https://souljian.cn/tags/%E6%B3%A8%E5%85%A5/Recent content in 注入 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088190/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088190/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>SQL 注入测试只在授权测试环境进行。</p> <h2 id="一sql-注入攻击链">一、SQL 注入攻击链 </h2><img src="https://souljian.cn/img/sql-injection-chain.svg" alt="SQL 注入攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现注入点 → ② 判断注入类型 → ③ 获取数据库信息 → ④ 读取数据 → ⑤ 写文件/执行命令 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二注入类型">二、注入类型 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">数字注入：id=1 UNION SELECT... </span></span><span class="line"><span class="cl">字符注入：name=&#39; UNION SELECT... </span></span><span class="line"><span class="cl">布尔盲注：id=1 AND 1=1 / AND 1=2 </span></span><span class="line"><span class="cl">时间盲注：id=1 AND SLEEP(5) </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">参数化查询（预处理语句） </span></span><span class="line"><span class="cl">ORM 框架（Hibernate/MyBatis） </span></span><span class="line"><span class="cl">WAF 规则拦截 </span></span><span class="line"><span class="cl">最小权限原则 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>SQL 注入的核心是<strong>用户输入被拼接到 SQL 语句中</strong>。<strong>参数化查询</strong>是唯一有效的防御。</p>