SQL injection là một phương pháp cho phép hacker lợi dụng lỗ hổng của việc kiểm tra dữ liệu đầu vào của Website và các thông báo lỗi của hệ quản trị cơ sở dữ liệu trả về để inject (tiêm vào) và thi hành các câu lệnh SQL bất hợp pháp. SQL injection giúp cho các Hacker thực hiện các lệnh như select, insert, update, delete v.v. ngay trên trình duyệt web, thậm chí là server mà ứng dụng đó đang chạy.

Mặc dù, đã trải qua rất nhiều năm kể từ khi lỗ hổng SQLi đầu tiên được phát hiện.SQLi vẫn là lỗ hổng rất phổ biến trong ứng dụng web. Hầu như các vụ đánh cắp thẻ tín dụng (CC) đều được khai thác từ lỗ hổng này. Trước đây các Shop bán hàng Online hầu như bị khai thác SQL injection để đánh cắp thông tin của người mua hàng. Bây giờ thì đỡ hơn nhiều rồi.

11 08 2018 04 35 54 - Thực hành khai thác lỗi SQL injection với Sqli-labs

Nhằm mục đích trau dồi kỹ năng phát hiện lỗ hổng SQLi. Thành viên DDos (của diễn đàn WhiiteHat) giới thiệu tới các bạn sqli-labs project. Project này bao gồm 65 bài lab khác nhau với độ khó tăng dần. Nội dung của sqli-labs bao gồm gần như tất cả các con đường có thể dẫn tới lỗi SQLi như: GET/POST request, User-Agent…

Thực hành khai thác lỗi SQL injection với Sqli-labs

Để cài đặt sqli-lab, các bạn cần:

  • PHP
  • MySQL
  • Apache server

Bạn có thể cài phần mềm Xamp (bản 5.6) hoặc Ampp để giả lập môi trường PHP, MySQL trên Windows. Hoặc thực hành ngay trên máy ảo Linux (Centos, Ubuntu, Kali Linux).

Bước 1: Tải Xamp (dùng bản 5.6)về và tiến hành cài đặt như bình thường.

Xóa tất cả các file trong thư mục: C:\xampp\htdocs

Bước 2: Mở Xampp Contorl Panel lên

Nhấn vào nút Start Apache, MySQL. (Nếu Start không được thì xem cách fix lỗi ở bài này)

11 08 2018 03 42 24 - Thực hành khai thác lỗi SQL injection với Sqli-labs

Bước 3: Bạn tải gói cài đặt Sqli-labs tại link bên dưới

Download SQLi-labs

Bước 4: Giải nén file vừa tải về, và copy vào thư mục C:\xampp\htdocs

Bước 5: Truy cập vào đường dẫn http://localhost trên trình duyệt Web.

Click vào Setup/reset Database for labs để bắt đầu cài đặt dữ liệu cho Sqli-labs

Nếu bạn thấy như hình bên dưới thì đã cài thành công.11 08 2018 04 22 19 - Thực hành khai thác lỗi SQL injection với Sqli-labs

Bước 6: Quay trở lại trang chủ localhost và click vào SQLi-LABS Page-1(Basic Challenges) để bắt đầu học từ bài 1.

Thực hành khai thác lỗi SQL injection với Sqli-labs
5 (100%) 4 votes

257 BÌNH LUẬN

  1. You are so interesting! I do not believe I’ve truly read a single thing like that before.
    So nice to discover someone with some original thoughts on this
    subject matter. Really.. many thanks for starting
    this up. This website is something that’s needed on the web, someone
    with a little originality!

  2. I’m impressed, I must say. Actually hardly ever do I encounter a weblog that’s both educative and entertaining, and let me inform you, you may have hit the nail on the head. Your concept is excellent; the problem is something that not enough persons are talking intelligently about. I am very completely satisfied that I stumbled across this in my search for one thing regarding this.

  3. Undeniably believe that which you said. Your favorite reason appeared to
    be on the internet the easiest thing to be aware of. I say to you,
    I definitely get annoyed while people think
    about worries that they plainly do not know about. You managed to hit the nail upon the
    top as well as defined out the whole thing without having side effect ,
    people can take a signal. Will probably be back to
    get more. Thanks

  4. Hiya! Quick question that’s entirely off topic. Do you know how
    to make your site mobile friendly? My website looks weird when browsing from my iphone.

