{"id":110344,"date":"2026-09-26T16:35:27","date_gmt":"2026-09-26T08:35:27","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/110344.html"},"modified":"2026-09-26T16:35:27","modified_gmt":"2026-09-26T08:35:27","slug":"%e4%bb%8e%e5%90%af%e6%98%8e%e6%98%9f%e8%be%b0%e9%9d%a2%e7%bb%8f%e5%8f%8d%e6%80%9d%e5%88%b0-sql-%e6%b3%a8%e5%85%a5%e9%bb%91%e5%90%8d%e5%8d%95%e7%bb%95%e8%bf%87%e5%ae%9e%e6%88%98%ef%bc%9asqli-labs","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/110344.html","title":{"rendered":"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8"},"content":{"rendered":"<p id=\"main-toc\">\u76ee\u5f55<\/p>\n<p id=\"-toc\" style=\"margin-left:0px\">\n<p id=\"%E4%B8%80%E3%80%81%E8%83%8C%E6%99%AF%E4%B8%8E%E5%A4%8D%E7%9B%98%E8%8C%83%E5%9B%B4%EF%BC%9A%E4%B8%80%E4%BB%BD%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95%E9%9D%A2%E8%AF%95%E8%AE%B0%E5%BD%95%E5%BC%95%E5%8F%91%E7%9A%84%E6%8A%80%E6%9C%AF%E4%BB%A3%E5%B7%AE%E5%8F%8D%E6%80%9D-toc\" style=\"margin-left:40px\">\u4e00\u3001\u80cc\u666f\u4e0e\u590d\u76d8\u8303\u56f4&#xff1a;\u4e00\u4efd\u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u8bb0\u5f55\u5f15\u53d1\u7684\u6280\u672f\u4ee3\u5dee\u53cd\u601d<\/p>\n<p id=\"1.1%20%E5%AD%A6%E4%B9%A0%E8%B7%AF%E5%BE%84%E4%B8%8E%E8%A1%8C%E4%B8%9A%E6%8A%80%E6%9C%AF%E7%A4%BE%E5%8C%BA%E7%9A%84%E6%B2%89%E6%B7%80%E5%B7%AE%E5%BC%82-toc\" style=\"margin-left:80px\">1.1 \u5b66\u4e60\u8def\u5f84\u4e0e\u884c\u4e1a\u6280\u672f\u793e\u533a\u7684\u6c89\u6dc0\u5dee\u5f02<\/p>\n<p id=\"1.2%20%E6%A0%B8%E5%BF%83%E6%BC%8F%E6%B4%9E%E6%9C%BA%E7%90%86%E8%A1%A8%E8%BF%B0%E7%9A%84%E6%8A%80%E6%9C%AF%E7%A1%AC%E4%BC%A4%EF%BC%9A%E4%BB%A5%20XXE%20%E4%B8%BA%E4%BE%8B-toc\" style=\"margin-left:80px\">1.2 \u6838\u5fc3\u6f0f\u6d1e\u673a\u7406\u8868\u8ff0\u7684\u6280\u672f\u786c\u4f24&#xff1a;\u4ee5 XXE \u4e3a\u4f8b<\/p>\n<p id=\"1.3%20%E7%8E%B0%E4%BB%A3%20WAF%20%E5%AF%B9%E6%8A%97%E8%AE%A4%E7%9F%A5%E4%B8%8E%E4%BC%A0%E7%BB%9F%E9%BB%91%E5%90%8D%E5%8D%95%E7%BB%95%E8%BF%87%E7%9A%84%E4%BB%A3%E5%B7%AE%E5%AE%A1%E8%A7%86-toc\" style=\"margin-left:80px\">1.3 \u73b0\u4ee3 WAF \u5bf9\u6297\u8ba4\u77e5\u4e0e\u4f20\u7edf\u9ed1\u540d\u5355\u7ed5\u8fc7\u7684\u4ee3\u5dee\u5ba1\u89c6<\/p>\n<p id=\"1.4%20%E5%B7%A5%E5%85%B7%E8%BF%90%E7%94%A8%E7%A6%81%E5%BF%8C%E4%B8%8E%E5%86%85%E7%BD%91%E5%AE%9E%E6%88%98%E8%BE%B9%E7%95%8C-toc\" style=\"margin-left:80px\">1.4 \u5de5\u5177\u8fd0\u7528\u7981\u5fcc\u4e0e\u5185\u7f51\u5b9e\u6218\u8fb9\u754c<\/p>\n<p id=\"1.5%20%E6%89%80%E8%B0%93%E2%80%9CSSL%20%E7%BB%95%E8%BF%87%E2%80%9D%E7%9A%84%E6%A6%82%E5%BF%B5%E8%AF%AF%E5%8C%BA%E4%B8%8E%E7%9C%9F%E5%AE%9E%E8%80%83%E7%82%B9%E6%BE%84%E6%B8%85-toc\" style=\"margin-left:80px\">1.5 \u6240\u8c13\u201cSSL \u7ed5\u8fc7\u201d\u7684\u6982\u5ff5\u8bef\u533a\u4e0e\u771f\u5b9e\u8003\u70b9\u6f84\u6e05<\/p>\n<p id=\"%E4%BA%8C%E3%80%81%E6%A1%88%E4%BE%8B%E4%B8%80%EF%BC%9A%E5%85%B3%E9%94%AE%E5%AD%97%E8%BF%87%E6%BB%A4%E4%B8%8E%E5%8F%8C%E5%86%99%E9%87%8D%E6%9E%84%E6%9C%BA%E5%88%B6%EF%BC%88sqli-labs%20Less-25%20%E6%B7%B1%E5%BA%A6%E5%A4%8D%E7%9B%98%EF%BC%89-toc\" style=\"margin-left:40px\">\u4e8c\u3001\u6848\u4f8b\u4e00&#xff1a;\u5173\u952e\u5b57\u8fc7\u6ee4\u4e0e\u53cc\u5199\u91cd\u6784\u673a\u5236&#xff08;sqli-labs Less-25 \u6df1\u5ea6\u590d\u76d8&#xff09;<\/p>\n<p id=\"2.1%20%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E4%B8%8E%E8%BF%87%E6%BB%A4%E5%9F%BA%E5%87%86-toc\" style=\"margin-left:80px\">2.1 \u5b9e\u9a8c\u73af\u5883\u4ee3\u7801\u5ba1\u8ba1\u4e0e\u8fc7\u6ee4\u57fa\u51c6<\/p>\n<p id=\"2.2%20%E5%9F%BA%E7%A1%80%E6%B3%A8%E5%85%A5%E7%82%B9%E9%AA%8C%E8%AF%81%E4%B8%8E%E8%81%94%E5%90%88%E6%9F%A5%E8%AF%A2%E5%9B%9E%E6%98%BE%E6%8E%A2%E6%B5%8B-toc\" style=\"margin-left:80px\">2.2 \u57fa\u7840\u6ce8\u5165\u70b9\u9a8c\u8bc1\u4e0e\u8054\u5408\u67e5\u8be2\u56de\u663e\u63a2\u6d4b<\/p>\n<p id=\"2.3%20%E6%95%8F%E6%84%9F%E5%AD%97%E6%AE%B5%E5%90%8D%E9%9A%90%E5%BC%8F%E8%BF%87%E6%BB%A4%E9%81%AD%E9%81%87%E4%B8%8E%E6%8E%92%E9%94%99%E8%BD%AC%E6%8A%98-toc\" style=\"margin-left:80px\">2.3 \u654f\u611f\u5b57\u6bb5\u540d\u9690\u5f0f\u8fc7\u6ee4\u906d\u9047\u4e0e\u6392\u9519\u8f6c\u6298<\/p>\n<p id=\"2.4%20%E7%B3%BB%E7%BB%9F%E5%85%83%E6%95%B0%E6%8D%AE%E8%8E%B7%E5%8F%96%E4%B8%AD%E7%9A%84%E7%BA%A7%E8%81%94%E8%BF%87%E6%BB%A4%E4%B8%8E%E9%80%90%E7%BA%A7%E6%8E%92%E6%9F%A5-toc\" style=\"margin-left:80px\">2.4 \u7cfb\u7edf\u5143\u6570\u636e\u83b7\u53d6\u4e2d\u7684\u7ea7\u8054\u8fc7\u6ee4\u4e0e\u9010\u7ea7\u6392\u67e5<\/p>\n<p id=\"%E4%B8%89%E3%80%81%E6%A1%88%E4%BE%8B%E4%BA%8C%EF%BC%9A%E7%A9%BA%E7%99%BD%E4%B8%8E%E6%B3%A8%E9%87%8A%E5%85%A8%E9%9D%A2%E5%B0%81%E9%94%81%E4%B8%8B%E7%9A%84%E6%9E%81%E9%99%90%E6%9E%84%E9%80%A0%EF%BC%88sqli-labs%20Less-26%20%E6%B7%B1%E5%BA%A6%E5%A4%8D%E7%9B%98%EF%BC%89-toc\" style=\"margin-left:40px\">\u4e09\u3001\u6848\u4f8b\u4e8c&#xff1a;\u7a7a\u767d\u4e0e\u6ce8\u91ca\u5168\u9762\u5c01\u9501\u4e0b\u7684\u6781\u9650\u6784\u9020&#xff08;sqli-labs Less-26 \u6df1\u5ea6\u590d\u76d8&#xff09;<\/p>\n<p id=\"3.1%20%E6%9E%81%E7%AB%AF%E8%BF%87%E6%BB%A4%E8%A7%84%E5%88%99%E5%AE%A1%E6%9F%A5-toc\" style=\"margin-left:80px\">3.1 \u6781\u7aef\u8fc7\u6ee4\u89c4\u5219\u5ba1\u67e5<\/p>\n<p id=\"3.2%20%E7%A9%BA%E7%99%BD%E5%AD%97%E7%AC%A6%E4%B8%8E%E6%B3%A8%E9%87%8A%E6%9B%BF%E4%BB%A3%E6%96%B9%E6%A1%88%E7%9A%84%E8%BF%9E%E7%8E%AF%E6%8C%AB%E8%B4%A5-toc\" style=\"margin-left:80px\">3.2 \u7a7a\u767d\u5b57\u7b26\u4e0e\u6ce8\u91ca\u66ff\u4ee3\u65b9\u6848\u7684\u8fde\u73af\u632b\u8d25<\/p>\n<p id=\"3.3%20%E6%B3%A8%E9%87%8A%E7%BB%95%E8%BF%87%E6%80%9D%E8%B7%AF%E8%BD%AC%E5%8F%98%EF%BC%9A%E6%94%BE%E5%BC%83%E6%B3%A8%E9%87%8A%E7%AC%A6%EF%BC%8C%E8%BD%AC%E5%90%91%E6%9E%84%E9%80%A0%E9%80%BB%E8%BE%91%E9%97%AD%E5%90%88-toc\" style=\"margin-left:80px\">3.3 \u6ce8\u91ca\u7ed5\u8fc7\u601d\u8def\u8f6c\u53d8&#xff1a;\u653e\u5f03\u6ce8\u91ca\u7b26&#xff0c;\u8f6c\u5411\u6784\u9020\u903b\u8f91\u95ed\u5408<\/p>\n<p id=\"3.4%20%E5%BC%95%E5%85%A5%E8%BE%85%E5%8A%A9%E7%A0%94%E5%88%A4%E5%B7%A5%E5%85%B7%E4%B8%8E%E8%AE%A4%E7%9F%A5%E6%A0%A1%E5%87%86-toc\" style=\"margin-left:80px\">3.4 \u5f15\u5165\u8f85\u52a9\u7814\u5224\u5de5\u5177\u4e0e\u8ba4\u77e5\u6821\u51c6<\/p>\n<p id=\"3.5%20%E5%88%87%E6%8D%A2%E5%BA%95%E5%B1%82%E7%8E%AF%E5%A2%83%EF%BC%9A%E6%9C%AC%E5%9C%B0%20MySQL%20%E5%91%BD%E4%BB%A4%E8%A1%8C%E7%B2%BE%E5%87%86%E6%8E%92%E9%94%99%E4%B8%8E%E6%8A%80%E6%9C%AF%E8%BD%AC%E6%8A%98-toc\" style=\"margin-left:80px\">3.5 \u5207\u6362\u5e95\u5c42\u73af\u5883&#xff1a;\u672c\u5730 MySQL \u547d\u4ee4\u884c\u7cbe\u51c6\u6392\u9519\u4e0e\u6280\u672f\u8f6c\u6298<\/p>\n<p id=\"3.6%20%E7%9C%9F%E5%AE%9E%E6%9C%89%E6%95%88%E8%BD%BD%E8%8D%B7%E7%9A%84%E6%9C%80%E7%BB%88%E9%AA%8C%E8%AF%81-toc\" style=\"margin-left:80px\">3.6 \u771f\u5b9e\u6709\u6548\u8f7d\u8377\u7684\u6700\u7ec8\u9a8c\u8bc1<\/p>\n<p id=\"3.7%20%E5%BB%B6%E4%BC%B8%E5%AF%B9%E6%AF%94%EF%BC%9Asqli-labs%20Less-26a%20%E7%9A%84%E8%BF%87%E6%BB%A4%E7%89%B9%E5%BE%81%E4%B8%8E%E8%A7%A3%E9%A2%98%E5%8F%96%E8%88%8D-toc\" style=\"margin-left:80px\">3.7 \u5ef6\u4f38\u5bf9\u6bd4&#xff1a;sqli-labs Less-26a \u7684\u8fc7\u6ee4\u7279\u5f81\u4e0e\u89e3\u9898\u53d6\u820d<\/p>\n<p id=\"%E5%9B%9B%E3%80%81%E7%B3%BB%E7%BB%9F%E6%80%A7%20MySQL%20%E8%BF%87%E6%BB%A4%E7%BB%95%E8%BF%87%E7%9F%A5%E8%AF%86%E5%9B%BE%E8%B0%B1%E4%B8%8E%E6%8A%80%E6%9C%AF%E6%BC%94%E8%BF%9B%EF%BC%88Typora%20%E7%AC%94%E8%AE%B0%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%90%EF%BC%89-toc\" style=\"margin-left:40px\">\u56db\u3001\u7cfb\u7edf\u6027 MySQL \u8fc7\u6ee4\u7ed5\u8fc7\u77e5\u8bc6\u56fe\u8c31\u4e0e\u6280\u672f\u6f14\u8fdb&#xff08;Typora \u7b14\u8bb0\u6df1\u5ea6\u89e3\u6790&#xff09;<\/p>\n<p id=\"4.1%20%E7%A9%BA%E6%A0%BC%E8%BF%87%E6%BB%A4%E7%9A%84%E5%9B%9B%E7%BB%B4%E7%AA%81%E7%A0%B4%E8%B7%AF%E5%BE%84-toc\" style=\"margin-left:80px\">4.1 \u7a7a\u683c\u8fc7\u6ee4\u7684\u56db\u7ef4\u7a81\u7834\u8def\u5f84<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%B8%80%EF%BC%9A%E5%86%85%E8%81%94%E6%B3%A8%E9%87%8A%E4%B8%8E%E7%89%B9%E6%80%A7%E6%B3%A8%E9%87%8A-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e00&#xff1a;\u5185\u8054\u6ce8\u91ca\u4e0e\u7279\u6027\u6ce8\u91ca<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%BA%8C%EF%BC%9A%E7%A9%BA%E7%99%BD%E5%AD%97%E7%AC%A6%E7%BC%96%E7%A0%81%E7%BD%AE%E6%8D%A2-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e8c&#xff1a;\u7a7a\u767d\u5b57\u7b26\u7f16\u7801\u7f6e\u6362<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%B8%89%EF%BC%9A%E5%8F%8D%E5%BC%95%E5%8F%B7%E5%8C%85%E8%A3%B9%E8%A1%A8%E5%90%8D%E4%B8%8E%E5%AD%97%E6%AE%B5-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e09&#xff1a;\u53cd\u5f15\u53f7\u5305\u88f9\u8868\u540d\u4e0e\u5b57\u6bb5<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E5%9B%9B%EF%BC%9A%E6%B5%AE%E7%82%B9%E6%95%B0%E4%B8%8E%E7%A7%91%E5%AD%A6%E8%AE%A1%E6%95%B0%E6%B3%95%E7%AA%81%E7%A0%B4%E5%8D%95%E8%AF%8D%E8%BE%B9%E7%95%8C%E6%AD%A3%E5%88%99%EF%BC%88%08%EF%BC%89-toc\" style=\"margin-left:120px\">\u65b9\u6848\u56db&#xff1a;\u6d6e\u70b9\u6570\u4e0e\u79d1\u5b66\u8ba1\u6570\u6cd5\u7a81\u7834\u5355\u8bcd\u8fb9\u754c\u6b63\u5219&#xff08;&#xff09;<\/p>\n<p id=\"4.2%20%E5%BC%95%E5%8F%B7%E8%BF%87%E6%BB%A4%E4%B8%8E%E5%8D%81%E5%85%AD%E8%BF%9B%E5%88%B6%E7%BB%95%E8%BF%87-toc\" style=\"margin-left:80px\">4.2 \u5f15\u53f7\u8fc7\u6ee4\u4e0e\u5341\u516d\u8fdb\u5236\u7ed5\u8fc7<\/p>\n<p id=\"4.3%20%E9%80%97%E5%8F%B7%E8%BF%87%E6%BB%A4%E7%9A%84%E4%B8%89%E5%A4%A7%E5%AE%9E%E6%88%98%E8%A7%A3%E6%B3%95-toc\" style=\"margin-left:80px\">4.3 \u9017\u53f7\u8fc7\u6ee4\u7684\u4e09\u5927\u5b9e\u6218\u89e3\u6cd5<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%B8%80%EF%BC%9A%E8%81%94%E5%90%88%E6%9F%A5%E8%AF%A2%E4%B8%AD%E7%9A%84%E9%80%97%E5%8F%B7%E7%BB%95%E8%BF%87%E2%80%94%E2%80%94JOIN%20%E8%99%9A%E6%8B%9F%E8%81%94%E8%A1%A8%E6%B3%95-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e00&#xff1a;\u8054\u5408\u67e5\u8be2\u4e2d\u7684\u9017\u53f7\u7ed5\u8fc7\u2014\u2014JOIN \u865a\u62df\u8054\u8868\u6cd5<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%BA%8C%EF%BC%9A%E7%9B%B2%E6%B3%A8%E6%88%AA%E5%8F%96%E5%87%BD%E6%95%B0%E4%B8%AD%E7%9A%84%E9%80%97%E5%8F%B7%E7%BB%95%E8%BF%87%E2%80%94%E2%80%94FROM%20...%20FOR%20...%20%E8%AF%AD%E6%B3%95%E8%A7%84%E8%8C%83-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e8c&#xff1a;\u76f2\u6ce8\u622a\u53d6\u51fd\u6570\u4e2d\u7684\u9017\u53f7\u7ed5\u8fc7\u2014\u2014FROM &#8230; FOR &#8230; \u8bed\u6cd5\u89c4\u8303<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%B8%89%EF%BC%9A%E6%88%AA%E5%8F%96%E5%87%BD%E6%95%B0%E5%8F%97%E9%99%90%E4%B8%8B%E7%9A%84%E5%87%BD%E6%95%B0%E7%BA%A7%E9%80%90%E7%BA%A7%E6%9B%BF%E4%BB%A3-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e09&#xff1a;\u622a\u53d6\u51fd\u6570\u53d7\u9650\u4e0b\u7684\u51fd\u6570\u7ea7\u9010\u7ea7\u66ff\u4ee3<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E5%9B%9B%EF%BC%9A%E5%BD%BB%E5%BA%95%E8%A7%84%E9%81%BF%E5%87%BD%E6%95%B0%E4%B8%8E%E9%80%97%E5%8F%B7%E2%80%94%E2%80%94LIKE%20%E6%A8%A1%E5%BC%8F%E5%8C%B9%E9%85%8D%E6%9A%B4%E7%A0%B4-toc\" style=\"margin-left:120px\">\u65b9\u6848\u56db&#xff1a;\u5f7b\u5e95\u89c4\u907f\u51fd\u6570\u4e0e\u9017\u53f7\u2014\u2014LIKE \u6a21\u5f0f\u5339\u914d\u66b4\u7834<\/p>\n<p id=\"%E6%96%B9%E6%A1%88%E4%BA%94%EF%BC%9A%E5%88%86%E9%A1%B5%E6%9F%A5%E8%AF%A2%E4%B8%8E%E9%9B%86%E5%90%88%E5%8C%85%E5%90%AB%E4%B8%AD%E7%9A%84%E9%80%97%E5%8F%B7%E7%BB%95%E8%BF%87-toc\" style=\"margin-left:120px\">\u65b9\u6848\u4e94&#xff1a;\u5206\u9875\u67e5\u8be2\u4e0e\u96c6\u5408\u5305\u542b\u4e2d\u7684\u9017\u53f7\u7ed5\u8fc7<\/p>\n<p id=\"4.4%20%E6%AF%94%E8%BE%83%E7%AC%A6%E5%8F%B7%EF%BC%88%3C%E3%80%81%3E%E3%80%81%3D%EF%BC%89%E5%8F%97%E9%99%90%E4%B8%8B%E7%9A%84%E6%9B%BF%E4%BB%A3%E6%96%B9%E6%A1%88-toc\" style=\"margin-left:80px\">4.4 \u6bd4\u8f83\u7b26\u53f7&#xff08;&lt;\u3001&gt;\u3001&#061;&#xff09;\u53d7\u9650\u4e0b\u7684\u66ff\u4ee3\u65b9\u6848<\/p>\n<p id=\"%E4%BA%94%E3%80%81%E8%87%AA%E5%8A%A8%E5%8C%96%E7%9B%B2%E6%B3%A8%E5%AE%9E%E7%8E%B0%E4%B8%8E%E6%94%BB%E9%98%B2%E5%B7%A5%E5%85%B7%E7%9A%84%E5%B7%A5%E7%A8%8B%E5%8F%96%E8%88%8D-toc\" style=\"margin-left:40px\">\u4e94\u3001\u81ea\u52a8\u5316\u76f2\u6ce8\u5b9e\u73b0\u4e0e\u653b\u9632\u5de5\u5177\u7684\u5de5\u7a0b\u53d6\u820d<\/p>\n<p id=\"5.1%20Python%20%E8%87%AA%E5%8A%A8%E5%8C%96%E7%9B%B2%E6%B3%A8%E8%84%9A%E6%9C%AC%E7%9A%84%E5%8F%8C%E9%87%8D%E6%BC%94%E8%BF%9B-toc\" style=\"margin-left:80px\">5.1 Python \u81ea\u52a8\u5316\u76f2\u6ce8\u811a\u672c\u7684\u53cc\u91cd\u6f14\u8fdb<\/p>\n<p id=\"%E6%A8%A1%E5%BC%8F%E4%B8%80%EF%BC%9A%E5%8F%8C%E9%87%8D%E5%B5%8C%E5%A5%97%E5%BE%AA%E7%8E%AF%EF%BC%88%E7%BA%BF%E6%80%A7%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3%EF%BC%89-toc\" style=\"margin-left:120px\">\u6a21\u5f0f\u4e00&#xff1a;\u53cc\u91cd\u5d4c\u5957\u5faa\u73af&#xff08;\u7ebf\u6027\u66b4\u529b\u7834\u89e3&#xff09;<\/p>\n<p id=\"%E6%A8%A1%E5%BC%8F%E4%BA%8C%EF%BC%9A%E5%9F%BA%E4%BA%8E%E4%BA%8C%E5%88%86%E6%9F%A5%E6%89%BE%EF%BC%88Binary%20Search%EF%BC%89%E7%9A%84%E9%AB%98%E6%95%88%E6%94%B6%E6%95%9B-toc\" style=\"margin-left:120px\">\u6a21\u5f0f\u4e8c&#xff1a;\u57fa\u4e8e\u4e8c\u5206\u67e5\u627e&#xff08;Binary Search&#xff09;\u7684\u9ad8\u6548\u6536\u655b<\/p>\n<p id=\"5.2%20%E5%85%8D%E8%84%9A%E6%9C%AC%E6%9B%BF%E4%BB%A3%EF%BC%9ABurp%20Suite%20Intruder%20%E7%9A%84%E9%9B%86%E6%9D%9F%E7%82%B8%E5%BC%B9%EF%BC%88Cluster%20Bomb%EF%BC%89%E5%AE%9E%E6%93%8D-toc\" style=\"margin-left:80px\">5.2 \u514d\u811a\u672c\u66ff\u4ee3&#xff1a;Burp Suite Intruder \u7684\u96c6\u675f\u70b8\u5f39&#xff08;Cluster Bomb&#xff09;\u5b9e\u64cd<\/p>\n<p id=\"5.3%20%E5%AE%9E%E6%88%98%E6%8A%80%E8%83%BD%E5%BB%B6%E4%BC%B8%EF%BC%9A%E5%86%85%E7%BD%91%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E4%B8%AD%E7%9A%84%E5%AF%86%E7%A0%81%E5%96%B7%E6%B4%92%EF%BC%88Password%20Spraying%EF%BC%89-toc\" style=\"margin-left:80px\">5.3 \u5b9e\u6218\u6280\u80fd\u5ef6\u4f38&#xff1a;\u5185\u7f51\u6a2a\u5411\u79fb\u52a8\u4e2d\u7684\u5bc6\u7801\u55b7\u6d12&#xff08;Password Spraying&#xff09;<\/p>\n<p id=\"%E5%85%AD%E3%80%81%E8%AE%B2%E5%B8%88%E7%BB%8F%E9%AA%8C%E6%80%BB%E7%BB%93%E4%B8%8E%E7%8E%B0%E4%BB%A3%E5%AE%89%E5%85%A8%E5%AE%9E%E6%88%98%2F%E9%9D%A2%E8%AF%95%E8%AE%A4%E7%9F%A5%E5%8D%87%E7%BA%A7-toc\" style=\"margin-left:40px\">\u516d\u3001\u8bb2\u5e08\u7ecf\u9a8c\u603b\u7ed3\u4e0e\u73b0\u4ee3\u5b89\u5168\u5b9e\u6218\/\u9762\u8bd5\u8ba4\u77e5\u5347\u7ea7<\/p>\n<p id=\"6.1%20%E6%AD%A3%E5%88%99%E9%BB%91%E5%90%8D%E5%8D%95%E4%B8%8E%E5%95%86%E4%B8%9A%E7%BA%A7%E8%AF%AD%E4%B9%89%20WAF%20%E7%9A%84%E4%BB%A3%E5%B7%AE%E5%88%86%E9%87%8E-toc\" style=\"margin-left:80px\">6.1 \u6b63\u5219\u9ed1\u540d\u5355\u4e0e\u5546\u4e1a\u7ea7\u8bed\u4e49 WAF \u7684\u4ee3\u5dee\u5206\u91ce<\/p>\n<p id=\"6.2%20%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95%E9%9D%A2%E8%AF%95%E4%B8%AD%E7%9A%84%E9%81%BF%E5%9D%91%E6%8C%87%E5%8D%97%E4%B8%8E%E8%83%BD%E5%8A%9B%E9%87%8D%E5%A1%91-toc\" style=\"margin-left:80px\">6.2 \u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u4e2d\u7684\u907f\u5751\u6307\u5357\u4e0e\u80fd\u529b\u91cd\u5851<\/p>\n<p id=\"%E4%B8%83%E3%80%81%E5%A4%8D%E7%9B%98%E7%BB%93%E8%AE%BA-toc\" style=\"margin-left:40px\">\u4e03\u3001\u590d\u76d8\u7ed3\u8bba<\/p>\n<p id=\"%E4%BA%A4%E4%BB%98%E8%87%AA%E6%A3%80%E6%8A%A5%E5%91%8A-toc\" style=\"margin-left:40px\">\u4ea4\u4ed8\u81ea\u68c0\u62a5\u544a<\/p>\n<hr id=\"hr-toc\" \/>\n<p>\u6458\u8981&#xff1a;\u672c\u6587\u56f4\u7ed5\u4e00\u4efd\u5178\u578b\u6e17\u900f\u6d4b\u8bd5\u5c97\u4f4d\u9762\u8bd5\u5b9e\u5f55\u5c55\u5f00\u6280\u672f\u53cd\u601d&#xff0c;\u5256\u6790\u4e86\u4f20\u7edf\u9ed1\u540d\u5355\u7ed5\u8fc7\u8bdd\u672f\u4e0e\u73b0\u4ee3\u5316\u9632\u5fa1\u4e4b\u95f4\u7684\u8ba4\u77e5\u65ad\u5c42\u3002\u968f\u540e\u4ee5 sqli-labs \u7b2c 25\u300126 \u53ca 2 \u5173\u4e3a\u5b9e\u9a8c\u9776\u573a&#xff0c;\u6df1\u5ea6\u590d\u76d8\u4e86\u9762\u5bf9 OR\/AND \u8fc7\u6ee4\u3001\u7a7a\u767d\u5b57\u7b26\u53ca\u6ce8\u91ca\u5168\u62e6\u622a\u7b49\u6781\u9650\u73af\u5883\u4e0b\u7684\u6392\u67e5\u8def\u5f84&#xff0c;\u8be6\u7ec6\u8bb0\u5f55\u4e86\u5229\u7528\u53cc\u5199\u91cd\u7ec4\u3001URL \u9690\u5f0f\u7a7a\u767d\u5931\u6548\u5206\u6790\u3001MySQL \u547d\u4ee4\u884c\u5e95\u5c42\u6392\u9519\u4ee5\u53ca\u6700\u7ec8\u5c06\u903b\u8f91\u95ed\u5408\u5d4c\u5165\u5b57\u6bb5\u8868\u8fbe\u5f0f\u7684\u8f6c\u6298\u7a81\u7834\u5168\u8fc7\u7a0b\u3002\u6700\u540e\u7cfb\u7edf\u68b3\u7406\u4e86\u7a7a\u683c\u3001\u5f15\u53f7\u3001\u9017\u53f7\u3001\u6bd4\u8f83\u7b26\u4e0e\u76f2\u6ce8\u4f18\u5316\u7684\u5b9e\u6218\u66ff\u4ee3\u65b9\u6848&#xff0c;\u4e3a\u5b89\u5168\u7814\u7a76\u4e0e\u653b\u9632\u6280\u672f\u590d\u76d8\u63d0\u4f9b\u4e25\u8c28\u7684\u5de5\u7a0b\u5b9e\u8df5\u53c2\u8003\u3002<\/p>\n<hr \/>\n<h3 id=\"%E4%B8%80%E3%80%81%E8%83%8C%E6%99%AF%E4%B8%8E%E5%A4%8D%E7%9B%98%E8%8C%83%E5%9B%B4%EF%BC%9A%E4%B8%80%E4%BB%BD%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95%E9%9D%A2%E8%AF%95%E8%AE%B0%E5%BD%95%E5%BC%95%E5%8F%91%E7%9A%84%E6%8A%80%E6%9C%AF%E4%BB%A3%E5%B7%AE%E5%8F%8D%E6%80%9D\">\u4e00\u3001\u80cc\u666f\u4e0e\u590d\u76d8\u8303\u56f4&#xff1a;\u4e00\u4efd\u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u8bb0\u5f55\u5f15\u53d1\u7684\u6280\u672f\u4ee3\u5dee\u53cd\u601d<\/h3>\n<p>\u5728\u7f51\u7edc\u5b89\u5168\u5de5\u7a0b\u5b9e\u8df5\u4e0e\u6280\u672f\u6c42\u804c\u8003\u6838\u4e2d&#xff0c;\u9762\u8bd5\u6c9f\u901a\u4e0d\u4ec5\u662f\u4e2a\u4eba\u6280\u80fd\u7684\u68c0\u9a8c\u7a97\u53e3&#xff0c;\u66f4\u662f\u89c2\u5bdf\u884c\u4e1a\u653b\u9632\u8ba4\u77e5\u6f14\u8fdb\u7684\u5207\u9762\u3002\u672c\u6b21\u6280\u672f\u590d\u76d8\u7684\u8d77\u70b9\u6e90\u81ea\u4e00\u4efd\u6d41\u4f20\u4e8e\u5b89\u5168\u6280\u672f\u793e\u7fa4\u7684\u516c\u5f00\u6c42\u804c\u5b9e\u5f55\u2014\u2014\u4e00\u7bc7\u6807\u9898\u4e3a\u300a\u67d0\u661f\u8fb0\u9762\u8bd5\u5206\u4eab\u300b\u7684\u6280\u672f\u9762\u7ecf\u3002\u8be5\u6c42\u804c\u8005\u76ee\u6807\u5c97\u4f4d\u4e3a\u5317\u4eac\u5730\u533a\u7684\u6e17\u900f\u6d4b\u8bd5\u5de5\u7a0b\u5e08&#xff0c;\u9762\u8bd5\u5355\u4f4d\u4e3a\u5934\u90e8\u7f51\u7edc\u5b89\u5168\u4f01\u4e1a\u542f\u660e\u661f\u8fb0\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"559\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083521-6ab783c9b32d1.png\" width=\"772\" \/><\/p>\n<p>\u56fe 01&#xff1a;\u516c\u5f00\u9762\u7ecf\u5206\u4eab\u6587\u7ae0\u7684\u8d77\u59cb\u90e8\u5206&#xff0c;\u5305\u542b\u6c42\u804c\u57ce\u5e02\u3001\u5e94\u8058\u5c97\u4f4d\u4ee5\u53ca\u6574\u4f53\u9762\u8bd5\u6d41\u7a0b\u80cc\u666f\u3002<\/p>\n<p>\u68b3\u7406\u8be5\u8bb0\u5f55\u7684\u521d\u59cb\u8bed\u5883\u53ef\u4ee5\u53d1\u73b0&#xff0c;\u6c42\u804c\u8005\u4e3a\u975e\u79d1\u73ed\u80cc\u666f\u51fa\u8eab&#xff0c;\u6b64\u524d\u4ece\u4e8b\u8bbe\u8ba1\u7c7b\u5de5\u4f5c&#xff0c;\u56e0\u884c\u4e1a\u53d8\u5316\u81ea\u5b66\u8f6c\u5c97\u81f3\u7f51\u7edc\u5b89\u5168\u9886\u57df\u7ea6\u4e24\u5e74\u65f6\u95f4\u3002\u5728\u5b9e\u6218\u7ecf\u9a8c\u79ef\u7d2f\u65b9\u9762&#xff0c;\u6c42\u804c\u8005\u4e3b\u8981\u4f9d\u9760\u5728\u6f0f\u6d1e\u76d2\u5b50\u7b49\u6f0f\u6d1e\u54cd\u5e94\u5e73\u53f0&#xff08;SRC&#xff09;\u63d0\u4ea4\u57fa\u7840 Web \u6f0f\u6d1e\u4e3a\u4e3b&#xff0c;\u6d89\u53ca\u7684\u6f0f\u6d1e\u7c7b\u578b\u96c6\u4e2d\u5728 SQL \u6ce8\u5165\u3001\u8de8\u7ad9\u811a\u672c&#xff08;XSS&#xff09;\u3001URL \u91cd\u653e\u4ee5\u53ca\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u7b49\u8303\u7574\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"691\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083522-6ab783ca6abc1.png\" width=\"865\" \/><\/p>\n<p>\u56fe 02&#xff1a;\u9762\u8bd5\u5b98\u5c31\u4e2a\u4eba\u7ecf\u5386\u3001\u65e5\u5e38\u5b66\u4e60\u6e20\u9053\u53ca\u7b80\u5386\u6280\u672f\u5173\u952e\u8bcd\u5c55\u5f00\u8be2\u95ee\u7684\u5bf9\u8bdd\u5b9e\u5f55\u3002<\/p>\n<p>\u7136\u800c&#xff0c;\u5f53\u9762\u8bd5\u5b98\u6df1\u5165\u8ffd\u95ee\u7ec6\u8282\u65f6&#xff0c;\u66b4\u9732\u51fa\u7684\u6280\u672f\u8868\u8ff0\u4e0e\u653b\u9632\u8ba4\u77e5\u5f15\u53d1\u4e86\u6df1\u5165\u63a2\u8ba8&#xff1a;<\/p>\n<h4 id=\"1.1%20%E5%AD%A6%E4%B9%A0%E8%B7%AF%E5%BE%84%E4%B8%8E%E8%A1%8C%E4%B8%9A%E6%8A%80%E6%9C%AF%E7%A4%BE%E5%8C%BA%E7%9A%84%E6%B2%89%E6%B7%80%E5%B7%AE%E5%BC%82\">1.1 \u5b66\u4e60\u8def\u5f84\u4e0e\u884c\u4e1a\u6280\u672f\u793e\u533a\u7684\u6c89\u6dc0\u5dee\u5f02<\/h4>\n<p>\u5728\u56de\u7b54\u201c\u65e5\u5e38\u901a\u8fc7\u54ea\u4e9b\u8bba\u575b\u8fdb\u884c\u6280\u672f\u5b66\u4e60\u201d\u65f6&#xff0c;\u6c42\u804c\u8005\u63d0\u53ca\u5e73\u65f6\u4e3b\u8981\u6d4f\u89c8 CSDN\u3002\u8fd9\u4e00\u56de\u7b54\u5728\u4e13\u4e1a\u5b89\u5168\u5de5\u7a0b\u5e08\u89c6\u89d2\u7684\u9762\u8bd5\u573a\u666f\u4e2d\u663e\u5f97\u4e0d\u591f\u7cbe\u51c6\u3002CSDN \u4f5c\u4e3a\u4e00\u4e2a\u6cdb\u5f00\u53d1\u7c7b\u7684\u7efc\u5408\u6280\u672f\u5e73\u53f0&#xff0c;\u5185\u5bb9\u6db5\u76d6\u6781\u5e7f\u4f46\u8d28\u91cf\u53c2\u5dee\u4e0d\u9f50&#xff0c;\u4e14\u7f3a\u5c11\u9488\u5bf9\u9ad8\u5bf9\u6297\u6027\u653b\u9632\u3001\u5e95\u5c42\u6f0f\u6d1e\u6316\u6398\u4ee5\u53ca\u524d\u6cbf\u5206\u6790\u7684\u5782\u76f4\u6c89\u6dc0\u3002<\/p>\n<p>\u5728\u5f53\u524d\u7684\u4f01\u4e1a\u7ea7\u653b\u9632\u4e0e\u6f0f\u6d1e\u7814\u7a76\u751f\u6001\u4e2d&#xff0c;\u884c\u4e1a\u516c\u8ba4\u4e14\u5177\u5907\u9ad8\u542b\u91d1\u91cf\u7684\u4ea4\u6d41\u793e\u533a\u4e3b\u8981\u96c6\u4e2d\u5728\u4e24\u5927\u5e73\u53f0&#xff1a;<\/p>\n<li>\n<p>\u963f\u91cc\u4e91\u5148\u77e5\u5b89\u5168\u6280\u672f\u793e\u533a&#xff1a;\u6c47\u805a\u4e86\u5927\u91cf\u5173\u4e8e\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\u6f0f\u6d1e\u5206\u6790&#xff08;\u4f8b\u5982\u9488\u5bf9 Linux \u5185\u6838 perf \u5b50\u7cfb\u7edf\u7684\u672c\u5730\u63d0\u6743\u6f0f\u6d1e\u5206\u6790&#xff09;\u3001\u9ad8\u9636\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe&#xff08;\u5982 FastJson2 Hash \u78b0\u649e\u4e0e RCE&#xff09;\u7b49\u9ad8\u8d28\u91cf\u7684\u539f\u521b\u7814\u7a76\u3002<\/p>\n<\/li>\n<li>\n<p>\u5947\u5b89\u4fe1\u653b\u9632\u793e\u533a&#xff1a;\u6301\u7eed\u8ffd\u8e2a\u6700\u65b0\u7684\u653b\u9632\u5b9e\u6218\u6280\u672f\u3001\u5bb9\u5668\u9003\u9038&#xff08;\u5982 Containerd \u8fd0\u884c\u65f6\u68c0\u67e5\u70b9\u9003\u9038\u5206\u6790&#xff09;\u3001\u6846\u67b6\u7ea7\u8def\u5f84\u904d\u5386\u4ee5\u53ca\u524d\u6cbf\u7684 AI \u8f85\u52a9\u653b\u9632\u5b9e\u8df5\u3002<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"439\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083522-6ab783caaa2d8.png\" width=\"865\" \/><\/p>\n<p>\u56fe 03&#xff1a;\u5148\u77e5\u793e\u533a\u5c55\u793a\u7684 Linux \u5185\u6838\u6f0f\u6d1e\u5206\u6790\u4e0e FastJson2 \u53cd\u5e8f\u5217\u5316\u7b49\u9ad8\u6c34\u5e73\u653b\u9632\u6587\u7ae0\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"434\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083522-6ab783cadfc55.png\" width=\"865\" \/><\/p>\n<p>\u56fe 04&#xff1a;\u5947\u5b89\u4fe1\u653b\u9632\u793e\u533a\u9996\u9875&#xff0c;\u805a\u5408\u4e86\u6f0f\u6d1e\u81ea\u52a8\u5316\u5229\u7528\u3001\u4ee3\u7801\u5ba1\u8ba1\u4e0e\u65b0\u578b\u5b9e\u6218\u6280\u672f\u6210\u679c\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"412\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083523-6ab783cb20f8f.png\" width=\"865\" \/><\/p>\n<p>\u56fe 05&#xff1a;\u793e\u533a\u5185\u9488\u5bf9 Spring Boot Actuator \u8ba4\u8bc1\u7ed5\u8fc7\u4e0e\u5bb9\u5668\u9003\u9038\u7b49\u524d\u6cbf\u6f0f\u6d1e\u7684\u6df1\u5ea6\u89e3\u6790\u3002<\/p>\n<p>\u884c\u4e1a\u7814\u5224\u4e0e\u5b66\u4e60\u5efa\u8bae&#xff1a; \u9762\u8bd5\u5b98\u8be2\u95ee\u65e5\u5e38\u5b66\u4e60\u6e20\u9053&#xff0c;\u6838\u5fc3\u610f\u56fe\u5728\u4e8e\u8bc4\u4f30\u5019\u9009\u4eba\u7684\u4fe1\u606f\u83b7\u53d6\u8d28\u91cf\u3001\u6280\u672f\u89c6\u91ce\u7684\u524d\u6cbf\u6027\u4ee5\u53ca\u81ea\u4e3b\u7814\u7a76\u7684\u6df1\u5ea6\u3002\u5982\u679c\u6c42\u804c\u8005\u65e0\u6cd5\u51c6\u786e\u8bf4\u51fa\u884c\u4e1a\u5934\u90e8\u7684\u5782\u76f4\u653b\u9632\u5e73\u53f0&#xff0c;\u5f80\u5f80\u4f1a\u88ab\u5224\u5b9a\u4e3a\u7f3a\u4e4f\u4e0e\u4e00\u7ebf\u653b\u9632\u63a5\u8f68\u7684\u81ea\u9a71\u529b\u4e0e\u654f\u611f\u5ea6\u3002<\/p>\n<h4 id=\"1.2%20%E6%A0%B8%E5%BF%83%E6%BC%8F%E6%B4%9E%E6%9C%BA%E7%90%86%E8%A1%A8%E8%BF%B0%E7%9A%84%E6%8A%80%E6%9C%AF%E7%A1%AC%E4%BC%A4%EF%BC%9A%E4%BB%A5%20XXE%20%E4%B8%BA%E4%BE%8B\">1.2 \u6838\u5fc3\u6f0f\u6d1e\u673a\u7406\u8868\u8ff0\u7684\u6280\u672f\u786c\u4f24&#xff1a;\u4ee5 XXE \u4e3a\u4f8b<\/h4>\n<p>\u5f53\u9762\u8bd5\u5b98\u9488\u5bf9\u7b80\u5386\u4e2d\u63d0\u53ca\u7684\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165&#xff08;XXE&#xff09;\u5c55\u5f00\u5b9e\u6218\u8ffd\u95ee\u65f6&#xff0c;\u6c42\u804c\u8005\u7684\u56de\u7b54\u66b4\u9732\u4e86\u4e25\u91cd\u7684\u6280\u672f\u65ad\u5c42\u3002\u6c42\u804c\u8005\u79f0\u5176\u64cd\u4f5c\u4e3a&#xff1a;\u201c\u5728\u4e00\u4e2a CMS \u4e2d\u642d\u5efa\u70ae\u53f0&#xff0c;\u521b\u5efa 1.xml\u30012.php\u30013.txt&#xff0c;\u6293\u5305\u5c06 1.xml \u6570\u636e\u4ece 2.php \u53d1\u9001\u5230 3.txt&#xff0c;\u6570\u636e\u4ece 3.txt \u56de\u663e&#xff0c;\u53ef\u80fd\u5e26\u52a0\u5bc6&#xff0c;\u89e3\u5bc6\u540e\u7ee7\u7eed\u6e17\u900f\u3002\u201d<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"325\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083523-6ab783cb556d4.png\" width=\"865\" \/><\/p>\n<p>\u56fe 06&#xff1a;\u6c42\u804c\u8005\u91c7\u7528\u9ad8\u5ea6\u53e3\u8bed\u5316\u4e14\u8bed\u7109\u4e0d\u8be6\u7684\u65b9\u5f0f\u63cf\u8ff0 XXE \u5b9e\u6218\u6b65\u9aa4&#xff0c;\u7f3a\u4e4f\u5e95\u5c42\u6280\u672f\u673a\u7406\u3002<\/p>\n<p>\u8fd9\u4e00\u8868\u8ff0\u5b58\u5728\u591a\u5904\u5173\u952e\u7f3a\u9677&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u6838\u5fc3\u673a\u7406\u7f3a\u5931&#xff1a;\u5b8c\u5168\u672a\u63d0\u53ca XML \u89e3\u6790\u5668\u5bf9\u5916\u90e8\u5b9e\u4f53\u7684\u89e3\u6790\u652f\u6301&#xff08;\u5982 SYSTEM \u6807\u8bc6\u7b26&#xff09;\u3001\u672a\u8bf4\u660e\u662f\u5426\u914d\u7f6e\u4e86\u7981\u6b62\u5916\u90e8\u5b9e\u4f53\u89e3\u6790\u9009\u9879&#xff08;\u5982 PHP \u4e2d\u7684 libxml_disable_entity_loader(true)&#xff09;\u3002<\/p>\n<\/li>\n<li>\n<p>\u7f3a\u4e4f\u6280\u672f\u62bd\u8c61&#xff1a;\u5c06 Blind XXE&#xff08;\u5e26\u5916\u6570\u636e\u56de\u663e&#xff09;\u7684\u8fc7\u7a0b\u8868\u8ff0\u4e3a\u7f3a\u4e4f\u903b\u8f91\u652f\u6491\u7684\u6587\u4ef6\u6d41\u6c34\u7ebf&#xff0c;\u6ca1\u6709\u9610\u660e\u57fa\u4e8e DTD \u6587\u4ef6\u7684\u5e26\u5916\u901a\u9053\u642d\u5efa&#xff08;OOB&#xff0c;Out-of-Band&#xff09;\u672c\u8d28\u4e0e\u6570\u636e\u4f20\u8f93\u534f\u8bae&#xff08;\u5982 HTTP\u3001FTP&#xff09;\u7684\u4ea4\u4e92\u6d41\u7a0b\u3002<\/p>\n<\/li>\n<li>\n<p>\u8bed\u8a00\u73af\u5883\u6df7\u6dc6&#xff1a;\u672a\u533a\u5206 PHP&#xff08;\u5982 simplexml_load_string\u3001DOMDocument&#xff09;\u4e0e Java&#xff08;\u5982 DocumentBuilderFactory&#xff09;\u5728\u89e3\u6790 XML \u5b9e\u4f53\u65f6\u7684\u5e95\u5c42\u5dee\u5f02\u4e0e\u9632\u62a4\u7279\u5f02\u6027\u3002<\/p>\n<\/li>\n<\/ul>\n<p>\u5c3d\u7ba1\u9762\u8bd5\u8bb0\u5f55\u663e\u793a\u9762\u8bd5\u5b98\u5bf9\u6b64\u56de\u590d\u4e86\u201c\u4e0d\u9519\u4e0d\u9519\u201d&#xff0c;\u4f46\u4ece\u4e13\u4e1a\u8bc4\u5ba1\u89c6\u89d2\u6765\u770b&#xff0c;\u8fd9\u79cd\u5ba2\u5957\u53cd\u9988\u5f80\u5f80\u662f\u56e0\u4e3a\u9762\u8bd5\u5b98\u5728\u7535\u8bdd\u521d\u7b5b\u4e2d\u5e76\u672a\u8fc7\u6df1\u7ea0\u7f20&#xff0c;\u6216\u662f\u5019\u9009\u4eba\u9762\u5bf9\u975e\u5bf9\u53e3\u6280\u672f\u80cc\u666f\u8003\u6838\u4eba\u5458\u65f6\u7684\u4fa5\u5e78\u8fc7\u5173\u3002<\/p>\n<h4 id=\"1.3%20%E7%8E%B0%E4%BB%A3%20WAF%20%E5%AF%B9%E6%8A%97%E8%AE%A4%E7%9F%A5%E4%B8%8E%E4%BC%A0%E7%BB%9F%E9%BB%91%E5%90%8D%E5%8D%95%E7%BB%95%E8%BF%87%E7%9A%84%E4%BB%A3%E5%B7%AE%E5%AE%A1%E8%A7%86\">1.3 \u73b0\u4ee3 WAF \u5bf9\u6297\u8ba4\u77e5\u4e0e\u4f20\u7edf\u9ed1\u540d\u5355\u7ed5\u8fc7\u7684\u4ee3\u5dee\u5ba1\u89c6<\/h4>\n<p>\u7d27\u63a5\u7740&#xff0c;\u9762\u8bd5\u5bf9\u8bdd\u8fdb\u5165\u4e86 Web \u5e94\u7528\u9632\u62a4\u7cfb\u7edf&#xff08;WAF&#xff09;\u5bf9\u6297\u7684\u8ba8\u8bba\u3002\u8fd9\u4e00\u73af\u8282\u5145\u5206\u5c55\u73b0\u4e86\u5341\u5e74\u524d\u7684\u201c\u9776\u573a\u601d\u7ef4\u201d\u4e0e\u73b0\u4ee3\u5316\u9632\u62a4\u4f53\u7cfb\u4e4b\u95f4\u7684\u4e25\u91cd\u8131\u8282\u3002<\/p>\n<p>\u9762\u8bd5\u5b98\u8be2\u95ee\u77e5\u540d WAF&#xff08;\u5982\u957f\u4ead\u79d1\u6280\u7684\u96f7\u6c60 SafeLine \u7b49&#xff09;\u9700\u8981\u586b\u5145\u591a\u5c11\u5783\u573e\u5b57\u7b26\u624d\u80fd\u5bfc\u81f4\u68c0\u6d4b\u5931\u6548\u3002\u6c42\u804c\u8005\u56de\u7b54\u79f0\u65f6\u95f4\u592a\u4e45\u5df2\u7ecf\u9057\u5fd8&#xff0c;\u5e76\u8868\u793a\u4e3b\u8981\u4f9d\u9760\u5728\u8bf7\u6c42\u524d\u90e8\u586b\u5145\u5927\u91cf\u5783\u573e\u5b57\u7b26\u8fdb\u884c\u7f13\u51b2\u533a\u6ea2\u51fa\u6d4b\u8bd5&#xff1b;\u9762\u8bd5\u5b98\u968f\u4e4b\u7ed9\u51fa\u4e86\u201c\u67d0 WAF \u9700\u8981 4.5 \u4e07\u4e2a\u5783\u573e\u5b57\u7b26\u201d\u7684\u53cd\u9988\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"370\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083523-6ab783cb873f5.png\" width=\"775\" \/><\/p>\n<p>\u56fe 07&#xff1a;\u5bf9\u8bdd\u4e2d\u63d0\u53ca\u4f9d\u9760\u586b\u5145\u8d85\u957f\u5783\u573e\u5b57\u7b26\u89e6\u53d1 WAF \u89c4\u5219\u7ed5\u8fc7\u7684\u6d4b\u8bd5\u903b\u8f91\u3002<\/p>\n<p>\u5728\u968f\u540e\u7684 SQL \u6ce8\u5165 WAF \u7ed5\u8fc7\u63d0\u95ee\u4e2d&#xff0c;\u6c42\u804c\u8005\u7f57\u5217\u4e86\u4e00\u7cfb\u5217\u7ecf\u5178\u624b\u6cd5&#xff1a;<\/p>\n<li>\n<p>\u5927\u5c0f\u5199\u6df7\u5199\u7ed5\u8fc7&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u7b26\u53f7\u66ff\u4ee3&#xff1a;\u4f7f\u7528 &amp; \u66ff\u4ee3 AND&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u5173\u952e\u5b57\u63d2\u5165\u7a7a\u503c&#xff1a;\u5728 UNION SELECT \u4e4b\u95f4\u63d2\u5165\u7a7a\u503c\u5199\u4e3a UNION NULL SELECT&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u5185\u8054\u6ce8\u91ca\u7ed5\u8fc7&#xff1a;\u4f7f\u7528 \/**\/ \u5e76\u7ed3\u5408\u7248\u672c\u53f7&#xff08;\u5982 \/*!10000select*\/&#xff09;\u7206\u7834\u6d4b\u8bd5&#xff0c;\u7ed3\u5408\u6362\u884c\u7b26 %0a&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u53c2\u6570\u6c61\u67d3&#xff08;HPP&#xff09;&#xff1a;\u5728\u5b57\u7b26\u95f4\u63d2\u5165\u7f16\u7801\u8fdb\u884c\u62fc\u63a5&#xff08;\u5982 s%e%l%e%c%t&#xff09;\u3002<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"680\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083523-6ab783cbb9581.png\" width=\"770\" \/><\/p>\n<p>\u56fe 08&#xff1a;\u6c42\u804c\u8005\u9488\u5bf9 WAF \u7ed5\u8fc7\u95ee\u9898\u6240\u5217\u4e3e\u7684\u4f20\u7edf\u57fa\u4e8e\u5b57\u7b26\u66ff\u6362\u4e0e\u6ce8\u91ca\u7684\u6280\u672f\u624b\u6bb5\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"390\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083524-6ab783cc10c36.png\" width=\"865\" \/><\/p>\n<p>\u56fe 09&#xff1a;\u9762\u8bd5\u5b9e\u5f55\u4e2d\u5173\u4e8e\u5404\u4e3b\u6d41 WAF \u9650\u5236\u5b57\u7b26\u957f\u5ea6\u7684\u518d\u6b21\u51fa\u73b0\u3002<\/p>\n<p>\u5b9e\u6218\u5bf9\u6297\u7ed3\u8bba\u4e0e\u6280\u672f\u8fa8\u6790&#xff1a; \u4e0a\u8ff0\u6240\u8c13\u201c\u7ed5\u8fc7\u6280\u5de7\u201d\u672c\u8d28\u4e0a\u5c5e\u4e8e\u5341\u81f3\u5341\u4e94\u5e74\u524d\u9488\u5bf9\u7b80\u964b\u6b63\u5219\u8868\u8fbe\u5f0f\u68c0\u6d4b\u7cfb\u7edf\u7684\u5386\u53f2\u9057\u7559\u4ea7\u7269\u3002<\/p>\n<li>\n<p>\u5783\u573e\u5b57\u7b26\u6ea2\u51fa\u5931\u6548&#xff1a;\u73b0\u4ee3\u4f01\u4e1a\u7ea7 WAF&#xff08;\u7279\u522b\u662f\u4ee5\u957f\u4ead\u96f7\u6c60 SafeLine \u4e3a\u4ee3\u8868\u7684\u667a\u80fd WAF&#xff09;\u91c7\u7528\u667a\u80fd\u6d41\u5f0f\u89e3\u6790\u4e0e\u8bf7\u6c42\u622a\u65ad\u4fdd\u62a4\u673a\u5236&#xff0c;\u76f4\u63a5\u9650\u5236\u8bf7\u6c42\u5934\u53ca\u5355\u4e2a\u53c2\u6570\u957f\u5ea6&#xff0c;\u8d85\u957f\u8f7d\u8377\u4e0d\u4ec5\u65e0\u6cd5\u7ed5\u8fc7\u68c0\u6d4b&#xff0c;\u53cd\u800c\u4f1a\u76f4\u63a5\u89e6\u53d1\u6d41\u91cf\u5f02\u5e38\u6216\u62d2\u7edd\u670d\u52a1\u9632\u62a4&#xff0c;\u547d\u4e2d\u963b\u65ad\u7b56\u7565\u3002<\/p>\n<\/li>\n<li>\n<p>\u8bed\u6cd5\u6811&#xff08;AST&#xff09;\u89e3\u6790\u78be\u538b\u5b57\u7b26\u53d8\u5f62&#xff1a;\u4f20\u7edf\u7684\u5927\u5c0f\u5199\u6df7\u5199\u3001UNION NULL SELECT \u6216\u5185\u8054\u6ce8\u91ca&#xff0c;\u5728\u73b0\u4ee3\u57fa\u4e8e\u8bed\u6cd5\u5206\u6790\u3001\u8bed\u4e49\u8bc6\u522b\u5f15\u64ce\u7684 WAF \u9762\u524d\u5b8c\u5168\u65e0\u6548\u3002\u8bed\u4e49\u5206\u6790\u5f15\u64ce\u5728\u5b8c\u6210\u8bcd\u6cd5\u5206\u6790\u4e0e\u8bed\u6cd5\u6811\u6784\u5efa\u540e&#xff0c;\u80fd\u591f\u8fd8\u539f\u771f\u5b9e\u7684 SQL \u64cd\u4f5c\u8bed\u4e49&#xff0c;\u70b9\u661f\u901a\u914d\u6b63\u5219\u4e0e\u62bd\u8c61\u8bed\u6cd5\u6811\u89e3\u6790\u4f1a\u5f7b\u5e95\u65e0\u89c6\u4e2d\u95f4\u63d2\u5165\u7684\u7a7a\u5b57\u7b26\u6216\u6ce8\u91ca\u3002<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"307\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083524-6ab783cc41110.png\" width=\"865\" \/><\/p>\n<p>\u56fe 10&#xff1a;\u9762\u8bd5\u5b98\u9488\u5bf9\u53cd\u5e8f\u5217\u5316\u539f\u7406\u5c55\u5f00\u6df1\u5165\u8be2\u95ee&#xff0c;\u6c42\u804c\u8005\u672a\u80fd\u5f62\u6210\u7cfb\u7edf\u5316\u56de\u7b54\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"405\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083524-6ab783cc6e1f8.png\" width=\"686\" \/><\/p>\n<p>\u56fe 11&#xff1a;\u7b80\u5386\u4e2d\u5c06\u6e17\u900f\u6d4b\u8bd5\u6846\u67b6 Metasploit&#xff08;MSF&#xff09;\u8bef\u5199\u4e3a smf \u7684\u7ec6\u8282\u88ab\u5f53\u573a\u6307\u51fa\u3002<\/p>\n<h4 id=\"1.4%20%E5%B7%A5%E5%85%B7%E8%BF%90%E7%94%A8%E7%A6%81%E5%BF%8C%E4%B8%8E%E5%86%85%E7%BD%91%E5%AE%9E%E6%88%98%E8%BE%B9%E7%95%8C\">1.4 \u5de5\u5177\u8fd0\u7528\u7981\u5fcc\u4e0e\u5185\u7f51\u5b9e\u6218\u8fb9\u754c<\/h4>\n<p>\u9762\u8bd5\u8bb0\u5f55\u4e2d\u8fd8\u8bb0\u5f55\u4e86\u4e00\u5904\u6781\u5177\u8b66\u793a\u610f\u4e49\u7684\u6280\u672f\u7ec6\u8282&#xff1a;\u6c42\u804c\u8005\u5728\u63cf\u8ff0\u4e3b\u673a\u6e17\u900f\u65f6\u8868\u793a&#xff0c;\u4e00\u65e6\u626b\u63cf\u53d1\u73b0\u76ee\u6807\u5f00\u653e 445 \u7aef\u53e3&#xff0c;\u4fbf\u76f4\u63a5\u8c03\u7528 MSF \u4e2d\u7684\u6c38\u6052\u4e4b\u84dd&#xff08;MS17-010&#xff09;\u653b\u51fb\u6a21\u5757\u5b9e\u65bd\u6f0f\u6d1e\u6253\u51fb&#xff0c;\u5e76\u63d0\u5230\u66fe\u5bfc\u81f4\u9776\u673a\u76f4\u63a5\u5d29\u6e83\u5173\u673a\u3002\u9762\u8bd5\u5b98\u5f53\u573a\u6307\u51fa&#xff1a;\u201c\u5728\u771f\u5b9e\u5546\u4e1a\u9879\u76ee\u4e2d\u4e25\u7981\u76f4\u63a5\u4f7f\u7528 MSF \u8fdb\u884c\u6b64\u7c7b\u653b\u51fb&#xff0c;\u7279\u522b\u662f\u5728\u4f01\u4e1a\u57df\u73af\u5883\u4e2d\u53ef\u80fd\u5bfc\u81f4\u6838\u5fc3\u4e1a\u52a1\u762b\u75ea\u3002\u201d<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"458\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083524-6ab783cc8db47.png\" width=\"865\" \/><\/p>\n<p>\u56fe 12&#xff1a;\u9762\u8bd5\u8bb0\u5f55\u5c55\u793a\u6c42\u804c\u8005\u4f7f\u7528 MSF \u6253\u51fb 445 \u7aef\u53e3\u5f15\u53d1\u7cfb\u7edf\u5d29\u6e83\u7684\u53d9\u8ff0&#xff0c;\u56fe\u4e0a\u88ab\u91cd\u70b9\u6807\u6ce8\u7ea2\u53c9\u3002<\/p>\n<p>\u8fd9\u4e00\u8bc4\u4ef7\u76f4\u51fb\u4f01\u4e1a\u7ea2\u84dd\u5bf9\u6297\u4e0e\u6388\u6743\u6e17\u900f\u6d4b\u8bd5\u7684\u6838\u5fc3\u7ea2\u7ebf&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4e1a\u52a1\u53ef\u7528\u6027\u7b2c\u4e00\u539f\u5219&#xff1a;MS17-010 \u7b49\u5185\u6838\u7ea7 SMB \u6f0f\u6d1e\u5229\u7528\u6d89\u53ca\u5e95\u5c42\u5185\u5b58\u8986\u5199&#xff0c;\u5229\u7528\u5931\u8d25\u6781\u6613\u5f15\u53d1\u64cd\u4f5c\u7cfb\u7edf\u84dd\u5c4f&#xff08;BSOD&#xff09;\u3002\u5728\u751f\u4ea7\u7f51\u7edc\u6216\u6838\u5fc3\u57df\u63a7\u73af\u5883\u4e2d\u6267\u884c\u6b64\u7c7b\u64cd\u4f5c\u5c5e\u4e8e\u4e25\u91cd\u7684\u64cd\u4f5c\u4e8b\u6545\u3002<\/p>\n<\/li>\n<li>\n<p>\u6d41\u91cf\u6307\u7eb9\u9ad8\u5371\u66b4\u9732&#xff1a;MSF \u539f\u751f\u751f\u6210\u7684 Shellcode \u4e0e\u901a\u4fe1\u6d41\u91cf\u5177\u5907\u9ad8\u5ea6\u6807\u51c6\u5316\u7684\u7279\u5f81&#xff0c;\u65e9\u5df2\u88ab\u56fd\u5185\u5916\u4e3b\u6d41\u9632\u75c5\u6bd2\u8f6f\u4ef6&#xff08;EDR&#xff09;\u4e0e\u6d41\u91cf\u5206\u6790\u8bbe\u5907\u6253\u4e0a\u660e\u786e\u6807\u7b7e\u3002\u672a\u7ecf\u8fc7\u6df1\u5ea6\u514d\u6740\u91cd\u6784\u7684 MSF \u8f7d\u8377\u5728\u771f\u5b9e\u653b\u9632\u4e2d\u751f\u5b58\u5468\u671f\u6781\u77ed\u3002\u76f8\u6bd4\u4e4b\u4e0b&#xff0c;Cobalt Strike \u7b49\u5de5\u5177\u5728\u5177\u5907\u53ef\u89c6\u5316\u4e0e\u56e2\u961f\u534f\u4f5c\u4f18\u52bf\u7684\u540c\u65f6&#xff0c;\u540c\u6837\u5fc5\u987b\u4f9d\u6258\u6df1\u5ea6\u5b9a\u5236\u7684 Malleable C2 \u914d\u7f6e\u6587\u4ef6\u624d\u80fd\u7ef4\u6301\u6709\u6548\u9690\u853d\u3002<\/p>\n<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"415\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083524-6ab783ccc27e5.png\" width=\"865\" \/><\/p>\n<p>\u56fe 13&#xff1a;\u9762\u8bd5\u5b98\u5bf9\u6c42\u804c\u8005\u81ea\u5b66\u7ecf\u5386\u4e0e SRC \u6316\u6398\u6392\u540d\u7684\u80af\u5b9a\u4e0e\u5f55\u7528\u6c9f\u901a\u63d0\u793a\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"348\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083524-6ab783ccf3b51.png\" width=\"865\" \/><\/p>\n<p>\u56fe 14&#xff1a;\u8bb2\u5e08\u5728\u56de\u987e\u8be5\u7bc7\u9762\u8bd5\u8bb0\u5f55\u65f6&#xff0c;\u7ea2\u7b14\u5708\u753b\u5f3a\u8c03 WAF \u7ed5\u8fc7\u5c5e\u4e8e\u5f53\u524d\u9762\u8bd5\u9ad8\u9891\u5fc5\u8003\u677f\u5757\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"454\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083525-6ab783cd2c1ad.png\" width=\"865\" \/><\/p>\n<p>\u56fe 15&#xff1a;\u7279\u5199\u5c55\u793a\u5019\u9009\u4eba\u5173\u4e8e\u5927\u5c0f\u5199\u3001\u7a7a\u503c\u3001\u5185\u8054\u6ce8\u91ca\u53ca\u53c2\u6570\u6c61\u67d3\u7684\u56de\u7b54\u6587\u672c\u3002<\/p>\n<h4 id=\"1.5%20%E6%89%80%E8%B0%93%E2%80%9CSSL%20%E7%BB%95%E8%BF%87%E2%80%9D%E7%9A%84%E6%A6%82%E5%BF%B5%E8%AF%AF%E5%8C%BA%E4%B8%8E%E7%9C%9F%E5%AE%9E%E8%80%83%E7%82%B9%E6%BE%84%E6%B8%85\">1.5 \u6240\u8c13\u201cSSL \u7ed5\u8fc7\u201d\u7684\u6982\u5ff5\u8bef\u533a\u4e0e\u771f\u5b9e\u8003\u70b9\u6f84\u6e05<\/h4>\n<p>\u5728\u9762\u8bd5\u5b9e\u5f55\u7684\u5ef6\u4f38\u5206\u6790\u4e2d&#xff0c;\u6d89\u53ca\u5230\u4e00\u4e2a\u5e38\u88ab\u8bef\u8bfb\u7684\u6280\u672f\u540d\u8bcd\u2014\u2014\u201cSSL \u7ed5\u8fc7\u201d\u3002\u9762\u8bd5\u5b98\u7684\u63d0\u95ee\u8bed\u5883\u5b9e\u9645\u6307\u5411\u79fb\u52a8\u7aef\u5e94\u7528&#xff08;APP \u53ca\u5c0f\u7a0b\u5e8f&#xff09;\u5728\u6e17\u900f\u6d4b\u8bd5\u8fc7\u7a0b\u4e2d\u7684\u6293\u5305\u53d7\u963b\u95ee\u9898\u3002<\/p>\n<ul>\n<li>\n<p>\u7f51\u7edc\u67b6\u6784\u672c\u8d28&#xff1a;\u79fb\u52a8\u7aef APP \u672c\u8d28\u4e0a\u662f\u4e00\u4e2a\u72ec\u7acb\u7684\u524d\u7aef\u5c55\u793a\u7a0b\u5e8f&#xff0c;\u5176\u6838\u5fc3\u4e1a\u52a1\u6570\u636e\u5747\u4f9d\u8d56 API \u63a5\u53e3\u5411\u540e\u7aef\u670d\u52a1\u5668\u5f02\u6b65\u8bf7\u6c42\u3002APP \u6e17\u900f\u7684\u6838\u5fc3\u8def\u5f84\u5728\u4e8e\u6355\u83b7\u5e76\u5206\u6790\u8fd9\u4e9b\u4e0e\u540e\u7aef\u670d\u52a1\u4ea4\u4e92\u7684\u6570\u636e\u5305&#xff0c;\u901a\u8fc7\u5206\u6790\u670d\u52a1\u7aef Web \u7cfb\u7edf\u7684\u63a5\u53e3\u903b\u8f91\u5bfb\u627e\u8d8a\u6743\u3001\u6ce8\u5165\u6216\u903b\u8f91\u7f3a\u9677\u3002<\/p>\n<\/li>\n<li>\n<p>\u5e38\u89c1\u6280\u672f\u5361\u70b9&#xff1a;\u6e17\u900f\u6d4b\u8bd5\u4eba\u5458\u5728\u7269\u7406\u673a\u914d\u7f6e Burp Suite \u76d1\u542c 127.0.0.1:8080&#xff0c;\u5e76\u5728\u79fb\u52a8\u8bbe\u5907\u4e2d\u914d\u7f6e Wi-Fi \u4ee3\u7406\u6307\u5411\u7269\u7406\u673a IP \u53ca\u7aef\u53e3\u540e&#xff0c;\u5e38\u53d1\u73b0\u5e94\u7528\u63d0\u793a\u201c\u7f51\u7edc\u8fde\u63a5\u4e2d\u65ad\u201d\u6216\u5b8c\u5168\u65e0\u6cd5\u6536\u53d1\u6570\u636e\u3002<\/p>\n<\/li>\n<li>\n<p>\u6982\u5ff5\u8fa8\u6790\u4e0e\u7ea0\u504f&#xff1a;\u6b64\u73b0\u8c61\u7edd\u975e\u610f\u5473\u7740\u201c\u7834\u89e3\u4e86 SSL \u534f\u8bae\u672c\u8eab\u201d\u3002SSL\/TLS \u5e95\u5c42\u57fa\u4e8e RSA\u3001ECC \u53ca AES \u7b49\u4e25\u5bc6\u7684\u975e\u5bf9\u79f0\u4e0e\u5bf9\u79f0\u5bc6\u7801\u5b66\u7b97\u6cd5&#xff0c;\u82e5\u771f\u6b63\u5b9e\u73b0 SSL \u7834\u89e3&#xff0c;\u5168\u7403\u52a0\u5bc6\u901a\u4fe1\u4e0e\u4e92\u8054\u7f51\u91d1\u878d\u4f53\u7cfb\u5c06\u53d1\u751f\u6839\u672c\u6027\u96ea\u5d29\u3002\u5e94\u7528\u65e0\u6cd5\u6293\u5305\u7684\u6839\u672c\u539f\u56e0\u5728\u4e8e\u5ba2\u6237\u7aef\u5b9e\u65bd\u4e86\u8bc1\u4e66\u7ed1\u5b9a&#xff08;SSL Pinning&#xff09;\u673a\u5236&#xff0c;\u5373 APP \u5185\u90e8\u9884\u57cb\u4e86\u670d\u52a1\u7aef\u5408\u6cd5\u8bc1\u4e66\u7684\u54c8\u5e0c\u6216\u516c\u94a5\u4fe1\u606f&#xff0c;\u62d2\u7edd\u4fe1\u4efb\u7531\u672c\u5730\u6293\u5305\u5de5\u5177\u9881\u53d1\u7684\u4f2a\u9020\u6839\u8bc1\u4e66\u3002\u5b9e\u6218\u4e2d\u7684\u5e94\u5bf9\u65b9\u6848\u662f\u501f\u52a9 Frida\u3001Xposed \u7b49\u52a8\u6001 Hook \u6846\u67b6\u7ed5\u8fc7\u5ba2\u6237\u7aef\u7684\u8bc1\u4e66\u6821\u9a8c\u51fd\u6570&#xff0c;\u4fc3\u4f7f\u5e94\u7528\u4fe1\u4efb\u7cfb\u7edf\u8bc1\u4e66\u6216\u672c\u5730\u4ee3\u7406&#xff0c;\u800c\u975e\u201c\u7ed5\u8fc7 SSL \u52a0\u5bc6\u201d\u3002<\/p>\n<\/li>\n<\/ul>\n<p>\u73b0\u4ee3\u653b\u9632\u8003\u6838\u8d8b\u52bf\u603b\u7ed3&#xff1a; \u5f53\u524d\u4e00\u7ebf\u5b89\u5168\u5c97\u4f4d\u5bf9\u4f20\u7edf\u7684 OWASP Top 10 \u57fa\u7840\u539f\u7406\u63d0\u95ee\u6b63\u5728\u5927\u5e45\u538b\u7f29&#xff0c;\u8003\u6838\u91cd\u5fc3\u5168\u9762\u8f6c\u5411\u6df1\u5ea6\u4ee3\u7801\u5ba1\u8ba1\u3001\u9ad8\u9636\u53cd\u5e8f\u5217\u5316\u5229\u7528\u94fe\u5206\u6790\u3001WAF \u673a\u5236\u62c6\u89e3\u4e0e\u771f\u5b9e\u9632\u5fa1\u89c4\u907f&#xff0c;\u4ee5\u53caWebShell \u52a8\u6001\u514d\u6740\u6280\u672f\u3002\u57fa\u4e8e\u6b64&#xff0c;\u4e0b\u6587\u5c06\u8131\u79bb\u7c97\u6d45\u7684\u53e3\u5934\u8868\u8ff0&#xff0c;\u4ee5\u4e25\u8c28\u7684\u4ee3\u7801\u5ba1\u8ba1\u548c\u672c\u5730\u8c03\u8bd5\u4e3a\u57fa\u7840&#xff0c;\u9488\u5bf9\u9ed1\u540d\u5355\u8fc7\u6ee4\u5c55\u5f00\u7cfb\u7edf\u6027\u7684\u653b\u9632\u6280\u672f\u590d\u76d8\u3002<\/p>\n<hr \/>\n<h3 id=\"%E4%BA%8C%E3%80%81%E6%A1%88%E4%BE%8B%E4%B8%80%EF%BC%9A%E5%85%B3%E9%94%AE%E5%AD%97%E8%BF%87%E6%BB%A4%E4%B8%8E%E5%8F%8C%E5%86%99%E9%87%8D%E6%9E%84%E6%9C%BA%E5%88%B6%EF%BC%88sqli-labs%20Less-25%20%E6%B7%B1%E5%BA%A6%E5%A4%8D%E7%9B%98%EF%BC%89\">\u4e8c\u3001\u6848\u4f8b\u4e00&#xff1a;\u5173\u952e\u5b57\u8fc7\u6ee4\u4e0e\u53cc\u5199\u91cd\u6784\u673a\u5236&#xff08;sqli-labs Less-25 \u6df1\u5ea6\u590d\u76d8&#xff09;<\/h3>\n<p>\u672c\u8282\u4ee5\u5f00\u6e90 SQL \u6ce8\u5165\u9776\u573a sqli-labs \u7684\u7b2c 25 \u5173&#xff08;Less-25&#xff09;\u4e3a\u5b9e\u9a8c\u5bf9\u8c61&#xff0c;\u590d\u76d8\u5728\u670d\u52a1\u7aef\u5b9e\u65bd\u7279\u5b9a\u5173\u952e\u8bcd\u4e25\u683c\u6b63\u5219\u5254\u9664\u65f6\u7684\u8c03\u8bd5\u5168\u6d41\u7a0b\u3002<\/p>\n<h4 id=\"2.1%20%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E4%B8%8E%E8%BF%87%E6%BB%A4%E5%9F%BA%E5%87%86\">2.1 \u5b9e\u9a8c\u73af\u5883\u4ee3\u7801\u5ba1\u8ba1\u4e0e\u8fc7\u6ee4\u57fa\u51c6<\/h4>\n<p>\u5ba1\u8ba1 sqli-labs\/Less-25\/index.php \u6e90\u7801&#xff0c;\u540e\u7aef\u5728\u63a5\u6536 HTTP GET \u8bf7\u6c42\u4f20\u9012\u7684 id \u53c2\u6570\u540e&#xff0c;\u672a\u76f4\u63a5\u62fc\u5165 SQL \u8bed\u53e5&#xff0c;\u800c\u662f\u663e\u5f0f\u8c03\u7528\u4e86\u81ea\u5b9a\u4e49\u7684 blacklist() \u51fd\u6570\u5b9e\u65bd\u8fc7\u6ee4&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"476\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083525-6ab783cd620ed.png\" width=\"865\" \/><\/p>\n<p>\u56fe 16&#xff1a;Less-25 \u540e\u7aef\u5728\u5c06\u8f93\u5165\u53d8\u91cf\u62fc\u5165\u6570\u636e\u5e93\u67e5\u8be2\u524d&#xff0c;\u901a\u8fc7 blacklist \u51fd\u6570\u8fdb\u884c\u53c2\u6570\u6e05\u6d17\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"180\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083525-6ab783cd99955.png\" width=\"838\" \/><\/p>\n<p>\u56fe 17&#xff1a;\u9ed1\u540d\u5355\u51fd\u6570\u4f7f\u7528 preg_replace \u9488\u5bf9 or \u4e0e and \u8bbe\u5b9a\u4e86\u4e0d\u533a\u5206\u5927\u5c0f\u5199\u7684\u5168\u5c40\u66ff\u6362\u89c4\u5219\u3002<\/p>\n<p>\u5ba1\u67e5\u8be5\u8fc7\u6ee4\u903b\u8f91\u7684\u5177\u4f53\u5b9e\u73b0&#xff1a;<\/p>\n<p>function blacklist($id)<br \/>\n{<br \/>\n \u00a0 \u00a0$id &#061; preg_replace(&#039;\/or\/i&#039;, &#034;&#034;, $id); \u00a0 \/\/ \u5254\u9664 or&#xff08;\u4e0d\u533a\u5206\u5927\u5c0f\u5199&#xff09;<br \/>\n \u00a0 \u00a0$id &#061; preg_replace(&#039;\/AND\/i&#039;, &#034;&#034;, $id); \u00a0\/\/ \u5254\u9664 and&#xff08;\u4e0d\u533a\u5206\u5927\u5c0f\u5199&#xff09;<br \/>\n \u00a0 \u00a0return $id;<br \/>\n} <\/p>\n<p>\u6280\u672f\u7279\u5f81\u5256\u6790&#xff1a;<\/p>\n<li>\n<p>\u6b63\u5219\u4fee\u9970\u7b26 \/i \u8868\u793a\u4e0d\u533a\u5206\u5927\u5c0f\u5199&#xff0c;\u8fd9\u610f\u5473\u7740\u4efb\u4f55\u8bd5\u56fe\u901a\u8fc7 Or\u3001oR\u3001aNd \u7b49\u5927\u5c0f\u5199\u53d8\u5f62\u7684\u8f7d\u8377\u90fd\u4f1a\u88ab\u7cbe\u51c6\u8bc6\u522b\u5e76\u5339\u914d\u3002<\/p>\n<\/li>\n<li>\n<p>\u8fc7\u6ee4\u51fd\u6570\u4f7f\u7528\u7684\u662f\u5355\u6b21\u5168\u5c40\u7a7a\u5b57\u7b26\u66ff\u6362&#xff08;&#034;&#034;&#xff09;&#xff0c;\u800c\u975e\u62d2\u7edd\u670d\u52a1\u629b\u51fa\u5f02\u5e38\u3002<\/p>\n<\/li>\n<li>\n<p>\u540e\u7aef\u6267\u884c\u7684 SQL \u6784\u9020\u903b\u8f91\u4e3a&#xff1a;<\/p>\n<p> $sql&#061;&#034;SELECT * FROM users WHERE id&#061;&#039;$id&#039; LIMIT 0,1&#034;; <\/p>\n<p>&#xff0c;\u76ee\u6807\u4e3a\u5355\u5f15\u53f7\u5305\u88f9\u7684\u5b57\u7b26\u578b\u6ce8\u5165\u70b9\u3002<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"494\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083525-6ab783cdbc54b.png\" width=\"865\" \/><\/p>\n<p>\u56fe 18&#xff1a;\u5728 blacklist \u5173\u952e\u4f4d\u7f6e\u6dfb\u52a0\u6ce8\u91ca&#xff0c;\u6807\u660e\u4e24\u79cd\u6838\u5fc3\u5bf9\u6297\u7b56\u7565&#xff1a;\u5f7b\u5e95\u907f\u5f00\u654f\u611f\u8bcd\u4e0e\u6784\u9020\u53cc\u5199\u91cd\u7ec4\u3002<\/p>\n<p>\u3010\u5c0f\u767d\u901a\u4fd7\u6ce8\u89e3\u3011<\/p>\n<p>\u5355\u6b21\u66ff\u6362&#xff08;preg_replace&#xff09;\u4e3a\u4ec0\u4e48\u4f1a\u4ea7\u751f\u5b89\u5168\u6f0f\u6d1e&#xff1f; \u5f53\u9632\u5fa1\u7a0b\u5e8f\u4ec5\u4ec5\u6267\u884c\u4e86\u4e00\u6b21\u67e5\u627e\u5e76\u5220\u9664\u7a7a\u5b57\u7b26\u7684\u64cd\u4f5c\u65f6&#xff0c;\u5b83\u53ea\u79fb\u9664\u4e86\u5b83\u9996\u6b21\u626b\u5230\u7684\u6a21\u5f0f\u3002\u5982\u679c\u653b\u51fb\u8005\u5c06\u4e00\u4e2a\u654f\u611f\u8bcd\u4ece\u4e2d\u95f4\u5207\u5f00&#xff0c;\u5e76\u5728\u7f1d\u9699\u4e2d\u518d\u585e\u5165\u4e00\u4e2a\u654f\u611f\u8bcd&#xff08;\u5982 a &#043; and &#043; nd&#xff09;&#xff0c;\u7a0b\u5e8f\u5220\u9664\u4e86\u5185\u5c42\u7684 and \u4e4b\u540e&#xff0c;\u539f\u672c\u88ab\u5206\u5f00\u7684\u5916\u5c42\u5b57\u6bcd\u5c31\u4f1a\u91cd\u65b0\u5408\u62e2&#xff0c;\u518d\u6b21\u62fc\u51d1\u6210\u5b8c\u6574\u7684 and\u3002\u8fd9\u5c31\u662f\u201c\u53cc\u5199\u7ed5\u8fc7\u201d\u7684\u7269\u7406\u672c\u8d28\u3002<\/p>\n<h4 id=\"2.2%20%E5%9F%BA%E7%A1%80%E6%B3%A8%E5%85%A5%E7%82%B9%E9%AA%8C%E8%AF%81%E4%B8%8E%E8%81%94%E5%90%88%E6%9F%A5%E8%AF%A2%E5%9B%9E%E6%98%BE%E6%8E%A2%E6%B5%8B\">2.2 \u57fa\u7840\u6ce8\u5165\u70b9\u9a8c\u8bc1\u4e0e\u8054\u5408\u67e5\u8be2\u56de\u663e\u63a2\u6d4b<\/h4>\n<p>\u5728\u6d4f\u89c8\u5668\u7aef\u8f93\u5165\u57fa\u7840\u6d4b\u8bd5\u8f7d\u8377&#xff0c;\u9a8c\u8bc1\u53c2\u6570\u95ed\u5408\u4e0e\u56de\u663e\u673a\u5236&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-25\/?id&#061;1&#039; <\/p>\n<p>\u7cfb\u7edf\u7acb\u5373\u629b\u51fa MySQL \u8bed\u6cd5\u9519\u8bef\u5f02\u5e38\u4fe1\u606f&#xff1a;You have an error in your SQL syntax; check the manual&#8230; near &#039;&#039;1&#039; LIMIT 0,1&#039; at line 1&#xff0c;\u660e\u786e\u8bc1\u5b9e\u5355\u5f15\u53f7\u6210\u529f\u7834\u574f\u4e86\u539f\u6709\u7684 SQL \u8bed\u53e5\u7ed3\u6784\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"429\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083525-6ab783cdf2e4a.png\" width=\"865\" \/><\/p>\n<p>\u56fe 19&#xff1a;\u901a\u8fc7\u5355\u5f15\u53f7\u6210\u529f\u95ed\u5408\u5e76\u7834\u574f\u539f\u59cb\u67e5\u8be2\u8bed\u53e5&#xff0c;\u9875\u9762\u56de\u663e\u9519\u8bef\u4fe1\u606f\u8bc1\u5b9e\u5b57\u7b26\u578b\u6ce8\u5165\u6f0f\u6d1e\u5b58\u5728\u3002<\/p>\n<p>\u786e\u8ba4\u5b57\u6bb5\u6570\u91cf\u5e76\u63a2\u6d4b\u6709\u6548\u56de\u663e\u4f4d\u3002\u6784\u9020\u6807\u51c6\u7684\u8054\u5408\u67e5\u8be2\u8f7d\u8377&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-25\/?id&#061;-1&#039; union select 1,2,3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"142\" src=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083526-6ab783ce3677d.png\" width=\"891\" \/><\/p>\n<p>\u56fe 20&#xff1a;\u5728\u5730\u5740\u680f\u952e\u5165\u5e26\u6709\u8054\u5408\u67e5\u8be2\u53ca\u6ce8\u91ca\u622a\u65ad\u7684\u63a2\u6d4b\u8f7d\u8377\u3002<\/p>\n<p>\u9875\u9762\u56de\u663e\u663e\u793a Your Login name: 2 \u4e0e Your Password: 3&#xff0c;\u8868\u660e\u5f53\u524d\u6570\u636e\u8868\u7684\u5b57\u6bb5\u603b\u6570\u4e3a 3&#xff0c;\u4e14\u7b2c 2 \u5b57\u6bb5\u4e0e\u7b2c 3 \u5b57\u6bb5\u4e3a\u6709\u6548\u6570\u636e\u56de\u663e\u4f4d\u7f6e\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"264\" src=\"2026-09-26dcl3gpnb1dg.png\" width=\"865\" \/><\/p>\n<p>\u56fe 21&#xff1a;\u9875\u9762\u660e\u786e\u56de\u663e 2 \u548c 3&#xff0c;\u9a8c\u8bc1\u8054\u5408\u67e5\u8be2\u901a\u9053\u5efa\u7acb\u6210\u529f\u3002<\/p>\n<h4 id=\"2.3%20%E6%95%8F%E6%84%9F%E5%AD%97%E6%AE%B5%E5%90%8D%E9%9A%90%E5%BC%8F%E8%BF%87%E6%BB%A4%E9%81%AD%E9%81%87%E4%B8%8E%E6%8E%92%E9%94%99%E8%BD%AC%E6%8A%98\">2.3 \u654f\u611f\u5b57\u6bb5\u540d\u9690\u5f0f\u8fc7\u6ee4\u906d\u9047\u4e0e\u6392\u9519\u8f6c\u6298<\/h4>\n<p>\u5728\u5efa\u7acb\u8054\u5408\u67e5\u8be2\u901a\u9053\u540e&#xff0c;\u4e0b\u4e00\u6b65\u662f\u901a\u8fc7\u5b50\u67e5\u8be2\u63d0\u53d6 users \u8868\u4e2d\u7684\u7528\u6237\u51ed\u8bc1\u3002\u6784\u9020\u5e38\u89c4\u5b50\u67e5\u8be2\u8bed\u53e5&#xff1a;<\/p>\n<p>-1&#039; union select 1,(select group_concat(username,0x3a,password) from users),3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"59\" src=\"2026-09-26i3twe02t0r0.png\" width=\"1058\" \/><\/p>\n<p>\u56fe 22&#xff1a;\u5c1d\u8bd5\u4f7f\u7528 group_concat \u8fde\u63a5 username\u3001\u5192\u53f7\u5341\u516d\u8fdb\u5236&#xff08;0x3a&#xff09;\u53ca password \u5b57\u6bb5\u3002<\/p>\n<p>\u8be5\u8bf7\u6c42\u53d1\u9001\u540e&#xff0c;\u9875\u9762\u5e76\u672a\u5982\u671f\u8f93\u51fa\u7528\u6237\u6570\u636e&#xff0c;\u800c\u662f\u8fd4\u56de\u4e86\u6570\u636e\u5e93\u8bed\u6cd5\u9519\u8bef\u3002 \u95ee\u9898\u5206\u6790&#xff1a; \u6392\u67e5\u8f7d\u8377\u6784\u6210&#xff0c;\u5f53\u524d\u8bed\u53e5\u4e2d\u5e76\u672a\u663e\u5f0f\u5305\u542b\u903b\u8f91\u8fde\u63a5\u8bcd OR \u6216 AND\u3002\u7136\u800c&#xff0c;\u7ec6\u81f4\u5ba1\u67e5\u5b57\u6bb5\u540d\u53d1\u73b0&#xff0c;\u76ee\u6807\u5b57\u6bb5 password \u7684\u62fc\u5199\u4e2d\u5185\u5d4c\u4e86\u8fde\u7eed\u5b57\u7b26 or&#xff08;\u5373 pass-w-or-d&#xff09;\u3002\u5f53\u8f93\u5165\u5b57\u7b26\u4e32\u7ecf\u8fc7 blacklist() \u51fd\u6570\u5904\u7406\u65f6&#xff0c;\u5185\u90e8\u7684 or \u88ab\u65e0\u6761\u4ef6\u66ff\u6362\u4e3a\u7a7a&#xff0c;\u4f7f\u5f97\u539f\u5b57\u6bb5\u540d\u88ab\u7be1\u6539\u6210\u975e\u6cd5\u7684\u6570\u636e\u5e93\u5217\u540d passwd&#xff0c;\u4ece\u800c\u5bfc\u81f4 MySQL \u4ea7\u751f\u5217\u540d\u4e0d\u5b58\u5728\u7684\u9519\u8bef\u3002<\/p>\n<p>\u4fee\u590d\u5c1d\u8bd5 1&#xff1a;\u903b\u8f91\u8fd0\u7b97\u7b26\u66ff\u4ee3 \u8bb2\u5e08\u5c1d\u8bd5\u4f7f\u7528\u5173\u7cfb\u8fd0\u7b97\u7b26 || \u4ee3\u66ff password \u4e2d\u7684 or \u5b57\u6bcd\u4e32&#xff0c;\u5728\u5730\u5740\u680f\u8f93\u5165&#xff1a;<\/p>\n<p><span style=\"background-color:#d7d8d9\">passw||d<\/span> <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"106\" src=\"2026-09-26o4kt2cgwhpg.png\" width=\"1006\" \/><\/p>\n<p>\u56fe 23&#xff1a;\u5c1d\u8bd5\u4f7f\u7528\u53cc\u7ad6\u7ebf passw||d \u7ed5\u8fc7&#xff0c;\u4f46\u56e0\u5b57\u6bb5\u540d\u5c5e\u4e8e\u7eaf\u6807\u8bc6\u7b26\u800c\u5931\u6548\u3002<\/p>\n<p>\u6d4b\u8bd5\u7ed3\u679c&#xff1a;\u6267\u884c\u5931\u8d25\u3002 \u5931\u8d25\u5f52\u56e0&#xff1a;|| \u662f SQL \u8bed\u6cd5\u4e2d\u7684\u903b\u8f91\u6790\u53d6\u8fd0\u7b97\u7b26&#xff08;\u6216\u5728\u67d0\u4e9b\u6a21\u5f0f\u4e0b\u7528\u4f5c\u5b57\u7b26\u4e32\u8fde\u63a5\u7b26&#xff09;&#xff0c;\u800c password \u662f\u6570\u636e\u8868\u4e2d\u7684\u7269\u7406\u5217\u6807\u8bc6\u7b26\u3002\u6807\u8bc6\u7b26\u5fc5\u987b\u662f\u8fde\u7eed\u5b8c\u6574\u7684\u6587\u672c&#xff0c;\u4e0d\u80fd\u88ab\u64cd\u4f5c\u7b26\u622a\u65ad&#xff0c;\u56e0\u6b64\u8bed\u6cd5\u89e3\u6790\u65e0\u6cd5\u5c06\u5176\u8bc6\u522b\u4e3a\u5408\u6cd5\u5b57\u6bb5\u3002<\/p>\n<p>\u4fee\u590d\u5c1d\u8bd5 2&#xff1a;\u57fa\u4e8e\u5355\u6b21\u8fc7\u6ee4\u7279\u6027\u7684\u53cc\u5199\u6784\u9020 \u5229\u7528 preg_replace \u4e0d\u5177\u5907\u9012\u5f52\u6e05\u6d17\u7684\u7279\u6027&#xff0c;\u5c06 password \u6539\u5199\u4e3a\u53cc\u5199\u5f62\u5f0f&#xff1a;<\/p>\n<p>passwoord <\/p>\n<p>\u5f53\u9632\u62a4\u51fd\u6570\u626b\u63cf\u5230\u4e2d\u95f4\u7684 or \u65f6&#xff0c;\u5c06\u5176\u66ff\u6362\u4e3a\u7a7a\u5b57\u7b26 &#034;&#034;&#xff0c;\u524d\u7f00 passw \u4e0e\u540e\u7f00 d \u4ee5\u53ca\u5916\u5c42\u4fdd\u7559\u7684\u5b57\u7b26\u91cd\u65b0\u91cd\u7ec4\u4e3a\u5408\u6cd5\u7684 password\u3002<\/p>\n<p>\u63d0\u4ea4\u8f7d\u8377&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-25\/?id&#061;-1&#039; union select 1,(select group_concat(username,0x3a,passwoord) from users),3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"207\" src=\"2026-09-26y22hnzgnmkb.png\" width=\"865\" \/><\/p>\n<p>\u56fe 24&#xff1a;\u9875\u9762\u6210\u529f\u6253\u5370 Dumb:Dumb, Angelina:I-kill-you \u7b49\u5168\u90e8\u654f\u611f\u7528\u6237\u4fe1\u606f\u3002<\/p>\n<h4 id=\"2.4%20%E7%B3%BB%E7%BB%9F%E5%85%83%E6%95%B0%E6%8D%AE%E8%8E%B7%E5%8F%96%E4%B8%AD%E7%9A%84%E7%BA%A7%E8%81%94%E8%BF%87%E6%BB%A4%E4%B8%8E%E9%80%90%E7%BA%A7%E6%8E%92%E6%9F%A5\">2.4 \u7cfb\u7edf\u5143\u6570\u636e\u83b7\u53d6\u4e2d\u7684\u7ea7\u8054\u8fc7\u6ee4\u4e0e\u9010\u7ea7\u6392\u67e5<\/h4>\n<p>\u5728\u771f\u5b9e\u7684\u76f2\u76d2\u6e17\u900f\u6d4b\u8bd5\u4e2d&#xff0c;\u653b\u51fb\u8005\u901a\u5e38\u65e0\u6cd5\u9884\u5148\u77e5\u6089\u6570\u636e\u8868\u7ed3\u6784&#xff0c;\u5fc5\u987b\u4f9d\u6b21\u904d\u5386\u67e5\u8be2\u7cfb\u7edf\u67b6\u6784\u5e93 information_schema\u3002\u7136\u800c\u5728 Less-25 \u7684\u8fc7\u6ee4\u89c4\u5219\u4e0b&#xff0c;\u8fd9\u4e00\u5e38\u89c4\u64cd\u4f5c\u906d\u9047\u4e86\u8fde\u7eed\u7684\u201c\u9690\u5f0f\u8fc7\u6ee4\u9677\u9631\u201d\u3002<\/p>\n<p>\u9677\u9631 1&#xff1a;\u5143\u6570\u636e\u5e93\u540d\u79f0\u88ab\u622a\u65ad \u5c1d\u8bd5\u83b7\u53d6\u6240\u6709\u6570\u636e\u8868\u540d\u79f0&#xff1a;<\/p>\n<p>-1&#039; union select 1,(select group_concat(table_name) from information_schema.tables where table_schema&#061;database()),3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"111\" src=\"2026-09-26ba4fphkzi5j.png\" width=\"865\" \/><\/p>\n<p>\u56fe 25&#xff1a;\u5730\u5740\u680f\u4e2d\u8f93\u5165\u9488\u5bf9 information_schema \u7cfb\u7edf\u7684\u67e5\u8be2\u5c1d\u8bd5\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"109\" src=\"2026-09-26v5vubds4h5f.png\" width=\"865\" \/><\/p>\n<p>\u56fe 26&#xff1a;\u672a\u5904\u7406\u5173\u952e\u5b57\u7684\u67e5\u8be2\u8bed\u53e5&#xff0c;\u56e0 information \u4e2d\u542b or \u5c06\u76f4\u63a5\u5bfc\u81f4\u8868\u540d\u5931\u6548\u3002<\/p>\n<p>\u7ed3\u679c\u5206\u6790&#xff1a;information_schema \u5e93\u540d\u4e2d\u540c\u6837\u5305\u542b\u654f\u611f\u5b50\u4e32 or&#xff08;inf-or-mation&#xff09;\u3002\u672a\u53cc\u5199\u76f4\u63a5\u8f93\u5165\u4f1a\u5bfc\u81f4\u88ab\u6e05\u6d17\u4e3a infmation_schema&#xff0c;\u5f15\u53d1\u5e93\u540d\u4e0d\u5b58\u5728\u9519\u8bef\u3002 \u4fee\u6b63\u65b9\u6848&#xff1a;\u5c06\u5e93\u540d\u5b9e\u65bd\u53cc\u5199\u91cd\u6784\u4e3a infoorrmation_schema.tables\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"163\" src=\"2026-09-26xipvyrursie.png\" width=\"906\" \/><\/p>\n<p>\u56fe 27&#xff1a;\u5730\u5740\u680f\u4fee\u6b63\u4e3a infoorrmation_schema&#xff0c;\u6d88\u9664\u5e93\u540d\u89e3\u6790\u9519\u8bef\u3002<\/p>\n<p>\u9677\u9631 2&#xff1a;\u67e5\u5217\u6761\u4ef6\u4e2d\u7684\u903b\u8f91\u8fde\u63a5\u8bcd\u88ab\u5254\u9664 \u5728\u679a\u4e3e\u76ee\u6807\u8868&#xff08;users \u8868&#xff09;\u4e2d\u7684\u5217\u540d\u65f6&#xff0c;\u9700\u8981\u540c\u65f6\u9650\u5b9a\u5f53\u524d\u6570\u636e\u5e93\u540d\u4e0e\u8868\u540d&#xff0c;\u5e38\u89c4\u5199\u6cd5\u5982\u4e0b&#xff1a;<\/p>\n<p>select group_concat(column_name) from infoorrmation_schema.columns where table_schema&#061;database() and table_name&#061;&#034;users&#034; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"85\" src=\"2026-09-26zonqexffv5u.png\" width=\"865\" \/><\/p>\n<p>\u56fe 28&#xff1a;\u901a\u8fc7 infoorrmation_schema.columns \u83b7\u53d6\u6307\u5b9a\u8868\u5217\u540d\u7ed3\u6784\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"156\" src=\"2026-09-26r2evaudhkfp.png\" width=\"865\" \/><\/p>\n<p>\u56fe 29&#xff1a;\u62a5\u9519\u4fe1\u606f\u660e\u786e\u6307\u5411 near &#039;table_name&#061;&#034;user&#034;),3&#8211;&#039;&#xff0c;\u8bc1\u5b9e and \u6d88\u5931\u5bfc\u81f4\u524d\u540e\u5b50\u53e5\u65e0\u6cd5\u8fde\u63a5\u3002<\/p>\n<p>\u6d4b\u8bd5\u7ed3\u679c&#xff1a;\u9875\u9762\u62a5\u9519 near &#039;table_name&#061;&#034;user&#034;),3&#8211;&#039; LIMIT 0,1\u3002 \u539f\u56e0\u5b9a\u4f4d&#xff1a;\u8bed\u53e5\u4e2d\u7684\u5173\u952e\u5b57 and \u88ab\u5b8c\u5168\u5254\u9664&#xff0c;\u5bfc\u81f4 where table_schema&#061;database() \u4e0e\u540e\u7eed\u7684 table_name&#061;&#034;users&#034; \u5931\u53bb\u903b\u8f91\u8fde\u63a5\u7b26&#xff0c;\u8bed\u6cd5\u7ed3\u6784\u53d1\u751f\u65ad\u88c2\u3002\u540c\u65f6&#xff0c;\u90e8\u5206\u6d4b\u8bd5\u5c06\u8868\u540d\u8bef\u62fc\u5199\u4e3a user&#xff08;\u6b63\u786e\u5e94\u4e3a users&#xff09;\u3002<\/p>\n<p>\u4fee\u590d\u6d4b\u8bd5&#xff1a;\u53cc\u5199\u903b\u8f91\u8bcd aandnd \u5728\u5730\u5740\u680f\u5c06 and \u66ff\u6362\u4e3a\u53cc\u5199\u5b57\u7b26\u4e32 aandnd&#xff0c;\u91cd\u65b0\u63d0\u4ea4&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"164\" src=\"2026-09-26tdv2l2q5i15.png\" width=\"871\" \/><\/p>\n<p>\u56fe 30&#xff1a;\u5bf9\u903b\u8f91\u8fde\u63a5\u8bcd\u5b9e\u65bd\u53cc\u5199\u91cd\u7ec4&#xff0c;\u6062\u590d WHERE \u6761\u4ef6\u7684\u5408\u6cd5\u903b\u8f91\u5173\u7cfb\u3002<\/p>\n<p>\u4fee\u590d\u540e\u67e5\u8be2\u987a\u5229\u6267\u884c&#xff0c;\u5b8c\u6574\u8f93\u51fa\u4e86 users \u8868\u7684\u5404\u4e2a\u5b57\u6bb5\u540d\u79f0\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"440\" src=\"2026-09-26cvaibusvxvr.png\" width=\"865\" \/><\/p>\n<p>\u56fe 31&#xff1a;\u7ed3\u5408\u9776\u573a\u5b9e\u6d4b&#xff0c;\u5bf9\u6bd4\u9762\u8bd5\u5b9e\u5f55\u4e2d\u5173\u4e8e\u4f20\u7edf\u7ed5\u8fc7\u65b9\u5f0f\u7684\u5c40\u9650\u6027\u3002<\/p>\n<p>\u5b9e\u6218\u7ecf\u9a8c\u6c89\u6dc0&#xff1a; \u57fa\u7840\u9ed1\u540d\u5355\u8fc7\u6ee4\u7684\u81f4\u547d\u5f31\u70b9\u5728\u4e8e\u5176\u9759\u6001\u5355\u6b21\u6e05\u6d17\u673a\u5236\u3002\u9632\u5fa1\u65b9\u82e5\u4ec5\u4f9d\u8d56\u5b57\u7b26\u7ea7\u5220\u9664&#xff0c;\u653b\u51fb\u8005\u901a\u8fc7\u6784\u9020\u5d4c\u5957\u540c\u6784\u5b57\u7b26\u4e32&#xff08;\u53cc\u5199&#xff09;\u5373\u53ef\u8f7b\u677e\u7a7f\u900f\u3002\u7136\u800c\u5fc5\u987b\u660e\u786e&#xff0c;\u8fd9\u7c7b\u6280\u672f\u5c5e\u4e8e\u5178\u578b\u7684\u201c\u6559\u5b66\u9776\u573a\u5bf9\u6297\u6280\u672f\u201d&#xff0c;\u5728\u5177\u5907\u62bd\u8c61\u8bed\u6cd5\u6811&#xff08;AST&#xff09;\u91cd\u6784\u80fd\u529b\u7684\u73b0\u4ee3\u5316\u9632\u62a4\u8bbe\u65bd\u4e2d\u4e0d\u5177\u5907\u5b9e\u6218\u5b58\u6d3b\u6027\u3002<\/p>\n<hr \/>\n<h3 id=\"%E4%B8%89%E3%80%81%E6%A1%88%E4%BE%8B%E4%BA%8C%EF%BC%9A%E7%A9%BA%E7%99%BD%E4%B8%8E%E6%B3%A8%E9%87%8A%E5%85%A8%E9%9D%A2%E5%B0%81%E9%94%81%E4%B8%8B%E7%9A%84%E6%9E%81%E9%99%90%E6%9E%84%E9%80%A0%EF%BC%88sqli-labs%20Less-26%20%E6%B7%B1%E5%BA%A6%E5%A4%8D%E7%9B%98%EF%BC%89\">\u4e09\u3001\u6848\u4f8b\u4e8c&#xff1a;\u7a7a\u767d\u4e0e\u6ce8\u91ca\u5168\u9762\u5c01\u9501\u4e0b\u7684\u6781\u9650\u6784\u9020&#xff08;sqli-labs Less-26 \u6df1\u5ea6\u590d\u76d8&#xff09;<\/h3>\n<p>\u5982\u679c\u8bf4 Less-25 \u4ec5\u662f\u9488\u5bf9\u7279\u5b9a\u5173\u952e\u5b57\u7684\u521d\u7ea7\u6e05\u6d17&#xff0c;\u90a3\u4e48 sqli-labs \u7b2c 26 \u5173&#xff08;Less-26&#xff09;\u5219\u6784\u5efa\u4e86\u4e00\u4e2a\u51e0\u4e4e\u5c01\u9501\u6240\u6709\u5e38\u89c4\u5916\u8bbe\u901a\u9053\u7684\u6781\u9650\u8fc7\u6ee4\u573a\u666f\u3002<\/p>\n<h4 id=\"3.1%20%E6%9E%81%E7%AB%AF%E8%BF%87%E6%BB%A4%E8%A7%84%E5%88%99%E5%AE%A1%E6%9F%A5\">3.1 \u6781\u7aef\u8fc7\u6ee4\u89c4\u5219\u5ba1\u67e5<\/h4>\n<p>\u5ba1\u67e5 sqli-labs\/Less-26\/index.php \u4e2d\u7684\u6838\u5fc3\u9ed1\u540d\u5355\u903b\u8f91&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"451\" src=\"2026-09-26ge3jhy2r5di.png\" width=\"865\" \/><\/p>\n<p>\u56fe 32&#xff1a;Less-26 \u6e90\u7801\u6784\u5efa\u4e86\u9488\u5bf9\u903b\u8f91\u8bcd\u3001\u5e38\u89c1\u6ce8\u91ca\u7b26\u3001\u7a7a\u767d\u5b57\u7b26\u53ca\u53cd\u659c\u6760\u7684\u7ec4\u5408\u6b63\u5219\u6e05\u6d17\u4f53\u7cfb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"278\" src=\"2026-09-26s2i2vuxjcoi.png\" width=\"764\" \/><\/p>\n<p>\u56fe 33&#xff1a;\u7279\u5199\u9ad8\u4eae\u5c55\u793a\u9ed1\u540d\u5355\u51fd\u6570\u5bf9 [\\\\s] \u53ca\u659c\u6760\u5b57\u7b26\u7684\u5904\u7406\u65b9\u5f0f\u3002<\/p>\n<p>\u63d0\u53d6\u6838\u5fc3\u8fc7\u6ee4\u89c4\u5219\u5982\u4e0b&#xff1a;<\/p>\n<p>function blacklist($id)<br \/>\n{<br \/>\n    $id &#061; preg_replace(&#039;\/or\/i&#039;, &#034;&#034;, $id);       \/\/ \u5254\u9664 or<br \/>\n    $id &#061; preg_replace(&#039;\/and\/i&#039;, &#034;&#034;, $id);      \/\/ \u5254\u9664 and<br \/>\n    $id &#061; preg_replace(&#039;\/[\\\\\/\\\\*]\/&#039;, &#034;&#034;, $id);    \/\/ \u5254\u9664 \/*<br \/>\n    $id &#061; preg_replace(&#039;\/[&#8211;]\/&#039;, &#034;&#034;, $id);      \/\/ \u5254\u9664 &#8212;<br \/>\n    $id &#061; preg_replace(&#039;\/[#]\/&#039;, &#034;&#034;, $id);       \/\/ \u5254\u9664 #<br \/>\n    $id &#061; preg_replace(&#039;\/[\\\\s]\/&#039;, &#034;&#034;, $id);      \/\/ \u5254\u9664\u6240\u6709\u7a7a\u767d\u5b57\u7b26&#xff08;\u7a7a\u683c\u3001\u6362\u884c\u3001\u5236\u8868\u7b26\u7b49&#xff09;<br \/>\n    $id &#061; preg_replace(&#039;\/[\\\\\/\\\\\\\\]\/&#039;, &#034;&#034;, $id);  \/\/ \u5254\u9664\u6b63\u53cd\u659c\u6760<br \/>\n    return $id;<br \/>\n} <\/p>\n<p>\u6280\u672f\u7ea6\u675f\u68b3\u7406&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u903b\u8f91\u8fd0\u7b97\u7b26\u5168\u9762\u5c01\u9501&#xff1a;or \u4e0e and \u5747\u88ab\u5f3a\u5236\u5254\u9664\u3002<\/p>\n<\/li>\n<li>\n<p>\u7269\u7406\u6ce8\u91ca\u7b26\u5168\u9762\u5c01\u9501&#xff1a;\/*\u3001&#8211;\u3001# \u5168\u90e8\u88ab\u6e05\u6d17&#xff0c;\u610f\u5473\u7740\u8f7d\u8377\u5c3e\u90e8\u65e0\u6cd5\u518d\u4f7f\u7528\u4f20\u7edf\u6ce8\u91ca\u624b\u6bb5\u622a\u65ad\u539f SQL \u7684\u5269\u4f59\u90e8\u5206\u3002<\/p>\n<\/li>\n<li>\n<p>\u6240\u6709\u7a7a\u767d\u7b26\u5f7b\u5e95\u6e05\u9664&#xff1a;\u6b63\u5219 [\\\\s] \u80fd\u591f\u5339\u914d ASCII \u4e2d\u7684\u6240\u6709\u6807\u51c6\u7a7a\u767d\u5b57\u7b26&#xff08;\u5305\u62ec\u7a7a\u683c\u3001 \u5236\u8868\u7b26\u3001 \u56de\u8f66\u7b26\u3001 \u6362\u884c\u7b26\u7b49&#xff09;\u3002<\/p>\n<\/li>\n<\/ul>\n<p>\u8fdb\u884c\u5355\u5f15\u53f7\u6d4b\u8bd5&#xff0c;\u786e\u8ba4\u4ecd\u7136\u5b58\u5728\u57fa\u4e8e\u62a5\u9519\u7684\u56de\u663e\u53cd\u9988&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-26\/?id&#061;1&#039; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"430\" src=\"2026-09-26smdbpbjgmrc.png\" width=\"865\" \/><\/p>\n<p>\u56fe 34&#xff1a;\u9875\u9762\u6807\u8bed\u201cAll Your Spaces and Comments belong to us\u201d\u660e\u786e\u6307\u660e\u7a7a\u767d\u4e0e\u6ce8\u91ca\u5747\u53d7\u7ba1\u8f96\u3002<\/p>\n<h4 id=\"3.2%20%E7%A9%BA%E7%99%BD%E5%AD%97%E7%AC%A6%E4%B8%8E%E6%B3%A8%E9%87%8A%E6%9B%BF%E4%BB%A3%E6%96%B9%E6%A1%88%E7%9A%84%E8%BF%9E%E7%8E%AF%E6%8C%AB%E8%B4%A5\">3.2 \u7a7a\u767d\u5b57\u7b26\u4e0e\u6ce8\u91ca\u66ff\u4ee3\u65b9\u6848\u7684\u8fde\u73af\u632b\u8d25<\/h4>\n<p>\u82e5\u76f4\u63a5\u5c1d\u8bd5\u4f20\u7edf\u7684\u8054\u5408\u67e5\u8be2&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-26\/?id&#061;-1&#039; union select 1,2,3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"104\" src=\"2026-09-26prqss24dkrf.png\" width=\"1364\" \/><\/p>\n<p>\u56fe 35&#xff1a;\u672a\u505a\u4efb\u4f55\u89c4\u907f\u5904\u7406\u7684\u8054\u5408\u67e5\u8be2\u8f7d\u8377&#xff0c;\u5fc5\u7136\u88ab\u8fc7\u6ee4\u89c4\u5219\u6574\u4f53\u7c89\u788e\u3002<\/p>\n<p>\u6240\u6709\u7a7a\u683c\u88ab\u6e05\u7a7a\u5bfc\u81f4\u5173\u952e\u5b57\u7c98\u8fde\u4e3a unionselect&#xff0c;\u6ce8\u91ca\u7b26\u88ab\u79fb\u9664\u5bfc\u81f4\u5c3e\u90e8\u5355\u5f15\u53f7\u5f15\u53d1\u8bed\u6cd5\u5d29\u6e83\u3002<\/p>\n<p>\u5931\u8d25\u5c1d\u8bd5 1&#xff1a;\u5185\u8054\u6ce8\u91ca \/**\/ \u5c1d\u8bd5\u5229\u7528\u5185\u8054\u6ce8\u91ca\u4ee3\u66ff\u7a7a\u683c&#xff1a;<\/p>\n<p>-1&#039; union\/**\/select 1,2,3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"112\" src=\"2026-09-262zn13fsl3oi.png\" width=\"821\" \/><\/p>\n<p>\u56fe 36&#xff1a;\u5728\u5730\u5740\u680f\u4f7f\u7528\u7ecf\u5178 SQL \u5185\u8054\u6ce8\u91ca\u5c1d\u8bd5\u9694\u5f00\u5173\u952e\u5b57\u3002<\/p>\n<p>\u6d4b\u8bd5\u7ed3\u679c&#xff1a;\u5931\u8d25\u3002 \u539f\u56e0\u5206\u6790&#xff1a;\u6e90\u7801\u4e2d\u663e\u5f0f\u5b9a\u4e49\u4e86 preg_replace(&#039;\/[\\\\\/\\\\*]\/&#039;, &#034;&#034;, $id)&#xff0c;\u76f4\u63a5\u5c06 \/* \u6e05\u7406\u5e72\u51c0\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"288\" src=\"2026-09-2635imxyfbix4.png\" width=\"723\" \/><\/p>\n<p>\u56fe 37&#xff1a;\u6e90\u7801\u5ba1\u8ba1\u8bc1\u5b9e\u5185\u8054\u6ce8\u91ca\u7b26\u5904\u4e8e\u4e25\u683c\u9ed1\u540d\u5355\u4e4b\u4e2d\u3002<\/p>\n<p>\u5931\u8d25\u5c1d\u8bd5 2&#xff1a;URL \u9690\u5f0f\u7a7a\u767d\u7f16\u7801&#xff08;%0a\u3001%a0\u3001&#043;&#xff09; \u8bb2\u5e08\u5728\u4ee3\u7801\u4e2d\u68b3\u7406\u4e86\u5e38\u89c1\u7684 URL \u7f16\u7801\u7a7a\u767d\u66ff\u4ee3\u7b26&#xff1a;%0a&#xff08;\u6362\u884c&#xff09;\u3001%0b&#xff08;\u5782\u76f4\u5236\u8868&#xff09;\u3001%0c&#xff08;\u6362\u9875&#xff09;\u3001%0d&#xff08;\u56de\u8f66&#xff09;\u3001%09&#xff08;\u6c34\u5e73\u5236\u8868&#xff09;\u3001%a0&#xff08;\u4e0d\u6362\u884c\u7a7a\u683c&#xff09;\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"146\" src=\"2026-09-26ivfhk0gertv.png\" width=\"802\" \/><\/p>\n<p>\u56fe 38&#xff1a;\u68b3\u7406\u5c1d\u8bd5\u6e05\u5355&#xff1a;%0a\u3001%0b\u3001%0c\u3001%0d\u3001%09 \u4ee5\u53ca %a0\u3002<\/p>\n<p>\u6d4b\u8bd5\u63d0\u4ea4 %a0&#xff1a;<\/p>\n<p>-1&#039; union%a0select 1,2,3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"138\" src=\"2026-09-26poameghq1dm.png\" width=\"1051\" \/><\/p>\n<p>\u56fe 39&#xff1a;\u5c1d\u8bd5\u5229\u7528\u975e\u6807\u51c6\u7a7a\u767d\u5b57\u7b26 %a0 \u7a7f\u900f\u8fc7\u6ee4\u673a\u5236\u3002<\/p>\n<p>\u7ed3\u679c\u5206\u6790&#xff1a;\u5728 Windows\/PHP \u73af\u5883\u4e0b&#xff0c;%a0 \u672a\u88ab MySQL \u89c6\u4e3a\u5408\u6cd5\u5206\u9694\u7b26&#xff0c;\u89e3\u6790\u5448\u73b0\u4e3a\u4e0d\u53ef\u89c1\u5f02\u5e38\u5b57\u7b26&#xff1b;\u800c\u9488\u5bf9 %0a \u7b49\u6807\u51c6\u5b57\u7b26&#xff0c;\u7531\u4e8e PHP \u6b63\u5219\u4e2d [\\\\s] \u5b8c\u6574\u56ca\u62ec\u4e86\u7a7a\u767d\u7b26\u96c6\u5408&#xff0c;\u6240\u6709\u6362\u884c\u7b26\u5747\u88ab\u7cbe\u786e\u5254\u9664\u3002 \u7d27\u63a5\u7740\u6d4b\u8bd5\u4f7f\u7528 URL \u6807\u51c6\u52a0\u53f7 &#043;&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"214\" src=\"2026-09-26sqw5vdflula.png\" width=\"1015\" \/><\/p>\n<p>\u56fe 40&#xff1a;\u62a5\u9519\u4fe1\u606f near &#039;unionselect1,2,3&#039; \u8bc1\u5b9e\u52a0\u53f7\u5728\u88ab\u670d\u52a1\u7aef\u89e3\u6790\u4e3a\u7a7a\u683c\u540e&#xff0c;\u88ab [\\\\s] \u6e05\u9664\u5bfc\u81f4\u5b57\u7b26\u7c98\u8fde\u3002<\/p>\n<p>\u673a\u7406\u62c6\u89e3&#xff1a;\u6d4f\u89c8\u5668\u53d1\u9001 &#043;&#xff0c;Web \u5bb9\u5668&#xff08;Apache\/Nginx&#xff09;\u5728\u8fdb\u5165 PHP \u4e1a\u52a1\u811a\u672c\u524d\u5c06\u5176\u6807\u51c6\u53cd\u7f16\u7801\u4e3a ASCII \u7a7a\u683c&#xff1b;\u968f\u540e\u811a\u672c\u4e2d\u7684 [\\\\s] \u6b63\u5219\u6355\u83b7\u8be5\u7a7a\u683c\u5e76\u5c06\u5176\u5b8c\u5168\u6e05\u9664&#xff0c;\u6700\u7ec8\u4f9d\u7136\u5bfc\u81f4 unionselect \u5b57\u7b26\u7c98\u8fde\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"237\" src=\"2026-09-26e1murrl2zg4.png\" width=\"934\" \/><\/p>\n<p>\u56fe 41&#xff1a;\u6392\u67e5\u53d1\u73b0\u4e0d\u4ec5\u5206\u9694\u7b26\u5931\u6548&#xff0c;\u5c3e\u90e8\u7684\u7269\u7406\u6ce8\u91ca\u540c\u6837\u65e0\u6cd5\u53d1\u6325\u4f5c\u7528\u3002<\/p>\n<h4 