权限动网先锋论坛-『 web开发讨论区 』-针对sql injection的sql server安全设置初级篇(Mobile pioneer Forum - Web Development Forum - for SQL Injection´s SQL Server Security Settings)

动网论坛  时间:2021-01-25  阅读:()

动网先锋论坛- 『 web开发讨论区』 -针对sql injection的sqlserver安全设置初级篇Mobile pioneer Forum-Web DevelopmentForum - for SQL Injection' s SQL Server Security SettingsMobile pioneer Forum - "WEB Development Forum" - for SQLINJECTION' s SQL SERVER security settings

Collect this page

Contact us

Forum Help

Qmtxf re login, stealth user control panel, SMS search style,forum status, forum exhibition, props center exit

Website development, database development exchange, variousWEB development technology exchange, base camp, my inbox (0)Mobile network pioneer Forum - computer technology - "WEBDevelopment Forum" - for SQL INJECTION SQL SERVER securitysettings junior article

You are the 1369th person reading this post AP

* posting theme: initial article on security settings for SQLINJECTION' s SQL SERVER

Jadesun

Title: people don't want to say

Class: VIP

Article: 1338

Points: 2527

Registration: 2000-7-31

The landlord

For SQL INJECTION SQL SERVER security settings junior articleThe day before the SQL INJECTION attack testing intensified,many large websites and forums have been injected. These sitesgenerally use more than SQL

SERVER database, and because of this, many people begin to doubtthe security of SQL SERVER. Actually, SQL SERVER

2000 has passed the U.S. government' s C2 level securitycertification - this is the industry can have the highestcertification level, so the use of SQL

SERVER is pretty safe. Of course, there is still a gap betweenORCAL and DB2, but SQL

The ease of use and universality of SERVER can still be a reasonfor us to continue using it. How can you make the SQL SERVERsettings reassuring?

The first step must be to hit SQL

SERVER' s latest security patch, and now the patch is out of SP3.Download address:http://www.microsoft.com/sql/downloads/2000/sp3.asp. If thisstep is not done well, then we do not have the necessary tocont inue.

The second step is to modify the default 1433 port andhide theSQL SERVER. This prevents attempts to enumerate existing SQLServer on the network

The broadcast sent by the client responds. In addition, youneedto screen the 1433 port from the TCP/IP filter and hide yourSQL as much as possible

SERVER database. This way, but let the attack create SQLSERVER accounts can not immediately use the query analyzerremote login for the next attack. From the ASP, PHP and otherpages to construct malicious statements, there is also need tocheck the return value of the problem, than the direct queryanalyzer to benefit from the fall. So the first thing we needto do even let others into, nor allow an attacker to do nextsmoothly. Modification method: Enterprise Manager

Taking your database group-- >attributes-->-->-->TCP/IP- > conventional network configuration attributes

Here, modify your default port and hide the SQL SERVER.

The third step is an important step, and SQL INJECTION tendsto be in WEB

Generated in CODE. As a system administrator or databaseadministrator, you can't always look at each piece of code. Evenif we often look at the code, we can not guarantee our negligenceon the above. What can we do?We' ll start with the database roleto get the database users' rights to the lowest point. SQLSERVER' s default permissions are really a headache, very highpermissions, no permissions, and nothing to do, SYSADMIN anddb_owner is really a love and hate. An attacker, however,confirmed that the site had SQL

INJECTION vulnerability, there must be a step in the processof testing the site' s SQL SERVER users have much authority.Usually with the help of SELECT

IS_SRVROLEMEMBER (' sysadmin' ) , or SELECT IS_MEMBER

('db_owner' ) , or user

= 0 (compare characters with numbers, SQL

The SERVER will prompt the error message, which can be used totest some sensitive information, and so on. And, I dare not saymore. One is afraid of being wrong, and the other is afraid ofthe people in the alliance. At present, if the database userof the web site uses SA privileges, plus the absolute path ofthe WEB, the OVER of your website is declared. Db_ownerpermissions are the same. If the absolute path is confirmed,there is a 50% chance to give WEB in your machine

A Trojan horse, such as Haiyang. So here we've got a point. Wehave to create our own privileges so that the attacker can'tfind a place to go. Quote a SQL here

Examples of SERVER online help:

Method for creating SQL Server database roles (EnterpriseManager)

Create SQL Server database roles

1. expand the server group, and then expand the server.

2. expand the database folder, and then expand the databasewhere you want to create the roles.

3. right click on roles, and then click new database roles.

4. enter the name of the new role in the name box.

5. click Add to add members to the standard roles list, and thenclick one or more users you want to add. (optional)

Only users in the selected database can be added to the role.Object permission

A class of permissions that is called object permissions whenprocessing data or executing procedures:

? SELECT, INSERT, UPDATE, and DELETE statement permiss ions,which can be applied to the entire table or view.

SELECT and UPDATE statement permissions, which can beselectively applied to a single column in a table or view.SELECT permissions, which can be applied to user-definedfunctions.

INSERT and DELETE statement permissions that affect entire rows,sotheycanonlybeappliedtotables orviews, not to individualcolumns.

EXECUTE statement permissions, which can affect storedprocedures and functions.

