https://souljian.cn/tags/%E8%BE%93%E5%85%A5%E6%A1%86/Recent content in 输入框 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088189/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088189/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>输入框测试只在授权测试环境进行。</p> <h2 id="一输入框攻击思路">一、输入框攻击思路 </h2><img src="https://souljian.cn/img/input-box-attack.svg" alt="输入框攻击思路" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① SQL注入 → ② XSS → ③ 命令注入 → ④ 路径遍历 → ⑤ SSRF </span></span></code></pre></td></tr></table> </div> </div><h2 id="二攻击方法">二、攻击方法 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">SQL注入：&#39; OR 1=1-- · UNION SELECT · 布尔盲注 </span></span><span class="line"><span class="cl">XSS：&lt;script&gt;alert(1)&lt;/script&gt; </span></span><span class="line"><span class="cl">命令注入：; cat /etc/passwd </span></span><span class="line"><span class="cl">路径遍历：../../../etc/passwd </span></span><span class="line"><span class="cl">SSRF：http://169.254.169.254/ </span></span><span class="line"><span class="cl">模板注入：{{7*7}} · ${{...}} </span></span><span class="line"><span class="cl">XXE：&lt;!DOCTYPE xxe [&lt;!ENTITY xxx SYSTEM &#34;file:///&#34;&gt;]&gt; </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">参数化查询 · 输出编码 · 输入过滤 </span></span><span class="line"><span class="cl">统一异常处理 · WAF 防护 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>输入框是 Web 应用最大的攻击面。<strong>输入过滤 + 输出编码 + 参数化查询</strong>是防御核心。</p>