    I’m trying to find a template or plugin that might be able to fix this problem.

    If you have any suggestions, please share. Thanks!

  5. Good day! This is my 1st comment here so I just wanted to give a quick shout out and tell you
    I genuinely enjoy reading through your articles.
    Can you recommend any other blogs/websites/forums that cover the same subjects?
    Appreciate it!

  6. Greetings! This is my first visit to your blog!
    We are a group of volunteers and starting a new project in a community in the same niche.
    Your blog provided us valuable information to work on. You have done a extraordinary job!

  7. I’ve been browsing online more than 2 hours today, yet I never found any interesting
    article like yours. It’s pretty worth enough for me. In my
    view, if all site owners and bloggers made good content
    as you did, the net will be much more useful than ever before.

  8. You’re so cool! I do not believe I’ve read through anything like that before.
    So wonderful to find another person with a few original
    thoughts on this topic. Seriously.. thank you for starting this up.
    This web site is one thing that’s needed on the web, someone with some originality!

  9. I’ve been surfing online more than three hours today, yet I never found any interesting article
    like yours. It’s pretty worth enough for me. Personally, if all web
    owners and bloggers made good content as you did, the internet will be a lot more useful than ever before.

  10. First of all I want to say terrific blog! I had a quick question which I’d like to ask if you don’t mind.
    I was curious to know how you center yourself and
    clear your head before writing. I’ve had difficulty clearing
    my mind in getting my thoughts out there. I do enjoy writing however it just seems like the first 10 to 15 minutes are lost simply just trying to figure out how to begin. Any suggestions or
    tips? Kudos!

  11. Hello there, I found your site by the use of Google whilst looking for a similar topic, your web site got here up,
    it appears to be like good. I’ve bookmarked it in my
    google bookmarks.
    Hello there, simply became alert to your weblog
    thru Google, and located that it is truly informative.
    I am going to be careful for brussels. I’ll be grateful for those who proceed this in future.
    Numerous folks might be benefited out of your writing.

    Cheers!

  12. hello there and thank you for your info – I’ve definitely picked up something new from right here.

    I did however expertise some technical issues using this
    web site, since I experienced to reload the web site a lot of times previous to I could get it to load properly.

    I had been wondering if your web hosting is OK?
    Not that I’m complaining, but slow loading instances times will sometimes affect your placement in google and can damage your quality score if advertising and marketing with Adwords.
    Well I’m adding this RSS to my email and can look out for
    much more of your respective fascinating content.

    Ensure that you update this again soon.

  13. Amazing blog! Do you have any tips for aspiring writers?
    I’m hoping to start my own site soon but I’m a little lost
    on everything. Would you recommend starting
    with a free platform like WordPress or go for a
    paid option? There are so many options out there that I’m
    totally confused .. Any recommendations? Thanks a lot!

  14. Howdy! This article couldn’t be written any better! Going through this post reminds me of my previous roommate! He always kept talking about this. I will forward this post to him. Pretty sure he’s going to have a very good read. Thanks for sharing!

  15. Great goods from you, man. I’ve understand your stuff previous
    to and you are just too excellent. I actually like what you have acquired here, certainly
    like what you are stating and the way in which you say it.
    You make it enjoyable and you still take care of to keep it smart.
    I can’t wait to read much more from you. This is actually a great website.
    natalielise plenty of fish

  16. Excellent post. I used to be checking constantly this weblog and I am impressed!
    Very useful info specifically the final part 🙂 I take care of such information much.
    I was seeking this certain information for a very lengthy time.
    Thank you and best of luck.

  17. Right here is the right web site for anybody who hopes to understand this topic. You understand so much its almost tough to argue with you (not that I actually would want to…HaHa). You certainly put a new spin on a topic which has been discussed for decades. Great stuff, just great!

  18. Hey there I am so happy I found your site, I really found you by accident, while I was looking on Yahoo for something else, Anyways I
    am here now and would just like to say kudos for a remarkable post and a
    all round thrilling blog (I also love the theme/design), I don’t have time to go through it all at the
    moment but I have book-marked it and also added
    in your RSS feeds, so when I have time I will be back to read much more, Please do keep up the fantastic work.

