《网络攻击与防御》专题研究实验研究报告.docVIP

XXXXXXXXXXX学院 网络工程系 《网络攻击与防御》报告 ——SQL注入攻击技术专题研究 学 生： XXXXXXXXXXX 班 级： XXXXXXXXXXX 撰写时间： XXXXXXXXXX 摘 要 由于现今信息技术发展迅速，网络安全越来越成为虚拟网络中不可或缺的一部分。然而，因为各种Web服务器的漏洞与程序的非严密性，导致针对服务器的脚本攻击时间日益增多，其大多数是通过ASP或者PHP等脚本主图作为主要攻击手段，加之Web站点迅速膨胀的今天，基于两者的SQL注入也慢慢成为目前攻击的主流方式。其应用方式主要集在利用服务端口接收用户输入的功能，将构造的语句传给数据库服务器，让其执行者开发者规定外的任务。 目前至少70%以上的Web站点存在着SQL注入的缺陷，恶意用户便可以利用服务器、数据库配置的疏漏和精心构造的非法语句通过程序或脚本侵入服务器获得网站管理员的权限和数据库的相关内容，严重的还可以获得整个服务器所在内网的系统信息，它们的存在不仅对数据库信息造成威胁，甚至还可以威胁到系统和用户本身。 本文针对SQL注入技术进行专题研究，进行工具注入和手动注入两种途径的实验分析。全文共分为五个章节：第一章为全文引言部分，简单介绍本次专题研究背景、来源以及研究意义；第二章阐述SQL注入技术的背景与网络环境；第三章详细介绍本次专题研究SQL注入攻击的实验过程和结果分析；第四章进行本次专题研究的总结及实验心得。 关键词：SQL，注入，权限，网络攻击 Abstract Due to the rapid development of information technology today, network security become an integral part of the virtual network. However, because of various Web server and procedure of the loopholes for server rigor leads to increasing the script against time, its most is through the ASP or PHP etc feet as the main attack means owner is graph, together with the rapid expansion of Web pillow mat, based on both today SQL injection also slowly become the mainstream way. Attack Its application in the main means set by service ports receive user input function, will construct sentences to database server, make its executives developers specified tasks. At least more than 70 percent of the Web site exist defects of SQL injection, malicious users can use server, database configuration the defects and elaborate structure of illegal statements programs or scripts invades server by website administrator permissions and obtained the database, serious still relevant content can be obtained in the whole server connection system information, they exist to threaten not only database information, and even threaten systems and users itself. This paper research projects in SQL injection technology, tools and manually injection into the experimental analysis of two kinds of ways. Full text is divided into five sections: the first chapter fo