id=\"3.3%20%E6%B3%A8%E9%87%8A%E7%BB%95%E8%BF%87%E6%80%9D%E8%B7%AF%E8%BD%AC%E5%8F%98%EF%BC%9A%E6%94%BE%E5%BC%83%E6%B3%A8%E9%87%8A%E7%AC%A6%EF%BC%8C%E8%BD%AC%E5%90%91%E6%9E%84%E9%80%A0%E9%80%BB%E8%BE%91%E9%97%AD%E5%90%88\">3.3 \u6ce8\u91ca\u7ed5\u8fc7\u601d\u8def\u8f6c\u53d8&#xff1a;\u653e\u5f03\u6ce8\u91ca\u7b26&#xff0c;\u8f6c\u5411\u6784\u9020\u903b\u8f91\u95ed\u5408<\/h4>\n<p>\u7531\u4e8e\u6240\u6709\u7269\u7406\u6ce8\u91ca\u7b26\u5168\u90e8\u88ab\u5254\u9664&#xff0c;\u8bb2\u5e08\u786e\u7acb\u4e86\u65b0\u7684\u8c03\u8bd5\u539f\u5219&#xff1a;\u653e\u5f03\u7269\u7406\u622a\u65ad&#xff0c;\u901a\u8fc7\u903b\u8f91\u8fd0\u7b97\u7b26\u624b\u5de5\u95ed\u5408\u539f SQL \u8bed\u53e5\u7684\u5c3e\u90e8\u5355\u5f15\u53f7\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"129\" src=\"2026-09-26lkhhrt3hq0a.png\" width=\"1048\" \/><\/p>\n<p>*\u56fe 42&#xff1a;\u8bb0\u5f55\u95ed\u5408\u516c\u5f0f\u8bbe\u8ba1&#xff1a;select * from users id&#061;&#039;1&#039; union select 1,2,3 and &#039;1&#039;&#061;&#039;1&#039;\u3002*<\/p>\n<p>\u539f SQL \u8bed\u53e5\u9aa8\u67b6\u4e3a&#xff1a;SELECT * FROM users WHERE id&#061;&#039;$id&#039; LIMIT 0,1\u3002 \u82e5\u6ce8\u5165\u8f7d\u8377\u8bbe\u8ba1\u4e3a&#xff1a;<\/p>\n<p>-1&#039; union select 1,2,3 aandnd &#039;1&#039;&#061;&#039;1 <\/p>\n<p>\u5f53\u539f\u8bed\u53e5\u5c3e\u90e8\u7684\u5355\u5f15\u53f7\u4e0e\u95ed\u5408\u8f7d\u8377\u672b\u5c3e\u7ed3\u5408\u65f6&#xff0c;\u5c06\u5728\u7406\u8bba\u4e0a\u5f62\u6210 and &#039;1&#039;&#061;&#039;1&#039; LIMIT 0,1 \u7684\u5408\u6cd5\u8868\u8fbe\u5f0f\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"132\" src=\"2026-09-26lt4sdlrtwbh.png\" width=\"876\" \/><\/p>\n<p>\u56fe 43&#xff1a;\u5728\u5730\u5740\u680f\u7ed3\u5408\u53cc\u5199\u903b\u8f91\u8bcd aandnd \u4e0e\u5355\u5f15\u53f7\u95ed\u5408\u8868\u8fbe\u5f0f\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"203\" src=\"2026-09-26r54s3nipo0t.png\" width=\"753\" \/><\/p>\n<p>\u56fe 44&#xff1a;\u62a5\u9519\u4fe1\u606f\u6307\u51fa near &#039;union?select?1,2,3and&#039;1&#039;&#061;&#039;1&#039;&#xff0c;\u5b57\u6bb5 3 \u4e0e and \u4e4b\u95f4\u65e0\u7a7a\u767d\u53d1\u751f\u7c98\u8fde\u3002<\/p>\n<p>\u62a5\u9519\u5206\u6790&#xff1a;\u5c3d\u7ba1\u53cc\u5199\u6210\u529f\u91cd\u7ec4\u51fa\u4e86 and&#xff0c;\u4f46\u7531\u4e8e\u6570\u5b57 3 \u4e0e and \u4e4b\u95f4\u7f3a\u4e4f\u7a7a\u683c&#xff0c;\u88ab\u89e3\u6790\u5f15\u64ce\u62fc\u63a5\u6210\u4e86\u975e\u6cd5\u7684\u8bcd\u6cd5\u5355\u5143 3and\u3002<\/p>\n<p>\u5c1d\u8bd5\u5229\u7528\u62ec\u53f7\u9694\u79bb&#xff1a; \u4e3a\u89e3\u51b3\u5b57\u7b26\u7c98\u8fde\u95ee\u9898&#xff0c;\u5c1d\u8bd5\u4e3a\u903b\u8f91\u8868\u8fbe\u5f0f\u6dfb\u52a0\u62ec\u53f7&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"173\" src=\"2026-09-26zmyu2xbkdgy.png\" width=\"865\" \/><\/p>\n<p>\u56fe 45&#xff1a;\u8bd5\u56fe\u5229\u7528\u62ec\u53f7\u9694\u79bb\u903b\u8f91\u8868\u8fbe\u5f0f\u4e2d\u7684\u5b57\u7b26\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"209\" src=\"2026-09-26hfeupyctllr.png\" width=\"544\" \/><\/p>\n<p>\u56fe 46&#xff1a;\u5fae\u8c03\u5c3e\u90e8\u62ec\u53f7\u4e0e\u5355\u5f15\u53f7\u7684\u5d4c\u5957\u5173\u7cfb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"179\" src=\"2026-09-26h3qft1we5oc.png\" width=\"1091\" \/><\/p>\n<p>\u56fe 47&#xff1a;\u5c1d\u8bd5\u901a\u8fc7\u5c06\u903b\u8f91\u8bcd\u81ea\u8eab\u52a0\u62ec\u53f7 (aandnd) \u5b9e\u73b0\u8fb9\u754c\u9694\u79bb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"222\" src=\"2026-09-2605r0dpe0lpm.png\" width=\"1085\" \/><\/p>\n<p>\u56fe 48&#xff1a;\u62a5\u9519\u4fe1\u606f\u663e\u793a\u5728\u62ec\u53f7\u8fb9\u754c\u5904\u4f9d\u7136\u5b58\u5728\u8bed\u6cd5\u51b2\u7a81\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"175\" src=\"2026-09-26w1slrvnr3dz.png\" width=\"865\" \/><\/p>\n<p>\u56fe 49&#xff1a;\u5c1d\u8bd5\u5bf9 union \u4e0e select \u5206\u522b\u52a0\u62ec\u53f7\u8fdb\u884c\u8bcd\u6cd5\u9694\u79bb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"100\" src=\"2026-09-26fb51z42vazx.png\" width=\"873\" \/><\/p>\n<p>\u56fe 50&#xff1a;\u7279\u5199\u5c55\u793a\u9488\u5bf9\u8054\u5408\u67e5\u8be2\u5173\u952e\u8bcd\u7684\u62ec\u53f7\u5d4c\u5957\u5b9e\u9a8c\u3002<\/p>\n<p>\u5c1d\u8bd5\u53cc\u91cd URL \u7f16\u7801\u7ed5\u8fc7\u7a7a\u683c&#xff1a; \u8bb2\u5e08\u63a8\u6d4b\u80fd\u5426\u5229\u7528 URL \u7f16\u7801\u7684\u53cc\u91cd\u5d4c\u5957\u5b9e\u73b0\u7a7a\u683c\u91cd\u7ec4&#xff0c;\u4f8b\u5982\u6784\u9020 %2%200&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"150\" src=\"2026-09-26mbrhqitpfv3.png\" width=\"1218\" \/><\/p>\n<p>\u56fe 51&#xff1a;\u8bbe\u8ba1\u7406\u5ff5\u4e3a\u5916\u5c42\u89e3\u7801\u540e\u91ca\u653e %20&#xff0c;\u671f\u671b\u9003\u9038\u540e\u91cd\u65b0\u7ec4\u5408\u6210\u7a7a\u683c\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"462\" src=\"2026-09-26gzphtkgya2r.png\" width=\"865\" \/><\/p>\n<p>\u56fe 52&#xff1a;\u9875\u9762\u660e\u786e\u56de\u663e Hint: 1&#039;%20unionselect&#xff0c;\u8bc1\u5b9e %20 \u88ab\u4f5c\u4e3a\u5b57\u9762\u91cf\u4f20\u5165&#xff0c;\u672a\u88ab\u7b2c\u4e8c\u6b21\u89e3\u7801\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"89\" src=\"2026-09-26fqjy3s4paqs.png\" width=\"1040\" \/><\/p>\n<p>\u56fe 53&#xff1a;\u5730\u5740\u680f\u4e2d\u672a\u88ab\u8bc6\u522b\u7684\u7f16\u7801\u5b57\u9762\u91cf\u7279\u5199\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"171\" src=\"2026-09-26xcjr24v5ryk.png\" width=\"1434\" \/><\/p>\n<p>\u56fe 54&#xff1a;\u5168\u9762\u8986\u76d6\u6d4b\u8bd5\u53cc\u91cd\u7f16\u7801&#xff0c;\u6700\u7ec8\u8bc1\u5b9e\u8be5\u601d\u8def\u5728\u5f53\u524d\u67b6\u6784\u4e0b\u4e0d\u53ef\u884c\u3002<\/p>\n<p>\u5f52\u56e0\u89e3\u6790&#xff1a;Web \u5bb9\u5668\u4ec5\u5bf9\u5916\u90e8\u8f93\u5165\u6267\u884c\u4e00\u6b21\u6807\u51c6 URL \u89e3\u7801\u3002%2%200 \u4e2d\u7684\u4e2d\u95f4\u90e8\u5206 %20 \u88ab\u89e3\u7801\u4e3a\u4e00\u4e2a\u7a7a\u683c\u540e&#xff0c;\u88ab [\\\\s] \u6e05\u7406&#xff1b;\u800c\u4e24\u4fa7\u6b8b\u7559\u7684\u5b57\u7b26\u62fc\u63a5\u4e3a\u5b57\u9762\u91cf %20\u3002\u7531\u4e8e MySQL \u6570\u636e\u5e93\u5185\u90e8\u4e0d\u4f1a\u5bf9 SQL \u8bed\u53e5\u4e8c\u6b21\u6267\u884c URL \u89e3\u7801&#xff0c;\u8be5\u5b57\u9762\u91cf\u88ab\u76f4\u63a5\u5224\u5b9a\u4e3a\u8bed\u6cd5\u9519\u8bef\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"342\" src=\"2026-09-26amjnesaxetn.png\" width=\"1126\" \/><\/p>\n<p>\u56fe 55&#xff1a;\u518d\u6b21\u5ba1\u89c6 [\\\\s] \u89c4\u5219&#xff0c;\u786e\u8ba4\u5b57\u7b26\u4e32\u6e05\u6d17\u5c42\u4e0d\u5b58\u5728\u4efb\u4f55\u4f20\u7edf\u7f16\u7801\u7ed5\u8fc7\u7684\u7f1d\u9699\u3002<\/p>\n<h4 id=\"3.4%20%E5%BC%95%E5%85%A5%E8%BE%85%E5%8A%A9%E7%A0%94%E5%88%A4%E5%B7%A5%E5%85%B7%E4%B8%8E%E8%AE%A4%E7%9F%A5%E6%A0%A1%E5%87%86\">3.4 \u5f15\u5165\u8f85\u52a9\u7814\u5224\u5de5\u5177\u4e0e\u8ba4\u77e5\u6821\u51c6<\/h4>\n<p>\u5728\u8fde\u7eed\u6d4b\u8bd5\u9677\u5165\u50f5\u5c40\u540e&#xff0c;\u8bb2\u5e08\u501f\u52a9 AI \u5bf9\u8bdd\u6a21\u578b&#xff08;DeepSeek&#xff09;\u9488\u5bf9\u8be5\u6bb5\u9ed1\u540d\u5355\u8fc7\u6ee4\u4ee3\u7801\u5c55\u5f00\u4e86\u89c4\u5219\u9a8c\u8bc1&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"350\" src=\"2026-09-26rahii44tfrs.png\" width=\"865\" \/><\/p>\n<p>\u56fe 56&#xff1a;\u660e\u786e\u5411\u6a21\u578b\u6307\u51fa\u65e0\u6cd5\u7ed5\u8fc7 \\\\s \u7a7a\u767d\u8fc7\u6ee4&#xff0c;\u63a2\u8ba8\u5982\u4f55\u4f7f\u7528\u62ec\u53f7\u5b9e\u73b0\u7a7a\u683c\u6d88\u9664\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"353\" src=\"2026-09-26pbhu1g5rti4.png\" width=\"728\" \/><\/p>\n<p>\u56fe 57&#xff1a;\u6a21\u578b\u5206\u6790\u6307\u51fa MySQL \u5141\u8bb8\u5728\u5173\u952e\u5b57\u4e0e\u62ec\u53f7\u4e4b\u95f4\u514d\u9664\u7a7a\u683c&#xff0c;\u63a8\u8350\u4f7f\u7528\u62ec\u53f7\u5b50\u67e5\u8be2\u7ed3\u6784\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"248\" src=\"2026-09-26vftbc2rj0ex.png\" width=\"641\" \/><\/p>\n<\/p>\n<p>\u56fe 58&#xff1a;\u6a21\u578b\u5217\u4e3e\u4e86\u52a0\u53f7\u3001\u53d6\u53cd\u7b26\u53f7&#xff08;~&#xff09;\u53ca -1union(select(1),2,3) \u7684\u53c2\u8003\u7ed3\u6784\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"317\" src=\"2026-09-26elkg4bxputj.png\" width=\"783\" \/><\/p>\n<p>\u56fe 59&#xff1a;\u91cd\u70b9\u5c55\u793a\u5229\u7528 -1union(select(1),(2),(3)) \u89c4\u907f\u7a7a\u683c\u7684\u6807\u51c6\u8303\u4f8b\u3002<\/p>\n<p>\u6a21\u578b\u7ed9\u51fa\u7684\u5173\u952e\u6d1e\u5bdf\u4e0e\u8bb2\u5e08\u7684\u8bbe\u8ba1\u65b9\u5411\u4e00\u81f4&#xff1a;\u5728 MySQL \u8bed\u6cd5\u89c4\u8303\u4e2d&#xff0c;\u5706\u62ec\u53f7 () \u672c\u8eab\u5177\u5907\u64cd\u4f5c\u7b26\u4e0e\u8fb9\u754c\u754c\u5b9a\u529f\u80fd&#xff0c;\u5173\u952e\u5b57\u4e0e\u62ec\u53f7\u4e4b\u95f4\u3001\u62ec\u53f7\u4e0e\u6570\u503c\u4e4b\u95f4\u5b8c\u5168\u65e0\u9700\u4f9d\u8d56\u7a7a\u683c\u5206\u9694\u3002<\/p>\n<p>\u7136\u800c&#xff0c;\u5f53\u8bb2\u5e08\u5c06 AI \u7ed9\u51fa\u7684\u53c2\u8003\u8f7d\u8377\u76f4\u63a5\u5957\u5165\u6d4f\u89c8\u5668\u65f6&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-26\/?id&#061;-1&#039;union(select(1),(2),(3))aandnd&#039;1&#039;&#061;&#039;1 <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"120\" src=\"2026-09-26lwazymks5vt.png\" width=\"777\" \/><\/p>\n<p>\u56fe 60&#xff1a;\u5c06\u62ec\u53f7\u9694\u79bb\u8bed\u6cd5\u4e0e\u53cc\u5199\u903b\u8f91\u95ed\u5408\u7ec4\u5408\u540e\u53d1\u8d77\u8bf7\u6c42\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"126\" src=\"2026-09-26hko2gnyiabu.png\" width=\"854\" \/><\/p>\n<p>\u56fe 61&#xff1a;\u8bb0\u5f55 id&#061;&#039;1&#039; union select 1,2,3 and &#039;1&#039;&#061;&#039;1&#039; \u7684\u903b\u8f91\u7ed3\u6784\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"120\" src=\"2026-09-26pr34smwrqms.png\" width=\"777\" \/><\/p>\n<p>\u56fe 62&#xff1a;\u7ee7\u7eed\u6d4b\u8bd5\u8be5\u8f7d\u8377\u5728\u6d4f\u89c8\u5668\u7aef\u7684\u6267\u884c\u53cd\u9988\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"149\" src=\"2026-09-26zgnmizpjw11.png\" width=\"1739\" \/><\/p>\n<p>\u56fe 63&#xff1a;\u5c06\u8f93\u5165\u8c03\u6574\u4e3a id&#061;111&#039; \u786e\u4fdd\u4e3b\u67e5\u8be2\u7ed3\u679c\u96c6\u4e3a\u7a7a\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"73\" src=\"2026-09-26zdia1x4jzlr.png\" width=\"1711\" \/><\/p>\n<p>\u56fe 64&#xff1a;\u5c1d\u8bd5\u4f7f\u7528\u7a7a\u5b57\u8282 %00; \u5b9e\u65bd\u622a\u65ad&#xff0c;\u56e0\u73b0\u4ee3\u9ad8\u7248\u672c\u73af\u5883\u5931\u6548\u3002<\/p>\n<p>\u6d4f\u89c8\u5668\u7aef\u4f9d\u7136\u6301\u7eed\u62a5\u9519&#xff0c;\u65e0\u6cd5\u5b9a\u4f4d\u6df1\u5c42\u8bed\u6cd5\u51b2\u7a81\u6240\u5728\u3002<\/p>\n<h4 id=\"3.5%20%E5%88%87%E6%8D%A2%E5%BA%95%E5%B1%82%E7%8E%AF%E5%A2%83%EF%BC%9A%E6%9C%AC%E5%9C%B0%20MySQL%20%E5%91%BD%E4%BB%A4%E8%A1%8C%E7%B2%BE%E5%87%86%E6%8E%92%E9%94%99%E4%B8%8E%E6%8A%80%E6%9C%AF%E8%BD%AC%E6%8A%98\">3.5 \u5207\u6362\u5e95\u5c42\u73af\u5883&#xff1a;\u672c\u5730 MySQL \u547d\u4ee4\u884c\u7cbe\u51c6\u6392\u9519\u4e0e\u6280\u672f\u8f6c\u6298<\/h4>\n<p>\u4e3a\u5f7b\u5e95\u6446\u8131 Web \u670d\u52a1\u7aef\u4e0e PHP \u6b63\u5219\u6e05\u6d17\u53ef\u80fd\u5e26\u6765\u7684\u5e72\u6270&#xff0c;\u8bb2\u5e08\u5207\u6362\u81f3\u672c\u5730 Windows \u547d\u4ee4\u884c\u73af\u5883\u4e0b\u7684 MySQL \u7ec8\u7aef&#xff0c;\u76f4\u9762\u6570\u636e\u5e93\u5e95\u5c42\u89e3\u6790\u5f15\u64ce&#xff0c;\u5c55\u5f00\u7eaf\u7cb9\u7684 SQL \u8bed\u6cd5\u8c03\u8bd5\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"413\" src=\"2026-09-26qhpcowtvhgo.png\" width=\"748\" \/><\/p>\n<p>\u56fe 65&#xff1a;\u767b\u5f55 root \u6743\u9650 MySQL \u7ec8\u7aef&#xff0c;\u9009\u62e9 security \u6570\u636e\u5e93\u8fdb\u884c\u72ec\u7acb\u8bed\u53e5\u6d4b\u8bd5\u3002<\/p>\n<p>\u5728\u547d\u4ee4\u884c\u4e2d\u76f4\u63a5\u8f93\u5165\u6d4b\u8bd5\u8bed\u53e5&#xff1a;<\/p>\n<p>select * from users where id&#061;-1&#039;union(select(1),(2),(3)); <\/p>\n<p>\u7ec8\u7aef\u7acb\u5373\u8fd4\u56de\u63d0\u793a\u7b26 &#039;&gt;&#xff0c;\u8868\u660e\u5b57\u7b26\u4e32\u5355\u5f15\u53f7\u672a\u5b8c\u6210\u95ed\u5408&#xff0c;\u8bed\u53e5\u5904\u4e8e\u6302\u8d77\u7b49\u5f85\u72b6\u6001\u3002\u8bb2\u5e08\u4f7f\u7528 Ctrl &#043; C \u4e2d\u65ad\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"227\" src=\"2026-09-260er5cmipmat.png\" width=\"570\" \/><\/p>\n<p>\u56fe 66&#xff1a;\u591a\u8f6e\u5c1d\u8bd5\u5747\u89e6\u53d1\u6362\u884c\u7b49\u5f85\u63d0\u793a\u7b26&#xff0c;\u660e\u786e\u66b4\u9732\u4e86\u95ed\u5408\u7ed3\u6784\u672a\u95ed\u5408\u7684\u672c\u8d28\u3002<\/p>\n<p>\u8bb2\u5e08\u5c1d\u8bd5\u6dfb\u52a0\u5c3e\u90e8\u95ed\u5408\u903b\u8f91&#xff1a;<\/p>\n<p>select * from users where id&#061;&#039;-1&#039;union(select(1),(2),(3)) and &#039;1&#039;&#061;&#039;1&#039;; <\/p>\n<p>\u6b64\u65f6 MySQL \u547d\u4ee4\u884c\u629b\u51fa\u4e86\u51b3\u5b9a\u6027\u7684\u9519\u8bef\u65e5\u5fd7&#xff1a;<\/p>\n<p>ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near &#039;and &#039;1&#039;&#061;&#039;1&#039;&#039; at line 1 <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"200\" src=\"2026-09-26oy5543rr44i.png\" width=\"813\" \/><\/p>\n<p>\u56fe 67&#xff1a;\u7ec8\u7aef\u6392\u9519\u5173\u952e\u5e27&#xff1a;\u660e\u786e\u6307\u51fa\u9519\u8bef\u53d1\u751f\u4e8e union \u62ec\u53f7\u540e\u7684 and &#039;1&#039;&#061;&#039;1&#039;\u3002<\/p>\n<p>\u5e95\u5c42\u8bed\u6cd5\u6839\u56e0\u89e3\u5bc6&#xff1a; \u5728\u6807\u51c6 SQL \u8bed\u6cd5\u89c4\u8303\u4e2d&#xff0c;UNION \u64cd\u4f5c\u7b26\u7528\u4e8e\u5408\u5e76\u4e24\u4e2a\u72ec\u7acb\u7684 SELECT \u7ed3\u679c\u96c6&#xff1a; SELECT &#8230; UNION (SELECT &#8230;)\u3002 \u5f53\u5728\u7b2c\u4e8c\u4e2a\u88ab\u62ec\u53f7\u5305\u88f9\u7684\u5b50\u67e5\u8be2 (SELECT &#8230;) \u5916\u90e8\u76f4\u63a5\u8ffd\u52a0 AND &#039;1&#039;&#061;&#039;1&#039; \u65f6&#xff0c;\u89e3\u6790\u5f15\u64ce\u65e0\u6cd5\u8bc6\u522b\u8be5 