  19. One more thing I would like to mention is that as an alternative to trying to accommodate all your online degree tutorials on days of the week that you end work (because most people are drained when they get back), try to have most of your sessions on the saturdays and sundays and only a few courses for weekdays, even if it means a little time off your weekend break. This is beneficial because on the weekends, you will be far more rested and concentrated on school work. Thanks for the different ideas I have discovered from your weblog.

  20. Greetings from Idaho! I’m bored to death at work so I decided to browse your site on my iphone during lunch break. I love the information you provide here and can’t wait to take a look when I get home. I’m surprised at how quick your blog loaded on my mobile .. I’m not even using WIFI, just 3G .. Anyways, good site!

  21. I have figured out some significant things through your blog post. One other subject I would like to mention is that there are lots of games available and which are designed specifically for toddler age youngsters. They include things like pattern identification, colors, wildlife, and patterns. These usually focus on familiarization in lieu of memorization. This helps to keep little ones occupied without having the experience like they are learning. Thanks

  22. Hi would you mind stating which blog platform you’re working with? I’m looking to start my own blog in the near future but I’m having a hard time making a decision between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design and style seems different then most blogs and I’m looking for something completely unique. P.S Apologies for getting off-topic but I had to ask!

  23. Howdy! Quick question that’s totally off topic. Do you know how to make your site mobile friendly? My blog looks weird when viewing from my iphone 4. I’m trying to find a theme or plugin that might be able to fix this issue. If you have any recommendations, please share. Cheers!

  24. obviously like your web site but you have to take a look at the spelling on several of your posts. Several of them are rife with spelling problems and I to find it very troublesome to tell the reality then again I will certainly come again again.

  25. I have been exploring for a little for any high quality articles or weblog posts on this sort of area . Exploring in Yahoo I finally stumbled upon this site. Studying this information So i’m happy to convey that I have a very just right uncanny feeling I came upon exactly what I needed. I such a lot without a doubt will make sure to don’t forget this site and give it a glance on a constant basis.

  26. Great – I should definitely pronounce, impressed with your site. I had no trouble navigating through all the tabs and related info ended up being truly simple to do to access. I recently found what I hoped for before you know it in the least. Quite unusual. Is likely to appreciate it for those who add forums or anything, website theme . a tones way for your customer to communicate. Excellent task..

  27. I am only writing to let you understand what a fantastic encounter my princess developed studying your web site. She picked up a wide variety of details, most notably what it is like to possess a great helping character to make the mediocre ones just understand a variety of tricky things. You really exceeded people’s expectations. Thanks for presenting those effective, trustworthy, explanatory and cool thoughts on that topic to Gloria.

  28. Thanks for the tips on credit repair on this excellent site. What I would advice people should be to give up the actual mentality they will buy at this moment and fork out later. Being a society most people tend to do that for many factors. This includes vacation trips, furniture, as well as items we would like. However, it is advisable to separate your current wants out of the needs. While you’re working to boost your credit score you really have to make some sacrifices. For example you’ll be able to shop online to save cash or you can turn to second hand retailers instead of highly-priced department stores pertaining to clothing.

  29. I have noticed that car insurance companies know the vehicles which are susceptible to accidents and also other risks. Additionally , they know what type of cars are given to higher risk as well as the higher risk they have got the higher the premium rate. Understanding the straightforward basics with car insurance will help you choose the right type of insurance policy that should take care of your wants in case you get involved in any accident. Many thanks sharing a ideas for your blog.

  30. Hey there! This is kind of off topic but I need some help from an established blog.
    Is it hard to set up your own blog? I’m not very techincal but I can figure things out pretty fast.
    I’m thinking about making my own but I’m not sure
    where to begin. Do you have any points or suggestions? Appreciate it

  31. After looking over a number of the blog articles on your site, I truly appreciate your technique of writing a blog. I saved as a favorite it to my bookmark website list and will be checking back in the near future. Please visit my web site too and tell me how you feel.

  32. Thanks for your publication on the vacation industry. I might also like to add that if your senior thinking of traveling, it is absolutely vital that you buy travel insurance for senior citizens. When traveling, seniors are at greatest risk being in need of a health emergency. Obtaining right insurance coverage package on your age group can look after your health and give you peace of mind.

