有没有人发现这是怎么做到的？ SQL注入 [英] Has anyone found out how this was done? SQL Injection
问题描述
由于有很多其他网站被点击，我必须假设它是一个机器人！
Since so many other websites have been hit I have to assume it is a bot!
它注入了一个脚本：
昨天： http://google-stats50.info/ur.php
今天： http://google-stats49.info/ur.php
It has injected a script with:
Yesterday: http://google-stats50.info/ur.php
Today: http://google-stats49.info/ur.php
它将它注入多个表格。
首先，它是如何识别的表格和列？
First, how did it identify the tables and columns?
其次，我应该在日志中搜索什么来识别源页面？
Second, what should I search for in the logs to identify the source page?
我们的任何服务器上都没有ftp。我们有1个联系表格，但它是电子邮件，甚至没有连接到数据库。
We do not have ftp on any of our servers. We have 1 contact form but it is email and not even connected to the database.
我们使用的是SQL Server和IIS。
We are using SQL Server and IIS.
推荐答案
您可能有一个页面没有验证/清理用户输入。用于向SQL查询提供参数的TextBoxes和QueryStrings在SQL注入攻击中经常被利用（尽管有其他方法......）。除此之外，当您访问数据库时，您可能不会使用参数化查询。
You probably have a page that is not validating/sanitizing user input. TextBoxes and QueryStrings that are used to provide parameters to a SQL Query are a commonly exploited in a SQL Injection attack (there are other ways as well though...). In addition to this you are probably not using parameterized queries when you access the database.
这将导致一个受伤的世界。
This will lead to a world of hurt.
他们很可能通过查询系统表来计算出你的数据库结构：
They most likely figured out your database structure by querying the system tables:
SELECT *
FROM sys.Tables
列名：
SELECT *
FROM sys.columns
你应该看一些链接：
- Input Validation
- Parameterized Queries
- SQL Injection prevention
如果这是我的网站，我会放弃< STRONG> EVERY那件事直到网站得到保护。您的网站和数据库处于严重危险之中。
If this were my website I would drop EVERYTHING until the site had been secured. Your site and database are in grave danger.
这篇关于有没有人发现这是怎么做到的？ SQL注入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