AND \u6761\u4ef6\u5c5e\u4e8e\u54ea\u4e00\u4e2a\u67e5\u8be2\u2014\u2014\u5b83\u65e2\u4e0d\u80fd\u6302\u8f7d\u7ed9\u7b2c\u4e00\u4e2a SELECT&#xff0c;\u4e5f\u4e0d\u80fd\u5728 UNION \u7ed3\u675f\u540e\u4f5c\u4e3a\u5168\u5c40\u8fc7\u6ee4\u6761\u4ef6\u5b58\u5728&#xff0c;\u56e0\u6b64\u76f4\u63a5\u89e6\u53d1 1064 \u8bed\u6cd5\u9519\u8bef&#xff01;<\/p>\n<p>\u91cd\u5927\u6280\u672f\u8f6c\u6298\u70b9&#xff1a; \u73b0\u573a\u5b66\u5458\u4e0e\u8bb2\u5e08\u5171\u540c\u6355\u6349\u5230\u4e86\u8fd9\u4e00\u8bed\u6cd5\u7279\u6027&#xff1a;\u5fc5\u987b\u5c06\u5c3e\u90e8\u95ed\u5408\u8868\u8fbe\u5f0f and &#039;1&#039;&#061;&#039;1&#039; \u79fb\u5165\u7b2c\u4e8c\u4e2a\u5b50\u67e5\u8be2\u5185\u90e8&#xff0c;\u4f5c\u4e3a\u5176\u67d0\u4e2a\u5b57\u6bb5\u672c\u8eab\u7684\u5e03\u5c14\/\u7b97\u672f\u8868\u8fbe\u5f0f&#xff01;<\/p>\n<p>\u8bb2\u5e08\u7acb\u5373\u91cd\u6784 SQL \u547d\u4ee4&#xff0c;\u5c06\u903b\u8f91\u95ed\u5408\u5199\u5165\u7b2c 3 \u4e2a\u67e5\u8be2\u5b57\u6bb5\u5185&#xff1a;<\/p>\n<p>select * from users where id&#061;&#039;-1&#039; union(select(1),(2),(3) and &#039;1&#039;&#061;&#039;1&#039;); <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"216\" src=\"2026-09-26ypgieu114ws.png\" width=\"801\" \/><\/p>\n<p>\u56fe 68&#xff1a;SQL \u6210\u529f\u6267\u884c&#xff01;\u8fd4\u56de\u7ed3\u679c\u96c6\u6210\u529f\u8f93\u51fa id&#061;1, username&#061;2, password&#061;1\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"218\" src=\"2026-09-26qmllkfhi2l2.png\" width=\"908\" \/><\/p>\n<p>\u56fe 69&#xff1a;\u7ec8\u7aef\u7a33\u5b9a\u56de\u663e\u8bc1\u660e\u8be5\u8bed\u6cd5\u7ed3\u6784\u5177\u5907 100% \u7684\u5408\u6cd5\u6027\u3002<\/p>\n<p>\u3010\u5c0f\u767d\u901a\u4fd7\u6ce8\u89e3\u3011<\/p>\n<p>\u4e3a\u4ec0\u4e48 (3) and &#039;1&#039;&#061;&#039;1&#039; \u5728\u6570\u636e\u5e93\u91cc\u662f\u5408\u6cd5\u7684&#xff1f; \u5728 MySQL \u4e2d&#xff0c;\u4efb\u4f55\u6570\u636e\u5217\u4f4d\u7f6e\u4e0d\u4ec5\u53ef\u4ee5\u653e\u666e\u901a\u7684\u6570\u5b57&#xff0c;\u8fd8\u53ef\u4ee5\u653e\u6570\u5b66\u8ba1\u7b97\u516c\u5f0f\u6216\u903b\u8f91\u5224\u65ad\u3002 \u8868\u8fbe\u5f0f (3) and &#039;1&#039;&#061;&#039;1&#039; \u5b9e\u9645\u4e0a\u8ba9\u6570\u636e\u5e93\u8fdb\u884c\u4e86\u4e00\u6b21\u8ba1\u7b97&#xff1a;<\/p>\n<li>\n<p>\u5148\u5224\u65ad &#039;1&#039;&#061;&#039;1&#039;&#xff0c;\u7ed3\u679c\u4e3a\u771f&#xff08;\u5373\u6570\u5b57 1&#xff09;&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u7136\u540e\u8ba1\u7b97 3 AND 1&#xff0c;\u5728\u903b\u8f91\u8fd0\u7b97\u4e2d\u975e\u96f6\u6570\u5b57\u5747\u4e3a\u771f&#xff0c;\u56e0\u6b64\u6700\u7ec8\u8fd4\u56de\u6570\u503c 1\u3002 \u8fd9\u6837\u4e00\u6765&#xff0c;\u539f\u672c\u7528\u6765\u51d1\u6570\u7684\u7b2c 3 \u4e2a\u5b57\u6bb5\u987a\u5229\u8f93\u51fa\u4e86\u6570\u5b57 1&#xff0c;\u540c\u65f6\u5b83\u672b\u5c3e\u7684 &#039;1&#039; \u6070\u597d\u66ff\u6211\u4eec\u628a\u539f\u7cfb\u7edf\u4ee3\u7801\u91cc\u591a\u51fa\u6765\u7684\u90a3\u4e2a\u70e6\u4eba\u7684\u5355\u5f15\u53f7\u7ed9\u95ed\u5408\u6389\u4e86&#xff01;<\/p>\n<\/li>\n<h4 id=\"3.6%20%E7%9C%9F%E5%AE%9E%E6%9C%89%E6%95%88%E8%BD%BD%E8%8D%B7%E7%9A%84%E6%9C%80%E7%BB%88%E9%AA%8C%E8%AF%81\">3.6 \u771f\u5b9e\u6709\u6548\u8f7d\u8377\u7684\u6700\u7ec8\u9a8c\u8bc1<\/h4>\n<p>\u57fa\u4e8e\u5e95\u5c42\u8c03\u8bd5\u6210\u529f\u7684\u8bed\u6cd5\u6a21\u578b&#xff0c;\u8bb2\u5e08\u8fdb\u4e00\u6b65\u5c06\u7b2c 2 \u5b57\u6bb5&#xff08;\u56de\u663e\u5b57\u6bb5&#xff09;\u66ff\u6362\u4e3a\u6570\u636e\u5e93\u654f\u611f\u4fe1\u606f\u63d0\u53d6\u51fd\u6570 user()&#xff1a;<\/p>\n<p>select * from users where id&#061;&#039;-1&#039; union (select(1),(user()),(3) and &#039;1&#039;&#061;&#039;1&#039;); <\/p>\n<p>\u547d\u4ee4\u56de\u8f66\u6267\u884c&#xff0c;MySQL \u7ec8\u7aef\u7acb\u5373\u7cbe\u51c6\u6253\u5370\u51fa\u5f53\u524d\u8fde\u63a5\u7528\u6237\u4fe1\u606f&#xff1a;root&#064;localhost&#xff01;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"280\" src=\"2026-09-26cjeahecnqz1.png\" width=\"865\" \/><\/p>\n<p>\u56fe 70&#xff1a;\u7ec8\u7aef\u6210\u529f\u8f93\u51fa root&#064;localhost&#xff0c;\u9a8c\u8bc1\u4e86\u65e0\u7a7a\u683c\u3001\u65e0\u6ce8\u91ca\u95ed\u5408\u7ed5\u8fc7\u65b9\u6848\u7684\u5b9e\u6218\u6709\u6548\u6027\u3002<\/p>\n<p>\u81f3\u6b64&#xff0c;\u5728\u5b8c\u5168\u675c\u7edd\u7a7a\u683c\u3001\u5c01\u9501\u4e00\u5207\u7269\u7406\u6ce8\u91ca\u3001\u6e05\u6d17\u6240\u6709\u6807\u51c6\u903b\u8f91\u8bcd\u7684\u82db\u523b\u73af\u5883\u4e0b&#xff0c;\u901a\u8fc7\u5168\u62ec\u53f7\u9694\u79bb\u914d\u5408\u5b57\u6bb5\u7ea7\u7b97\u672f\u5e03\u5c14\u95ed\u5408&#xff0c;\u5b9e\u73b0\u4e86\u6570\u636e\u5e93\u4fe1\u606f\u7684\u5b8c\u6574\u63d0\u53d6\u3002<\/p>\n<h4 id=\"3.7%20%E5%BB%B6%E4%BC%B8%E5%AF%B9%E6%AF%94%EF%BC%9Asqli-labs%20Less-26a%20%E7%9A%84%E8%BF%87%E6%BB%A4%E7%89%B9%E5%BE%81%E4%B8%8E%E8%A7%A3%E9%A2%98%E5%8F%96%E8%88%8D\">3.7 \u5ef6\u4f38\u5bf9\u6bd4&#xff1a;sqli-labs Less-26a \u7684\u8fc7\u6ee4\u7279\u5f81\u4e0e\u89e3\u9898\u53d6\u820d<\/h4>\n<p>\u8bb2\u5e08\u7b80\u8981\u5bf9\u6bd4\u4e86\u9776\u573a\u7d27\u90bb\u7684\u7b2c 26a \u5173&#xff08;Less-26a&#xff09;\u3002\u5ba1\u67e5\u5176\u6e90\u7801\u53d1\u73b0&#xff0c;\u8be5\u5173\u5361\u5728 blacklist() \u4e2d\u5bf9\u7a7a\u767d\u5b57\u7b26\u5b9e\u65bd\u4e86\u8fde\u7eed\u4e24\u6b21\u6b63\u5219\u8fc7\u6ee4&#xff1a;<\/p>\n<p>$id &#061; preg_replace(&#039;\/[\\\\s]\/&#039;, &#034;&#034;, $id);<br \/>\n$id &#061; preg_replace(&#039;\/[\\\\s]\/&#039;, &#034;&#034;, $id); <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"358\" src=\"2026-09-26eb2pbrqi40g.png\" width=\"850\" \/><\/p>\n<p>\u56fe 71&#xff1a;Less-26a \u6e90\u7801\u5c55\u793a\u53cc\u91cd\u7a7a\u767d\u6e05\u7406\u673a\u5236&#xff0c;\u540c\u65f6\u8be5\u5173\u5361\u4e3a\u57fa\u4e8e\u76f2\u6ce8\/\u62a5\u9519\u7684\u65e0\u56de\u663e\u73af\u5883\u3002<\/p>\n<p>\u9488\u5bf9\u6b64\u7c7b\u5173\u5361&#xff0c;\u7531\u4e8e\u9875\u9762\u4e0d\u518d\u63d0\u4f9b\u7c7b\u4f3c Less-26 \u7684\u591a\u5b57\u6bb5\u76f4\u63a5\u56de\u663e\u4f4d&#xff0c;\u6d4b\u8bd5\u8def\u5f84\u901a\u5e38\u6709\u4e24\u79cd\u9009\u62e9&#xff1a;<\/p>\n<li>\n<p>\u57fa\u4e8e\u9519\u8bef\u7684\u6ce8\u5165&#xff08;\u62a5\u9519\u6ce8\u5165&#xff09;&#xff1a;\u901a\u8fc7\u6784\u9020 updatexml() \u6216 extractvalue()&#xff0c;\u5229\u7528\u62ec\u53f7\u66ff\u4ee3\u5168\u90e8\u7a7a\u683c&#xff0c;\u5c06\u6570\u636e\u901a\u8fc7\u9519\u8bef\u63d0\u793a\u629b\u51fa&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u57fa\u4e8e\u5e03\u5c14\u7684\u76f2\u6ce8&#xff1a;\u5229\u7528\u62ec\u53f7\u5305\u88f9\u5b50\u67e5\u8be2&#xff0c;\u901a\u8fc7\u9875\u9762\u663e\u793a\u6b63\u5e38\u4e0e\u5426\u9010\u4f4d\u7206\u7834\u6570\u636e\u3002<\/p>\n<\/li>\n<hr \/>\n<h3 id=\"%E5%9B%9B%E3%80%81%E7%B3%BB%E7%BB%9F%E6%80%A7%20MySQL%20%E8%BF%87%E6%BB%A4%E7%BB%95%E8%BF%87%E7%9F%A5%E8%AF%86%E5%9B%BE%E8%B0%B1%E4%B8%8E%E6%8A%80%E6%9C%AF%E6%BC%94%E8%BF%9B%EF%BC%88Typora%20%E7%AC%94%E8%AE%B0%E6%B7%B1%E5%BA%A6%E8%A7%A3%E6%9E%90%EF%BC%89\">\u56db\u3001\u7cfb\u7edf\u6027 MySQL \u8fc7\u6ee4\u7ed5\u8fc7\u77e5\u8bc6\u56fe\u8c31\u4e0e\u6280\u672f\u6f14\u8fdb&#xff08;Typora \u7b14\u8bb0\u6df1\u5ea6\u89e3\u6790&#xff09;<\/h3>\n<p>\u5728\u5b8c\u6210\u4e0a\u8ff0\u4e24\u4e2a\u590d\u6742\u9776\u573a\u7684\u6781\u9650\u6392\u9519\u540e&#xff0c;\u8bb2\u5e08\u6253\u5f00\u4e86\u7cfb\u7edf\u6574\u7406\u7684 MySQL\u7ed5\u8fc7.md \u77e5\u8bc6\u5927\u7eb2&#xff0c;\u9488\u5bf9\u5e38\u89c1\u7684\u8f93\u5165\u8fc7\u6ee4\u4e0e\u8bed\u6cd5\u9650\u5236\u5c55\u5f00\u4e86\u6a2a\u5411\u7684\u5206\u7c7b\u63a8\u6f14\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"538\" src=\"2026-09-263wut3jyfzby.png\" width=\"865\" \/><\/p>\n<p>\u56fe 72&#xff1a;\u5927\u7eb2\u6db5\u76d6\u7a7a\u683c\u3001\u5f15\u53f7\u3001\u9017\u53f7\u3001\u6bd4\u8f83\u7b26\u3001\u903b\u8f91\u8bcd\u3001\u6ce8\u91ca\u7b26\u7b49\u5341\u516d\u4e2a\u6838\u5fc3\u8fc7\u6ee4\u65b9\u5411\u3002<\/p>\n<h4 id=\"4.1%20%E7%A9%BA%E6%A0%BC%E8%BF%87%E6%BB%A4%E7%9A%84%E5%9B%9B%E7%BB%B4%E7%AA%81%E7%A0%B4%E8%B7%AF%E5%BE%84\">4.1 \u7a7a\u683c\u8fc7\u6ee4\u7684\u56db\u7ef4\u7a81\u7834\u8def\u5f84<\/h4>\n<p>\u5728\u5b9e\u9645\u4e1a\u52a1\u9632\u62a4\u89c4\u5219\u4e2d&#xff0c;\u9488\u5bf9\u7a7a\u683c\u7684\u9650\u5236\u662f\u6700\u57fa\u7840\u4e5f\u662f\u6700\u9891\u7e41\u7684\u7b56\u7565\u3002\u9664\u4e86\u524d\u6587\u8be6\u8ff0\u7684\u62ec\u53f7\u9694\u79bb\u6cd5&#xff0c;\u5b9e\u6218\u4e2d\u5b58\u5728\u56db\u79cd\u5178\u578b\u66ff\u4ee3\u65b9\u6848&#xff1a;<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%B8%80%EF%BC%9A%E5%86%85%E8%81%94%E6%B3%A8%E9%87%8A%E4%B8%8E%E7%89%B9%E6%80%A7%E6%B3%A8%E9%87%8A\">\u65b9\u6848\u4e00&#xff1a;\u5185\u8054\u6ce8\u91ca\u4e0e\u7279\u6027\u6ce8\u91ca<\/h5>\n<p>\u5229\u7528 MySQL \u72ec\u6709\u7684\u6ce8\u91ca\u8bed\u6cd5\u66ff\u4ee3\u7a7a\u683c\u5206\u9694&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u6807\u51c6\u5185\u8054\u6ce8\u91ca&#xff1a;SELECT\/**\/*\/**\/FROM\/**\/users;<\/p>\n<\/li>\n<li>\n<p>\u7248\u672c\u7279\u6027\u6ce8\u91ca&#xff1a;\/*!50000SELECT*\/*\/*!50000FROM*\/users;<\/p>\n<\/li>\n<\/ul>\n<p>\u5728\u672c\u5730 MySQL \u547d\u4ee4\u884c\u9a8c\u8bc1&#xff1a;<\/p>\n<p>select\/**\/*from\/**\/users; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"461\" src=\"2026-09-26jz5teej4ucy.png\" width=\"721\" \/><\/p>\n<p>\u56fe 73&#xff1a;\u7ec8\u7aef\u9a8c\u8bc1 \/**\/ \u5b8c\u7f8e\u5c65\u884c\u4e86\u5b57\u6bb5\u4e0e\u8868\u540d\u4e4b\u95f4\u7684\u7a7a\u683c\u5206\u9694\u804c\u8d23\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%BA%8C%EF%BC%9A%E7%A9%BA%E7%99%BD%E5%AD%97%E7%AC%A6%E7%BC%96%E7%A0%81%E7%BD%AE%E6%8D%A2\">\u65b9\u6848\u4e8c&#xff1a;\u7a7a\u767d\u5b57\u7b26\u7f16\u7801\u7f6e\u6362<\/h5>\n<p>\u5728\u4e0d\u540c\u64cd\u4f5c\u7cfb\u7edf\u4e0e\u89e3\u6790\u73af\u5883\u4e0b&#xff0c;\u90e8\u5206\u7279\u6b8a\u7684 URL \u7f16\u7801\u53ef\u88ab\u8bc6\u522b\u4e3a\u6709\u6548\u7a7a\u767d\u7b26&#xff1a; %20&#xff08;\u6807\u51c6\u7a7a\u683c&#xff09;\u3001%09&#xff08;Tab&#xff09;\u3001%0a&#xff08;\u6362\u884c&#xff09;\u3001%0b&#xff08;\u5782\u76f4\u5236\u8868&#xff09;\u3001%0c&#xff08;\u6362\u9875&#xff09;\u3001%0d&#xff08;\u56de\u8f66&#xff09;\u3001%a0&#xff08;\u4e0d\u6362\u884c\u7a7a\u683c&#xff09;\u3001%00&#xff08;\u622a\u65ad\u7b26&#xff09;\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%B8%89%EF%BC%9A%E5%8F%8D%E5%BC%95%E5%8F%B7%E5%8C%85%E8%A3%B9%E8%A1%A8%E5%90%8D%E4%B8%8E%E5%AD%97%E6%AE%B5\">\u65b9\u6848\u4e09&#xff1a;\u53cd\u5f15\u53f7\u5305\u88f9\u8868\u540d\u4e0e\u5b57\u6bb5<\/h5>\n<p>\u5728 MySQL \u4e2d&#xff0c;\u53cd\u5f15\u53f7 &#096; \u7528\u4e8e\u754c\u5b9a\u6807\u8bc6\u7b26\u3002\u5f53\u8868\u540d\u524d\u540e\u7f3a\u4e4f\u7a7a\u683c\u65f6&#xff0c;\u76f4\u63a5\u4f7f\u7528\u53cd\u5f15\u53f7\u5305\u88f9\u53ef\u907f\u514d\u8bcd\u6cd5\u89e3\u6790\u51b2\u7a81&#xff1a;<\/p>\n<p>select * from&#096;users&#096;; <\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E5%9B%9B%EF%BC%9A%E6%B5%AE%E7%82%B9%E6%95%B0%E4%B8%8E%E7%A7%91%E5%AD%A6%E8%AE%A1%E6%95%B0%E6%B3%95%E7%AA%81%E7%A0%B4%E5%8D%95%E8%AF%8D%E8%BE%B9%E7%95%8C%E6%AD%A3%E5%88%99%EF%BC%88%08%EF%BC%89\">\u65b9\u6848\u56db&#xff1a;\u6d6e\u70b9\u6570\u4e0e\u79d1\u5b66\u8ba1\u6570\u6cd5\u7a81\u7834\u5355\u8bcd\u8fb9\u754c\u6b63\u5219&#xff08;&#xff09;<\/h5>\n<p>\u8fd9\u4e00\u65b9\u6848\u5e76\u975e\u7528\u4e8e\u89e3\u51b3\u8bed\u6cd5\u4e0a\u7684\u7a7a\u683c\u7f3a\u5931&#xff0c;\u800c\u662f\u4e13\u95e8\u9488\u5bf9\u9632\u5b88\u65b9\u8bbe\u7f6e\u7684\u5355\u8bcd\u8fb9\u754c\u6b63\u5219\u8868\u8fbe\u5f0f\u5c55\u5f00\u7684\u964d\u7ef4\u6253\u51fb\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"644\" src=\"2026-09-26rjon2yjw42s.png\" width=\"1066\" \/><\/p>\n<p>\u56fe 74&#xff1a;\u5927\u7eb2\u8be6\u7ec6\u8bb0\u5f55 8E0union\u30018.0union \u4e0e\u5355\u8bcd\u8fb9\u754c \\\\bunion(.?)select\\\\b \u7684\u5bf9\u6297\u903b\u8f91\u3002*<\/p>\n<p>\u673a\u7406\u6df1\u5ea6\u62c6\u89e3&#xff1a; \u8bb8\u591a\u5b89\u5168\u9632\u62a4\u811a\u672c&#xff08;\u5982 ModSecurity \u57fa\u7840\u89c4\u5219\u6216\u5f00\u53d1\u8005\u7684\u7b80\u6613\u8fc7\u6ee4\u5668&#xff09;\u5e38\u91c7\u7528\u5982\u4e0b\u6b63\u5219\u62e6\u622a\u8054\u5408\u67e5\u8be2&#xff1a;<\/p>\n<p><span style=\"background-color:#cbe0f1\">union(.