一種自動SQL注入攻擊檢測與利用系統(tǒng)的研究實現(xiàn).pdf

1、北京交通大學碩士學位論文一種自動SQL注入攻擊檢測與利用系統(tǒng)的研究實現(xiàn)姓名：符宇波申請學位級別：碩士專業(yè)：計算機科學與技術指導教師：張駿溫201106ABSTRACTTheCoInputI昌rne吶ork叩plicationhasbecIlirⅣolVcdiIlallaspectsofourdailylife，mesecurit)roftlledatab嬲ewhichCo衄ectt0mene咐orkapplicationhasbecom

2、e鋤in蝴ingconc鋤T11ispaperrese鯽chestlleSQLiIljectionⅦ1nerabilities肌ddefI饑seofthebaCkenddatab嬲e，mal【es血e觚alysisofthecauses觚dc_haract研sticsoftlleattackaSpect，illus缸atestlleg吼eralst印s趾dmemodsofSQL蛔ectionattaCks，illustratesⅡlem

3、emodsofSQLiIljectiondef饑se，realizetllesyStemofautomaticSQLi坷ectiondetectingaIldutiliziI培111esysteIllinclude踟tomaticSQLiIljectiondetecting，SQL螄eCtionutilizingandm舢姐lSQLⅫectiondctectingIIlnleautomaticSQLiIljectionattackdet

4、ectionmodule，Ⅱleuserinputb鶴eURL，tIleprogramc孤getallⅡ圮pagewhichundertllebaseURL缸ougllthesourcefileofmebaseW曲pageAjfter廿1ecllstomizationand0ptimiz撕onofmeW曲∞聊ler，itordyr印tilesⅡ圮W曲pagc、)l臨chisnonrepetition鋤dh嬲吐lekeydomaill舢l

5、dn嗽ltesttlleURLoft11er印tiles，nleuserc姐getthepagew】1ichc勰be細ectedh也IeSQLiIljectionutilizingmodule，mellsere11tersaⅦln咖blepageaddrcss，m即c鋤beobtaineddirectly廿1crcsult11lismodulenotoIllybymegcIleralmethodofSQLiIlje嘶ona仕acl【s，

6、butalsobytlleSQLdictiona巧guess鋤dblindtestingGetmed撕b嬲et)rpe，瑚ern鋤e觚ddatab弱en鋤ebytlle缸aditionalSQLi匈ection，g融tlletdblen乏吼es，c01umnn鋤esby仕aditionalSQLi坷cction觚ddictionaryguess，getⅡlecom鋤tsoftlledata：baSebyme仃aditionalSQLi匈

7、ection趾dliterallyblirldguessThrou曲a11ofmistocon叩letemeworkofgetdatab嬲eillfo吼acionIllmemanualSQL廁ectiondetectmodule，t11euserc趾inputspecijfic(tlaVebeeIl刎ected0rnot)URLtogettlle鯽lrCecodeofmepage，meuserc鋤analyzea11dmakejud舯e