  33. Yet another thing I would like to convey is that as opposed to trying to suit all your online degree lessons on days of the week that you finish work (as most people are exhausted when they get back), try to arrange most of your classes on the saturdays and sundays and only 1 or 2 courses for weekdays, even if it means taking some time away from your saturday and sunday. This is really good because on the weekends, you will be much more rested along with concentrated in school work. Thx for the different suggestions I have figured out from your weblog.

  34. You actually make it seem really easy together with your presentation but I to find this matter to be actually something that I believe I’d by no means understand. It kind of feels too complex and very large for me. I’m looking forward on your next post, I will attempt to get the grasp of it!

  35. Thanks for your information on this blog. One thing I want to say is that purchasing electronic products items on the Internet is not something new. In truth, in the past ten years alone, the market for online gadgets has grown a great deal. Today, you can get practically almost any electronic device and other gadgets on the Internet, ranging from cameras plus camcorders to computer elements and video gaming consoles.

  36. I do like the manner in which you have framed this specific situation plus it does indeed provide me personally a lot of fodder for thought. On the other hand, coming from everything that I have personally seen, I just simply hope as the actual commentary pack on that people today remain on point and in no way get started on a soap box regarding some other news of the day. Yet, thank you for this outstanding piece and while I do not go along with this in totality, I value the perspective.

  37. After research a few of the blog posts in your web site now, and I really like your approach of blogging. I bookmarked it to my bookmark website list and will be checking again soon. Pls take a look at my website as nicely and let me know what you think.

  38. This design is spectacular! You most certainly know how to keep a reader amused. Between your wit and your videos, I was almost moved to start my own blog (well, almost…HaHa!) Fantastic job. I really loved what you had to say, and more than that, how you presented it. Too cool!

  39. Hi, I’ve been visiting your website a few times and decided to give you some positive feedback because I find it very useful. Well done. I was wondering if you as someone with experience of creating a useful website could help me out with my new site by giving some feedback about what I could improve? You can find my site by searching for “redaktionstest net casino” in Google. I would appreciate if you could check it out quickly and tell me what you think. -> info@redaktionstest.net – Thank you for help and I wish you a great week!

  40. Hey there, I think your site might be having browser compatibility issues. When I look at your blog in Firefox, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, excellent blog!

  41. Thanks for your write-up. I also think that laptop computers have become more and more popular today, and now are often the only kind of computer included in a household. The reason is that at the same time actually becoming more and more very affordable, their processing power keeps growing to the point where they are as highly effective as personal computers coming from just a few years back.

  42. My developer is trying to convince me to move to .net from PHP. I have always disliked the idea because of the expenses. But he’s tryiong none the less. I’ve been using WordPress on various websites for about a year and am concerned about switching to another platform. I have heard fantastic things about blogengine.net. Is there a way I can import all my wordpress posts into it? Any kind of help would be really appreciated!

  43. Virtually all of whatever you state is supprisingly legitimate and it makes me ponder the reason why I hadn’t looked at this with this light before. This article really did turn the light on for me as far as this particular subject goes. Nonetheless there is actually one factor I am not too cozy with so while I try to reconcile that with the actual core idea of your position, permit me observe just what the rest of the readers have to say.Nicely done.

  44. Excellent beat ! I would like to apprentice at the same time as you amend your website, how can i subscribe for a weblog website? The account aided me a acceptable deal. I had been a little bit acquainted of this your broadcast offered vibrant transparent idea

  45. Attractive section of content. I just stumbled upon your weblog and in accession capital to assert that I acquire actually enjoyed account your blog posts. Any way I’ll be subscribing to your feeds and even I achievement you access consistently rapidly.

  46. I cherished up to you will obtain carried out proper here. The sketch is attractive, your authored material stylish. however, you command get got an shakiness over that you want be handing over the following. sick for sure come more until now once more as exactly the same just about a lot incessantly inside case you defend this hike.

  47. I’ve been browsing online more than three hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. Personally, if all web owners and bloggers made good content as you did, the net will be a lot more useful than ever before.

  48. Hi there I am so excited I found your weblog, I really found you by error, while I was
    researching on Digg for something else, Regardless I am here now and would just like to say thanks for a tremendous post and a all round
    entertaining blog (I also love the theme/design), I don’t have time
    to read it all at the minute but I have bookmarked it and also added in your RSS feeds, so when I have time I will
    be back to read a lot more, Please do keep
    up the superb b.

BÌNH LUẬN

Please enter your comment!
Please enter your name here