、北京交通大學(xué)碩士學(xué)位論文一種自動(dòng)SQL注入攻擊檢測(cè)與利用系統(tǒng)的研究實(shí)現(xiàn)姓名：符宇波申請(qǐng)學(xué)位級(jí)別：碩士專業(yè)：計(jì)算機(jī)科學(xué)與技術(shù)指導(dǎo)教師：張駿溫201106ABSTRACTTheCoInputI昌rne吶ork叩plicationhasbecIlirⅣolVcdiIlallaspectsofourdailylife，mesecurit)roftlledatab嬲ewhichCo衄ectt0mene咐orkapplicationhasbecom

2、e鋤in蝴ingconc鋤T11ispaperrese鯽chestlleSQLiIljectionⅦ1nerabilities肌ddefI饑seofthebaCkenddatab嬲e，mal【es血e觚alysisofthecauses觚dc_haract研sticsoftlleattackaSpect，illus缸atestlleg吼eralst印s趾dmemodsofSQL蛔ectionattaCks，illustratesⅡlem

3、emodsofSQLiIljectiondef饑se，realizetllesyStemofautomaticSQLi坷ectiondetectingaIldutiliziI培111esysteIllinclude踟tomaticSQLiIljectiondetecting，SQL螄eCtionutilizingandm舢姐lSQLⅫectiondctectingIIlnleautomaticSQLiIljectionattackdet

4、ectionmodule，Ⅱleuserinputb鶴eURL，tIleprogramc孤getallⅡ圮pagewhichundertllebaseURL缸o(hù)ugllthesourcefileofmebaseW曲pageAjfter廿1ecllstomizationand0ptimiz撕onofmeW曲∞聊ler，itordyr印tilesⅡ圮W曲pagc、)l臨chisnonrepetition鋤dh嬲吐lekeydomaill舢l

5、dn嗽ltesttlleURLoft11er印tiles，nleuserc姐getthepagew】1ichc勰be細(xì)ectedh也IeSQLiIljectionutilizingmodule，mellsere11tersaⅦln咖blepageaddrcss，m即c鋤beobtaineddirectly廿1crcsult11lismodulenotoIllybymegcIleralmethodofSQLiIlje嘶ona仕acl【s，

6、butalsobytlleSQLdictiona巧guess鋤dblindtestingGetmed撕b嬲et)rpe，瑚ern鋤e觚ddatab弱en鋤ebytlle缸aditionalSQLi匈ection，g融tlletdblen乏吼es，c01umnn鋤esby仕aditionalSQLi坷cction觚ddictionaryguess，getⅡlecom鋤tsoftlledata：baSebyme仃aditionalSQLi匈

7、ection趾dliterallyblirldguessThrou曲a11ofmistocon叩letemeworkofgetdatab嬲eillfo吼acionIllmemanualSQL廁ectiondetectmodule，t11euserc趾inputspecijfic(tlaVebeeIl刎ected0rnot)URLtogettlle鯽lrCecodeofmepage，meuserc鋤analyzea11dmakejud舯e