214, 6/11 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   ka0r1
   SQL Injection

http://www.hackerschool.org/HS_Boards/zboard.php?id=QNA_Web&no=144 [º¹»ç]


SELECT * FROM user_data WHERE last_name = 'Your Name or 1=1'
À§ÀÇ °ªÀ»...

SELECT * FROM user_data WHERE last_name = 'Your Name' or '1=1'
À§ÀÇ °ªÀ¸·Î ¹Ù²Ù´Ï±ñ ·Î±×ÀÎÀÌ µÇ¾ú½À´Ï´Ù.




'Your Name or 1=1'ÀÌ ±× ÀÚü°¡ ÇÑ ºí·°ÀÌ µÈ´Ù? ºÒ¾ÈÁ¤ÇÏ´Ù?
ÀÌ·¸°Ô ¼³¸íÀÌ µÇ¾î ÀÖ´õ¶ó°í¿ä.

±×·¡¼­ Á¦°¡ 'Your Name' or '1=1'·Î ¹Ù²Ù´Ï±ñ µÇ´Âµ¥...

'Your Name or 1=1' <- ÀÏ´ÜÀº ÀÌ°Í ÀÚü°¡ FALSE°ªÀÌ µÇ¾î¼­ ·Î±×ÀÎÀÌ ºÒ°¡´ÉÇÑ °ÍÀÌ°í

'Your Name' or '1=1' <- ÀÌ°ÍÀº FALSE or TRUE°¡ µÇ¾î¼­, ³í¸®¿¬»ê¿¡ ÀÇÇØ TRUE°¡ µÇ¾î¼­
·Î±×ÀÎÀÌ µÇ´Â °Å¶ó°í ¾Ë°í ÀÖ½À´Ï´Ù.

Á¦°¡ ±Ã±ÝÇÑ °Ç 'Your Name or 1=1' <- ÀÌ°Ô ¿Ö FALSE°¡ µÇ´Â °Ç°¡¿ä?

  Hit : 3575     Date : 2013/04/14 02:53



    
rubiya last_name = 'Your Name or 1=1' Äõ¸® ±×´ë·Î last_name ÀÌ ÄÞ¸¶ »çÀÌ¿¡ ÀÖ´Â 'Your Name or 1=1' ÀÎ °ªÀ» ¹ÝȯÇ϶ó´Â ÀǹÌÀÔ´Ï´Ù.

char a = 'Your Name or 1=1'; ÀÌ°Í°ú ºñ½ÁÇÏ´Ù°í º¸½Ã¸é ÁÁÀ» °Í °°½À´Ï´Ù.
2013/04/14  
ka0r1 Á¦°¡ Áú¹®¿¡ ±ÛÀ» ¿Ã¸®¸é¼­ ´äÀ» ½á¹ö·È³×¿ä ¤»¤»¤»¤»
Your Name or 1=1 (FALSE or TRUE) ==> °á±¹¿£ ³í¸®¿¬»êÀÚ¿¡ ÀÇÇØ FALSE°¡ µÈ´Ù.
ÀÌ·¸°Ô ÀÌÇØÇÏ¸é µÇ³ª¿ä? Your Name ÀÚü°¡ FALSEÀΰǰ¡¿ä?
2013/04/14  
rubiya last_name ÀÇ °ªÀÌ Your Name or 1=1 ÀÌ·¸°Ô 16±ÛÀÚÀÎ °ªÀÌ¿ä!

or À̶ó´Â ´Ü¾î°¡ µé¾îÀÖ´Ù°í Çؼ­ last_nameÀÇ ÀÎÀÚ°¡ ³¡³ª´Â°Ô ¾Æ´Ï¿¹¿ä

'°¡ ¿À´Â¼ø°£ÀÌ ÀÎÀÚ°¡ ³¡³ª¿è

±×¸®°í false or true¸é trueÀԴϴ礻¤»¤»
2013/04/14  
asdf3856 ¼º¸íÀ» ¾î·Æ°Ô ÇϽô°Š°°Àºµ¥.,..
°£´ÜÈ÷ ¼³¸íÇص帲.
SELECT * FROM user_data WHERE last_name = 'Your Name or 1=1'
1.¶ó½ºÆ® ³×ÀÓÀ̶ó´Â º¯¼ö°ª¿¡ true¸¦ ³Ö¾î ¿ìȸ ÇÏ´Â°Ô ¸ñÀû.
2. 'yourName or 1=1' ÀÌ·¸°Ô µÈ°ÍÀº Èí»ç .. last_name = 'asdf'¿Í °°½À´Ï´Ù.

