????1.???????????????????????????????
??????????
????whois??????IP???????C????????????????汾???????汾??????汾????????????????????????????????????????...
????2.mysql????????5.0?????5.0????????????
????5.0???????information_schema????????????б???????????????????
????5.0??????????????????5.0?????????????????
????3.??????????У???????????????????????????????
???????繤???????????й????????????й?????????е???????
???????????????????ж??????????檔
??????????????????????????????????????????罻????
?????繤????罻???????????????????????????????? ??
?????????????????????????
?????????????????Щ???????????????????????????????????
????4.?ж???????CMS????????????壿
??????????????????????????
???????????????????????????????д???????
????5.????????????????CMS??????????????壿
?????????????????????
?????????????????磺???????????????????.txt???????????????????????
????6.?????????????????????
????IIS??Apache??nginx??Lighttpd??Tomcat
????7.mysql???????????????????д????仰???????Щ??????
????root???????????·????
????8.???????Щ?汾???????н?????????????????
????IIS 6.0
????/xx.asp/xx.jpg "xx.asp"?????????
????IIS 7.0/7.5
???????Fast-CGI??????????url???????????????/1.php???????????????php????
????Nginx
?????汾С?????0.8.37?????÷?????IIS 7.0/7.5?????Fast-CGI??????????????á?
???????????? xxx.jpg%00.php
????Apache
???????????????????test.php.x1.x2.x3??Apache??????????ж???
????lighttpd
????xx.jpg/xx.php?????????С???????????????????лл??
????9.???????????ж???????windows????linux????????
????linux??Сд??У?windows??Сд????С?
????10.??????mysql???????????????80???????
????????????????????????
??????????
????3306??????????
????11.3389????????????????
?????????3389 ???
???????????
????????????
????????????(????ж?????)
????12.?????????????????壿
????????????
????hex???????
????13.??????????????濴???????????????????
????????????????汾????????????????????
????14.??????webshell???????????????.htaccess?????????????????
???????????????????????????????????
????????
????<FilesMatch "xxx.jpg"> SetHandler application/x-httpd-php </FilesMatch>
????.jpg???????????.php?????
?????????????????飬???????????????????????????????檔
????15.?????????????????
???????????????????
????16.???????????????????????????仰?????
??????????????????????????????·???????????????????ò?????????????
????17.access ???????asp??????????????????????????????????á?
???????????????????.mdb??
????18.?????????д??????ξ????????????????
???????exp??ж????????綨????
????19.????????????A??B ?????A???????test?????????B??????????????????test?????
??????????
????20.????????????and ??or ??xor?????order by ????????
????and/or/xor??????1=1??1=2???????????ж??????????????????????????????????????
????21:?????????????????????????
????????????з???????????
????????????ip xx.xx.xx.xx
???????:2016:01-23
?????????:test.asp?id=15
??????????:and 1=1
???????????????????????shell??
??????URL???????????仰????????????????仰???????????????? ??????????????????????????? ???????????????????2μ???http://ytxiao.lofter.com/post/40583a_ab36540??
????22.??????????????????????Щ???????
??????????и????
????23.???????????????????壿
??????Щ???????????????????????????????????????????????????????????
????24.???????????????????????????????????????“???????????”????????????????????
?????????????????????????????????????????????
?????????Щ???????????????????
???????к???????н??????????п????????
????25.?????????txt?????????http://www.test.com/down/down.php?file=/upwdown/1.txt?????????·??
???????????е????????????file=???波??????index.php??????????????????????????????????????????????????????????????????????????????????????