摘要
分析DVWA中存在SQL盲注漏洞的源码,旨在能够通过对现有攻击方式的验证下,提出对应的防御措施,为开发人员提供参考。采用基于时间的盲注方法,并借助python脚本对存在漏洞的页面进行了仿真测试,成功利用该漏洞显示出数据库版本信息。现阶段对于存在数据库操作的代码,应重视其安全性,针对安全和开发的平衡,经过相应的需求分析后,采取对应的防御措施。
This paper analyzes the source code with blind SQL injection vulnerabilities in DVWA, and proposes the corrcsponding defense measures validated in the existing attack modes to provide references for developers. A time-based blind injection method is used to simulate the vulnerability pages by the aid of a python script, and the database version information is displayed succcssfully. At the present stage, for database operation code, developers should pay attention to its security, and for security and development balance, take corresponding defense measures based on corresponding requirement analysis.
作者
李鸿鹄
王喆
翟继强
LI Honghu, WANG Zhe, ZHAI Jiqiang(College of Computer Science and Technology, Harbin University of Science and Technology, Harbin Heilongjiang 150000, Chin)
出处
《计算机与网络》
2018年第5期68-71,共4页
Computer & Network