Áï,½Ì±Û ÄõÅÍ (')·Î °ªÀ» ¹­¾î ÁÖ¼Å¾ß µÇ¿ä.. 'yourName' '1=1' ÀÌ·¸°Ô ¹­¾î ÁÖ½ÃÁö ¾ÊÀ¸¸é or¹® ÀÚü°¡ Àǹ̰¡ ¾ø¾îÁö´Âµ¥ or´Â ' 1' '2' ºñ±³ÇÒ º¯¼ö µÎ°³¸¦ ¸¸µé¾îÁּžߵ˴ϴÙ...

SELECT * FROM user_data WHERE last_name = 'Your Name' or '1=1'
' ' or 'true' ·Î ¿ìȸ µÇ´Â °ÅÁ®.. ¸»ÀÌ ÀÌ»óÇѵ¥ ³ªµµ.. ¤Ð
2014/10/18  
asdf3856 ' a' or 'b' ÀÌ·¸°Ô ¹­¾î ÁÖ´ÂÀÌÀ¯´Â ºñ±³ÇÒ ´ë»ó ¼³Á¤ÇÏ½Å´Ù°í º¸¸éµÇ¿ä .
'a or b' ÀÌ·¸°Ô µÇÀÖÀ¸¸é ºñ±³ÇÒ ´ë»óÀ» ãÁö ¸øÇÏ°í 'a or b'¸¦ ÇϳªÀÇ stringÀ¸·Î º»´ä´Ï´Ù.

ps:typeÀÌ ½ºÆ®¸µÀΰ¡?..±â¾ïÀÌ °¡¹°
2014/10/18  
114   ip¸¸À¸·Î ÇØÅ·°¡´ÉÇÑ°¡¿ä?[5]     clova777
06/25 7603
113   LibrettoCMS 2.2.2 - Arbitrary File Upload ¾Æ½Ã´ÂºÐ °è½Å°¡¿ä?     Á¦·Î½Ã
06/16 3312
112   À¥ ¾ð¾î Áú¹® µå¸³´Ï´Ù.[5]     pk920207
05/31 3070
111   À¥ÇØÅ·À» ¹è¿ì°í½Í½À´Ï´Ù..[2]     edustars
05/24 3522
110   MySQL Áú¹®[2]     ka0r1
04/15 3441
  SQL Injection[5]     ka0r1
04/14 3574
108   header¿Í body°¡ ±¸ºÐµÇ¾î ÀÖ´Â ÀÌÀ¯?[4]     ka0r1
04/12 4611
107   ·Î±×¾Æ¿ô ±¸Çö[1]     ka0r1
04/10 3584
106   ·Î±×ÀÎ ÆäÀÌÁö ±¸ÇöÁß header ÇÔ¼öÀÇ ÀǹÌ[2]     ka0r1
04/10 4682
105   À¥ ÇØÅ·À» ¹è¿ì°í½Í½À´Ï´Ù.     a12341z
04/05 3139
104   ÀÌ °ø°Ý ¹«½¼ °ø°ÝÀÎÁö ¾Æ½Ã´Â ºÐ[1]     power3122
03/26 3294
103   À¥»çÀÌÆ® ÇØÅ·°ü·Ã ¹®Àǵ帳´Ï´Ù.[1]     chniow
02/27 3179
102   ½©·Î ÀÎÅÍ³Ý Á¢¼Ó     sean95
02/14 3189
101   À¥Å÷º¸´Ù°¡ ½ºÅÿÀ¹öÇ÷οì‰ç´Âµ¥     kimthon
01/19 3571
100   Áú¹®ÀÌ¿ä!![1]     sophiz
01/06 2850
99   ÀÌ ÇÁ·Î±×·¥ ¹ºÁö ¾Æ½Ã´ÂºÐ?(»çÁøêó)[8]     ygh357
12/16 4184
98   °øÀÎIP, »ç¼³IP[2]     ehdgns3136
11/06 3814
97   ¸ðÀÇÇØÅ· ¿¬½À¿¡ ÇÊ¿äÇÑ °Í.     inwoox
10/11 4035
96   °ú¿¬ ´ëÇü °Ë»ö»çÀÌÆ® ¹ö±×... ¾ÆÁ÷ °¡´ÉÇÒ±î¿ä...?[2]     magpass
10/08 3219
95   À¥ÇØÅ· ´É·ÂÀÌ µÇ½Ã´ÂºÐ¸¸ º¸¼¼¿ä~     mabini01
09/20 3569
[1][2][3][4][5] 6 [7][8][9][10]..[11]

Copyright 1999-2024 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org