Statement permission

The activities involved in creating items in a database ordatabase, such as tables or stored procedures, require anotherclass of permissions called statement rights. For example, ifa user must be able to create a table in the database, the usershould be granted it

CREATE TABLE statement permissions. Statement permissions(such as CREATE, DATABASE) apply to the statement itself,rather than to specific objects defined in the database.Statement authority:

? BACKUP DATABASE

? BACKUP LOG

? CREATE DATABASE

? CREATE DEFAULT

? CREATE FUNCTION

? CREATE PROCEDURE

·创建规则

·创建表

·创建视图

暗示性权限

暗示性权限控制那些只能由预定义系统角色的成员或数据库对象所有者执行的活动。例如 固定服务器角色成员自动继承在SQLsysadmin

服务器安装中进行操作或查看的全部权限。

数据库对象所有者还有暗示性权限可以对所拥有的对象执行一切活动。例如拥有表的用户可以查看、添加或删除数据更改表定义或控制允许其他用户对表进行操作的权限。d b_o wn e r在数据库中有全部权限。

db_accessadmin可以添加或删除用户ID。db_securityadmin可以管理全部权限、对象所有权、角色和角色成员资格。db_ddladmin可以发出所有DDL但不能发出格兰特、撤销或否认语句。db_backupoperator可以发出DBCC、检查站和备份语句。db_datareader可以选择数据库内任何用户表中的所有数据。db_datawri ter可以更改数据库内任何用户表中的所有数据。db_denydatareader不能选择数据库内任何用户表中的任何数据。db_denydatawriter不能更改数据库内任何用户表中的任何数据。在这儿把新建的数据库角色的权限配置好比如需要使用哪个表、视图、存储过程等。然后把db_owner和db_securityadmin、db_backupoperator取消不给攻击者备份

和创建数据库

表的机会一但攻击者具有这两个权限那么你的网站就还处在十分危险的状态。还有注意一下在创建数据库账号时千万不能对服务器角色进行选择。

第四步是修改内置存储过程SQL SQL Server。

服务器估计是为了安装或者其它方面它内置了一批危险的存储过程。能读到注册表信息能写入注册表信息能读磁盘共享信息等等. . . . . .各位看到这儿心里可能会在想我的网站中有其它的代码又不像查询分析器那样能查接将结果输出。给你这个权限又不能怎么样还是看不到信息。如果各位这样想就大错特错了提示一下如果攻击者有创建。

表的权限那么创建一个临时表然后将信息插入到表中然选择出来接着跟数字进行比较让SQL

服务器报错那么结果就全出来了. . . . . .所以我们要报着宁错杀不放过的态度进行修补。

先来列出危险的内置存储过程xp_cmdshellxp_regaddmultistringxp_regdeletekeyxp_regdeletevaluexp_regenumkeysxp_regenumvaluesxp_regreadxp_regremovemult istring

HostSailor:罗马尼亚机房,内容宽松;罗马尼亚VPS七折优惠,罗马尼亚服务器95折

hostsailor怎么样?hostsailor成立多年,是一家罗马尼亚主机商家,机房就设在罗马尼亚,具说商家对内容管理的还是比较宽松的,商家提供虚拟主机、VPS及独立服务器,今天收到商家推送的八月优惠,针对所有的产品都有相应的优惠,商家的VPS产品分为KVM和OpenVZ两种架构,OVZ的比较便宜,有这方面需要的朋友可以看看。点击进入:hostsailor商家官方网站HostSailor优惠活动...

王小玉网-美国洛杉矶2核4G 20元/月,香港日本CN2 2核2G/119元/季,美国300G高防/80元/月!

 活动方案:美国洛杉矶 E5 2696V2 2核4G20M带宽100G流量20元/月美国洛杉矶E5 2696V2 2核4G100M带宽1000G流量99元/季香港CN2 E5 2660V2 2核2G30M CN2500G流量119元/季日本CN2E5 2660 2核2G30M CN2 500G流量119元/季美国300G高防 真实防御E5 2696V2 2核2G30M...

趣米云月付460元,香港CN2云服务器VPS月付低至18元

趣米云早期为做技术起家,为3家IDC提供技术服务2年多,目前商家在售的服务有香港vps、香港独立服务器、香港站群服务器等,线路方面都是目前最优质的CN2,直连大陆,延时非常低,适合做站,目前商家正在做七月优惠活动,VPS低至18元,价格算是比较便宜的了。趣米云vps优惠套餐:KVM虚拟架构,香港沙田机房,线路采用三网(电信,联通,移动)回程电信cn2、cn2 gia优质网络,延迟低,速度快。自行封...

动网论坛为你推荐
马云卸任软银董事马云昨天卸任阿里巴巴董事长,不是之前听说已经卸任了吗?怎么又卸任?之前听说卸任交给了张勇p图软件哪个好用美图P图软件哪个好,你们用哪个迈腾和帕萨特哪个好一汽迈腾和上海大众帕萨特哪个好诛仙青云志360云盘资源求诛仙青云志全集资源360云盘怎么用360云盘怎么用广东联通网络传真如何使用广东联通如意传真?广东联通彩铃广东联通炫铃 怎么定制彩铃什么快递最便宜最便宜的是什么快递什么快递最便宜寄大物件什么快递便宜便宜的儿童手机想买儿童手机,什么牌子的好?价格贵吗?
台湾vps 域名转让网 hostigation rackspace 2014年感恩节 网站监控 光棍节日志 qq数据库下载 gspeed 沈阳主机托管 免费蓝钻 国外网页代理 电信宽带测速软件 域名和主机 netvigator 免费主页空间 好看的空间 phpwind论坛 美国西雅图独立 极域网 更多