关于机器学习:ava代码审计之不安全的Java代码

48次阅读

共计 12011 个字符,预计需要花费 31 分钟才能阅读完成。

​ SQLI(SQL Injection),SQL 注入是因为程序未能正确对用户的输出进行查看,将用户的输出以拼接的形式带入 SQL 语句,导致了 SQL 注入的产生。攻击者可通过 SQL 注入间接获取数据库信息,造成信息透露。
SQL 注入之 JDBC 注入

​ JDBC 有两个办法执行 SQL 语句,别离是 PrepareStatement 和 Statement。

破绽代码:

// 采纳原始的 Statement 拼接语句,导致破绽产生

public String jdbcVul(String id) {

StringBuilder result = new StringBuilder();
try {Class.forName("com.mysql.cj.jdbc.Driver");
    Connection conn = DriverManager.getConnection(db_url, db_user, db_pass);

    Statement stmt = conn.createStatement();
    // 拼接语句产生 SQL 注入
    String sql = "select * from users where id ='" + id + "'";
    ResultSet rs = stmt.executeQuery(sql);

    while (rs.next()) {String res_name = rs.getString("user");
        String res_pass = rs.getString("pass");
        String info = String.format("查问后果 %s: %s", res_name, res_pass);
        result.append(info);
    }                  

破绽代码二:

// PrepareStatement 会对 SQL 语句进行预编译,但有时开发者为了便当,间接采取拼接的形式结构 SQL,此时进行预编译也无用。

Connection conn = DriverManager.getConnection(db_url, db_user, db_pass);
String sql = “select * from users where id = ” + id;
PreparedStatement st = conn.prepareStatement(sql);
System.out.println(“[*] 执行 SQL 语句:” + st);
ResultSet rs = st.executeQuery();


SQL 注入之 MyBatis

​ MyBatis 框架底层曾经实现了对 SQL 注入的进攻,但存在使用不当的状况下,依然存在 SQL 注入的危险。

破绽代码:

// 此破绽呈现频率较高并且很重大!
// 为何产生:因为应用 #{} 会将对象转成字符串,造成 order by “user” desc 造成谬误,因而很多研发会采纳 ${} 来解决,从而造成 SQL 注入
// 点击运行可通过报错语句获取数据库 user

@RequestMapping(“/mybatis/vul/order”)
public List<User> orderBy(String field, String sort) {

return userMapper.orderBy(field, sort);

}

// mapper.xml 语句
<select id=”orderBy” resultType=”com.best.hello.entity.User”>

select * from users order by ${field} ${sort}

</select>

破绽代码二:
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
https://weibo.com/a/hot/76273…
// 含糊搜寻时,间接应用 ’%#{q}%’ 会报错,局部研发图不便间接改成 ’%${q}%’ 从而造成注入

正文完
 0