*?)select<\/span> <\/p>\n<p>\u3010\u5c0f\u767d\u901a\u4fd7\u6ce8\u89e3\u3011<\/p>\n<p>\u4ec0\u4e48\u662f\u6b63\u5219\u8868\u8fbe\u5f0f\u91cc\u7684\u201c\u5355\u8bcd\u8fb9\u754c\u201d&#xff08;&#xff09;&#xff1f;  \u5c31\u50cf\u662f\u4e00\u4e2a\u68c0\u67e5\u5c97\u54e8&#xff0c;\u5b83\u4e13\u95e8\u7ad9\u5728\u201c\u82f1\u6587\u5355\u8bcd\u201d\u548c\u201c\u6807\u70b9\u7b26\u53f7\/\u7a7a\u683c\u201d\u7684\u4ea4\u754c\u5904\u3002 \u6bd4\u5982\u5728 select * from \u4e2d&#xff0c;select \u524d\u9762\u662f\u5f00\u5934\u7684\u7a7a\u767d&#xff0c;\u540e\u9762\u662f\u7a7a\u683c&#xff0c;\u6240\u4ee5\u5b83\u7684\u4e24\u7aef\u90fd\u662f\u201c\u8fb9\u754c\u201d&#xff0c;select \u5c31\u80fd\u6293\u5230\u5b83\u3002 \u4f46\u5982\u679c\u4f60\u5728 select \u524d\u9762\u7d27\u7d27\u8d34\u7740\u5199\u4e00\u4e2a\u6570\u5b57\u6216\u5b57\u6bcd&#xff0c;\u8ba9\u5b83\u53d8\u6210 1select&#xff0c;\u90a3\u4e48\u6570\u5b57\u548c\u5b57\u6bcd\u5728\u7535\u8111\u770b\u6765\u662f\u201c\u540c\u4e00\u4e2a\u5355\u8bcd\u7684\u5185\u90e8\u6210\u5458\u201d&#xff0c;\u539f\u672c\u5904\u4e8e\u5f00\u5934\u7684\u201c\u8fb9\u754c\u5c97\u54e8\u201d\u5c31\u6d88\u5931\u4e86&#xff0c;\u6b63\u5219\u68c0\u67e5\u5c31\u4f1a\u76f4\u63a5\u6f0f\u8fc7\u53bb&#xff01;<\/p>\n<p>\u5728\u5728\u7ebf\u6b63\u5219\u6d4b\u8bd5\u5e73\u53f0 regex101.com \u4e2d\u91cd\u73b0\u8be5\u89c4\u5219&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"387\" src=\"2026-09-26vp3eerc1r3s.png\" width=\"865\" \/><\/p>\n<p>\u56fe 75&#xff1a;\u6807\u51c6\u5f62\u6001\u4e0b&#xff0c;\u8f93\u5165 select from \u80fd\u591f\u88ab\u6b63\u5219\u5b8c\u6574\u6355\u83b7\u3002<\/p>\n<p>\u82e5\u5728 select \u524d\u90e8\u62fc\u63a5\u5176\u4ed6\u5b57\u6bcd&#xff08;\u5982 aaaaselect from&#xff09;&#xff0c;\u5219\u7531\u4e8e\u7834\u574f\u4e86\u524d\u7f6e\u8fb9\u754c\u65ad\u8a00&#xff0c;\u8be5\u6b63\u5219\u7acb\u5373\u5339\u914d\u5931\u8d25&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"235\" src=\"2026-09-263fdqbkgkc2d.png\" width=\"865\" \/><\/p>\n<p>\u56fe 76&#xff1a;\u524d\u7f00\u4f7f\u5f97\u9996\u5b57\u6bcd s \u4e0d\u518d\u5904\u4e8e\u8bcd\u8fb9\u754c&#xff0c;\u663e\u793a Match Information: Does not match\u3002<\/p>\n<p>\u5728 SQL \u8bed\u6cd5\u5c42\u9762\u7684\u5de5\u7a0b\u5b9e\u8df5&#xff1a; \u5982\u679c\u6ce8\u5165\u70b9\u4e3a\u6570\u5b57\u578b\u6ce8\u5165&#xff08;\u4f8b\u5982 sqli-labs Less-2&#xff09;&#xff0c;\u539f\u8bed\u53e5\u7ed3\u6784\u4e3a&#xff1a;SELECT * FROM users WHERE id&#061;$id LIMIT 0,1\u3002 \u82e5\u8f93\u5165\u5e38\u89c4\u8f7d\u8377 id&#061;-1 union select 1,2,3&#xff0c;\u5fc5\u5b9a\u89e6\u53d1 union \u62e6\u622a\u3002 \u6b64\u65f6\u653b\u51fb\u8005\u53ef\u5c06\u53c2\u6570\u6784\u9020\u4e3a\u6d6e\u70b9\u6570\u6216\u79d1\u5b66\u8ba1\u6570\u6cd5\u5f62\u5f0f&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u6d6e\u70b9\u6570\u5f62\u5f0f&#xff1a;id&#061;-1.0union select 1,2,3<\/p>\n<\/li>\n<li>\n<p>\u79d1\u5b66\u8ba1\u6570\u6cd5\u5f62\u5f0f&#xff1a;id&#061;1E1union select 1,2,3<\/p>\n<\/li>\n<\/ul>\n<p>\u5728 MySQL \u7ec8\u7aef\u4e2d\u6392\u67e5\u5176\u8bed\u6cd5\u5408\u6cd5\u6027&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"228\" src=\"2026-09-265nnlcpztbqt.png\" width=\"745\" \/><\/p>\n<p>\u56fe 77&#xff1a;\u7ec8\u7aef\u6d4b\u8bd5\u8868\u660e&#xff0c;\u5728\u6570\u5b57\u578b\u5b57\u6bb5\u4e4b\u540e\u76f4\u63a5\u7d27\u8d34 union \u5c5e\u4e8e\u5b8c\u5168\u5408\u6cd5\u7684\u6570\u503c\u4e0e\u64cd\u4f5c\u7b26\u7ec4\u5408\u3002<\/p>\n<p>\u5728\u6d4f\u89c8\u5668\u7aef\u8bbf\u95ee Less-2 \u5b9e\u6d4b&#xff1a;<\/p>\n<p>http:\/\/127.0.0.1\/sqllabs\/Less-2\/?id&#061;-1.0union select 1,2,3&#8211;&#043; <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"245\" src=\"2026-09-26icbhw444xj2.png\" width=\"1302\" \/><\/p>\n<p>\u56fe 78&#xff1a;\u9875\u9762\u5b8c\u7f8e\u6267\u884c\u8054\u5408\u67e5\u8be2&#xff0c;\u56de\u663e\u7528\u6237\u4fe1\u606f&#xff0c;\u8bc1\u5b9e\u6d6e\u70b9\u6570\u6210\u529f\u7a7f\u900f\u5355\u8bcd\u8fb9\u754c\u9650\u5236\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"430\" src=\"2026-09-26ftxxe0yhsqp.png\" width=\"709\" \/><\/p>\n<p>\u56fe 79&#xff1a;\u6a21\u62df\u5728\u6e90\u7801\u4e2d\u52a0\u5165 if(preg_match(&#039;\/(?:(\\\\bunion(.?)select\\\\b))\/i&#039;,$id)) \u9632\u5fa1\u4f53\u7cfb\u3002*<\/p>\n<h4 id=\"4.2%20%E5%BC%95%E5%8F%B7%E8%BF%87%E6%BB%A4%E4%B8%8E%E5%8D%81%E5%85%AD%E8%BF%9B%E5%88%B6%E7%BB%95%E8%BF%87\">4.2 \u5f15\u53f7\u8fc7\u6ee4\u4e0e\u5341\u516d\u8fdb\u5236\u7ed5\u8fc7<\/h4>\n<p>\u5728\u5f88\u591a\u4e25\u683c\u8fc7\u6ee4\u5355\u53cc\u5f15\u53f7\u7684\u73af\u5883\u4e2d&#xff0c;\u653b\u51fb\u8005\u5728\u67e5\u8be2\u5143\u6570\u636e\u65f6\u65e0\u6cd5\u76f4\u63a5\u4e66\u5199\u8bf8\u5982 table_name&#061;&#034;users&#034; \u7684\u5b57\u7b26\u4e32\u5e38\u91cf\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"217\" src=\"2026-09-260q1lcvrlmaq.png\" width=\"865\" \/><\/p>\n<p>\u56fe 80&#xff1a;\u539f\u8bed\u53e5 table_name&#061;&#034;users&#034; \u8f6c\u6362\u4e3a\u5341\u516d\u8fdb\u5236 table_name&#061;0x7573657273\u3002<\/p>\n<p>\u89e3\u51b3\u7b56\u7565&#xff1a;MySQL \u539f\u751f\u652f\u6301\u5341\u516d\u8fdb\u5236\u5b57\u9762\u91cf\u8bed\u6cd5\u3002 \u5c06\u5b57\u7b26\u4e32 users \u8f6c\u6362\u4e3a ASCII \u5341\u516d\u8fdb\u5236\u7f16\u7801&#xff1a;<\/p>\n<ul>\n<li>\n<p>u -&gt; 0x75<\/p>\n<\/li>\n<li>\n<p>s -&gt; 0x73<\/p>\n<\/li>\n<li>\n<p>e -&gt; 0x65<\/p>\n<\/li>\n<li>\n<p>r -&gt; 0x72<\/p>\n<\/li>\n<li>\n<p>s -&gt; 0x73 \u7ec4\u5408\u4e3a\u5341\u516d\u8fdb\u5236\u6807\u91cf&#xff1a;0x7573657273\u3002 \u5728\u67e5\u8be2\u8bed\u53e5\u4e2d\u76f4\u63a5\u4f7f\u7528&#xff1a;<\/p>\n<\/li>\n<\/ul>\n<p>select column_name from infoorrmation_schema.columns where table_name&#061;0x7573657273; <\/p>\n<p>\u7531\u4e8e\u6574\u6761\u8bed\u53e5\u5b8c\u5168\u65e0\u9700\u5f15\u5165\u4efb\u4f55\u5f15\u53f7&#xff0c;\u6210\u529f\u5b9e\u73b0\u5bf9\u5355\u53cc\u5f15\u53f7\u8fc7\u6ee4\u7684\u7edd\u5bf9\u89c4\u907f\u3002<\/p>\n<h4 id=\"4.3%20%E9%80%97%E5%8F%B7%E8%BF%87%E6%BB%A4%E7%9A%84%E4%B8%89%E5%A4%A7%E5%AE%9E%E6%88%98%E8%A7%A3%E6%B3%95\">4.3 \u9017\u53f7\u8fc7\u6ee4\u7684\u4e09\u5927\u5b9e\u6218\u89e3\u6cd5<\/h4>\n<p>\u9017\u53f7&#xff08;,&#xff09;\u5728 SQL \u8bed\u53e5\u4e2d\u4e3b\u8981\u627f\u62c5\u4e09\u4e2a\u804c\u8d23&#xff1a;\u8054\u5408\u67e5\u8be2\u591a\u5217\u5206\u9694\u3001\u51fd\u6570\u591a\u53c2\u6570\u4f20\u9012&#xff08;\u5982 substr()\u3001mid()&#xff09;\u3001\u4ee5\u53ca\u5206\u9875\u6307\u4ee4 limit 0,1 \u7684\u53c2\u6570\u754c\u5b9a\u3002\u5f53\u9017\u53f7\u88ab\u9ed1\u540d\u5355\u5c01\u9501\u65f6&#xff0c;\u9700\u91c7\u7528\u5dee\u5f02\u5316\u7684\u7ed3\u6784\u66ff\u4ee3\u65b9\u6848\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"425\" src=\"2026-09-26gyqniylpinl.png\" width=\"825\" \/><\/p>\n<p>\u56fe 81&#xff1a;\u603b\u7ed3\u5305\u62ec join \u8054\u8868\u6cd5\u3001from for \u8bed\u6cd5\u53ca\u5404\u7c7b\u622a\u53d6\u51fd\u6570\u7684\u66ff\u4ee3\u6f14\u8fdb\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%B8%80%EF%BC%9A%E8%81%94%E5%90%88%E6%9F%A5%E8%AF%A2%E4%B8%AD%E7%9A%84%E9%80%97%E5%8F%B7%E7%BB%95%E8%BF%87%E2%80%94%E2%80%94JOIN%20%E8%99%9A%E6%8B%9F%E8%81%94%E8%A1%A8%E6%B3%95\">\u65b9\u6848\u4e00&#xff1a;\u8054\u5408\u67e5\u8be2\u4e2d\u7684\u9017\u53f7\u7ed5\u8fc7\u2014\u2014JOIN \u865a\u62df\u8054\u8868\u6cd5<\/h5>\n<p>\u5e38\u89c4\u8054\u5408\u67e5\u8be2\u4f7f\u7528\u9017\u53f7\u754c\u5b9a\u5b57\u6bb5&#xff1a;UNION SELECT 1,2,3\u3002 \u5728\u7f3a\u4e4f\u9017\u53f7\u65f6&#xff0c;\u53ef\u5c06\u6bcf\u4e2a\u6570\u5b57\u89c6\u4e3a\u4e00\u4e2a\u62e5\u6709\u72ec\u7acb\u522b\u540d\u7684\u5355\u5217\u5355\u884c\u865a\u62df\u5b50\u67e5\u8be2\u8868&#xff0c;\u901a\u8fc7 JOIN \u5173\u952e\u5b57\u8fdb\u884c\u6a2a\u5411\u8fde\u63a5&#xff1a;<\/p>\n<p>union select * from (select 1)a join (select 2)b join (select 3)c <\/p>\n<p>\u5728\u672c\u5730 MySQL \u547d\u4ee4\u884c\u4e2d\u8fdb\u884c\u8c03\u8bd5&#xff1a; \u8bb2\u5e08\u521d\u6b21\u8f93\u5165\u65f6\u7531\u4e8e\u6f0f\u5199\u4e86\u4e2d\u95f4\u7684 join \u5173\u952e\u5b57&#xff1a;<\/p>\n<p>select * from users where id&#061;1 union select *from (select 1) a join (select 2) b (select 3) c; <\/p>\n<p>\u7ec8\u7aef\u7acb\u5373\u629b\u51fa ERROR 1064 (42000) \u8bed\u6cd5\u5f02\u5e38\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"248\" src=\"2026-09-26djrfv3f0t1w.png\" width=\"1023\" \/><\/p>\n<p>\u56fe 82&#xff1a;\u9519\u8bef\u4fe1\u606f\u660e\u786e\u6307\u51fa\u8bed\u6cd5\u89e3\u6790\u5728 (select 3) c \u9644\u8fd1\u4e2d\u65ad&#xff0c;\u8bc1\u660e\u5404\u865a\u62df\u8868\u4e4b\u95f4\u5fc5\u987b\u4e25\u683c\u4f7f\u7528 join \u58f0\u660e\u3002<\/p>\n<p>\u8865\u9f50 join \u540e\u91cd\u65b0\u6267\u884c&#xff0c;\u67e5\u8be2\u987a\u5229\u8fd4\u56de\u5305\u542b\u4e86 1, 2, 3 \u4e09\u5217\u7ec4\u5408\u7684\u5408\u6210\u6570\u636e\u884c\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"359\" src=\"2026-09-26fkiav5rpl4j.png\" width=\"660\" \/><\/p>\n<p>\u56fe 83&#xff1a;\u91cd\u70b9\u89e3\u91ca join on \u8981\u6c42\u4e24\u8868\u5177\u5907\u7269\u7406\/\u903b\u8f91\u5916\u952e\u5bf9\u5e94&#xff0c;\u800c\u6b64\u5904\u4f7f\u7528\u7b1b\u5361\u5c14\u79ef\u865a\u62df\u8054\u8868\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"469\" src=\"2026-09-26l2jfhwg5fpi.png\" width=\"914\" \/><\/p>\n<p>\u56fe 84&#xff1a;\u8bb2\u5e08\u8be6\u7ec6\u9610\u8ff0\u5c06\u5b66\u751f 30 \u4e2a\u5c5e\u6027\u62c6\u5206\u4e3a\u57fa\u672c\u4fe1\u606f\u8868\u3001\u94f6\u884c\u5361\u8868\u3001\u90ae\u7bb1\u8868\u80cc\u540e\u7684\u5de5\u7a0b\u610f\u4e49\u3002<\/p>\n<p>\u6570\u636e\u5e93\u5e95\u5c42\u539f\u7406\u79d1\u666e&#xff1a; \u8054\u5408\u67e5\u8be2 UNION \u662f\u5c06\u4e24\u4e2a\u7ed3\u6784\u76f8\u540c&#xff08;\u5217\u6570\u76f8\u540c&#xff09;\u7684\u7ed3\u679c\u96c6\u8fdb\u884c\u7eb5\u5411\u7684\u6570\u636e\u884c\u5806\u53e0&#xff0c;\u4e24\u8868\u4e4b\u95f4\u53ef\u4ee5\u4e0d\u5b58\u5728\u4efb\u4f55\u8bed\u4e49\u5173\u8054\u3002 \u800c JOIN \u5219\u662f\u57fa\u4e8e\u7279\u5b9a\u5173\u8054\u6761\u4ef6&#xff08;ON \u6761\u4ef6&#xff09;\u8fdb\u884c\u7684\u6a2a\u5411\u5217\u6269\u5145\u3002\u5728\u5173\u7cfb\u578b\u6570\u636e\u5e93\u89c4\u8303\u5316\u8bbe\u8ba1\u4e2d&#xff0c;\u4e3a\u4e86\u907f\u514d\u5bbd\u8868\u7684\u5197\u4f59&#xff0c;\u4f1a\u5c06\u5b9e\u4f53\u5c5e\u6027\u62c6\u5206\u81f3\u4e0d\u540c\u6570\u636e\u8868&#xff0c;\u5e76\u901a\u8fc7\u5916\u952e\u5efa\u7acb\u53c2\u7167\u5b8c\u6574\u6027\u3002\u5728\u4e0a\u8ff0\u5229\u7528\u6280\u5de7\u4e2d&#xff0c;\u7531\u4e8e\u5404\u5b50\u67e5\u8be2\u53ea\u6709\u5355\u884c\u5355\u5217\u4e14\u672a\u6307\u5b9a ON \u6761\u4ef6&#xff0c;\u5b9e\u9645\u4e0a\u89e6\u53d1\u7684\u662f\u5355\u884c\u6570\u636e\u96c6\u7684\u81ea\u7136\u7b1b\u5361\u5c14\u79ef\u5408\u5e76&#xff0c;\u4ece\u800c\u5de7\u5999\u62fc\u88c5\u51fa\u5305\u542b\u4e09\u5217\u7684\u591a\u5b57\u6bb5\u7ed3\u679c\u96c6&#xff0c;\u5b8c\u5168\u7ed5\u8fc7\u4e86\u9017\u53f7\u7684\u9650\u5236\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%BA%8C%EF%BC%9A%E7%9B%B2%E6%B3%A8%E6%88%AA%E5%8F%96%E5%87%BD%E6%95%B0%E4%B8%AD%E7%9A%84%E9%80%97%E5%8F%B7%E7%BB%95%E8%BF%87%E2%80%94%E2%80%94FROM%20...%20FOR%20...%20%E8%AF%AD%E6%B3%95%E8%A7%84%E8%8C%83\">\u65b9\u6848\u4e8c&#xff1a;\u76f2\u6ce8\u622a\u53d6\u51fd\u6570\u4e2d\u7684\u9017\u53f7\u7ed5\u8fc7\u2014\u2014FROM &#8230; FOR &#8230; \u8bed\u6cd5\u89c4\u8303<\/h5>\n<p>\u5728\u5e03\u5c14\u76f2\u6ce8\u4e0e\u65f6\u95f4\u76f2\u6ce8\u4e2d&#xff0c;\u653b\u51fb\u8005\u5fc5\u987b\u9010\u4f4d\u63d0\u53d6\u5b57\u7b26\u4e32\u4ee5\u8fdb\u884c ASCII \u7801\u5224\u65ad\u3002 \u786e\u8ba4\u5f53\u524d\u6570\u636e\u5e93\u540d&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"192\" src=\"2026-09-26crlah5farpq.png\" width=\"665\" \/><\/p>\n<p>\u56fe 85&#xff1a;\u901a\u8fc7 select database(); \u786e\u8ba4\u76ee\u6807\u6570\u636e\u5e93\u6807\u8bc6\u4e3a security\u3002<\/p>\n<p>\u5e38\u89c4\u76f2\u6ce8\u8bed\u53e5\u4f7f\u7528 substr(database(), 1, 1)&#xff0c;\u5176\u4e2d\u5305\u542b\u4e86\u4e24\u4e2a\u9017\u53f7\u3002\u5728\u547d\u4ee4\u884c\u9a8c\u8bc1\u57fa\u7840\u63d0\u53d6\u903b\u8f91&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"72\" src=\"2026-09-26s5psobil1dz.png\" width=\"1233\" \/><\/p>\n<p>*\u56fe 86&#xff1a;\u6784\u5efa select * from users where id&#061;1 and ascii(substr(database(),1,1)) \u9a8c\u8bc1\u8bed\u53e5\u3002*<\/p>\n<p>\u5f53\u8bbe\u7f6e\u9996\u5b57\u6bcd ASCII \u4e3a 115&#xff08;\u5373\u5c0f\u5199\u5b57\u6bcd s&#xff09;\u65f6&#xff0c;\u6761\u4ef6\u4e3a\u771f&#xff0c;\u9875\u9762\u6210\u529f\u8fd4\u56de id&#061;1 \u7684\u7528\u6237\u4fe1\u606f&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"241\" src=\"2026-09-261oz1yrwcm4l.png\" width=\"727\" \/><\/p>\n<p>\u56fe 87&#xff1a;\u56de\u663e\u6570\u636e\u8bc1\u5b9e security \u5e93\u7684\u9996\u5b57\u7b26\u547d\u4e2d ASCII 115\u3002<\/p>\n<p>\u5f53\u63a2\u6d4b\u7b2c\u4e8c\u4f4d\u5b57\u7b26\u4e14\u4f9d\u7136\u731c\u6d4b 115 \u65f6&#xff0c;\u6761\u4ef6\u4e3a\u5047&#xff0c;\u8fd4\u56de Empty set&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"219\" src=\"2026-09-26nmal5htevcv.png\" width=\"686\" \/><\/p>\n<p>\u56fe 88&#xff1a;\u8fd4\u56de\u7a7a\u96c6\u5370\u8bc1\u4e86\u5e03\u5c14\u76f2\u6ce8\u57fa\u4e8e\u6b63\u53cd\u72b6\u6001\u533a\u5206\u731c\u6d4b\u51c6\u786e\u6027\u7684\u6838\u5fc3\u673a\u7406\u3002<\/p>\n<p>\u53bb\u9664\u9017\u53f7\u7684\u8bed\u6cd5\u91cd\u6784&#xff1a; \u5728 SQL \u56fd\u9645\u5316\u6807\u51c6\u4e2d&#xff0c;\u622a\u53d6\u64cd\u4f5c\u539f\u751f\u652f\u6301 FROM \u8d77\u59cb\u4f4d FOR \u622a\u53d6\u957f\u5ea6 \u7684\u8868\u8fbe\u65b9\u5f0f&#xff1a;<\/p>\n<p>select * from users where id&#061;1 and ascii(substr(database() from 1 for 1))&#061;115; <\/p>\n<p>\u5728 MySQL \u7ec8\u7aef\u4e2d\u6267\u884c\u8be5\u547d\u4ee4&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"188\" src=\"2026-09-26tc1vteejyr2.png\" width=\"831\" \/><\/p>\n<p>\u56fe 89&#xff1a;\u7ec8\u7aef\u6210\u529f\u8fd4\u56de\u6570\u636e\u884c&#xff0c;\u8bc1\u5b9e from &#8230; for &#8230; \u80fd\u591f\u5b8c\u5168\u514d\u9664\u9017\u53f7\u5e76\u5b9e\u73b0\u7b49\u6548\u622a\u53d6\u3002<\/p>\n<p>\u540c\u7406&#xff0c;\u6807\u51c6\u51fd\u6570 substring() \u4ea6\u5b8c\u5168\u652f\u6301\u8be5\u7279\u6027&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"166\" src=\"2026-09-263r5kugktvsf.png\" width=\"1014\" \/><\/p>\n<p>\u56fe 90&#xff1a;\u9a8c\u8bc1 substring \u5177\u5907\u5b8c\u5168\u4e00\u81f4\u7684\u65e0\u9017\u53f7\u622a\u53d6\u7279\u6027\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%B8%89%EF%BC%9A%E6%88%AA%E5%8F%96%E5%87%BD%E6%95%B0%E5%8F%97%E9%99%90%E4%B8%8B%E7%9A%84%E5%87%BD%E6%95%B0%E7%BA%A7%E9%80%90%E7%BA%A7%E6%9B%BF%E4%BB%A3\">\u65b9\u6848\u4e09&#xff1a;\u622a\u53d6\u51fd\u6570\u53d7\u9650\u4e0b\u7684\u51fd\u6570\u7ea7\u9010\u7ea7\u66ff\u4ee3<\/h5>\n<p>\u5f53\u9632\u62a4\u7cfb\u7edf\u5c06 substr() \u4e0e substring() \u540c\u65f6\u52a0\u5165\u9ed1\u540d\u5355\u65f6&#xff0c;\u9700\u8981\u8c03\u7528\u540c\u529f\u80fd\u51fd\u6570\u65cf\u8fdb\u884c\u6a2a\u5411\u66ff\u4ee3&#xff1a;<\/p>\n<li>\n<p>mid() \u51fd\u6570&#xff1a; mid() \u51fd\u6570\u7684\u53c2\u6570\u89c4\u5219\u4e0e substr() \u5b8c\u5168\u4e00\u81f4&#xff0c;\u4e14\u540c\u6837\u652f\u6301 from &#8230; for &#8230; \u8bed\u6cd5\u7ed3\u6784\u3002\u5728\u7ec8\u7aef\u6d4b\u8bd5 mid(database(), 1, 1)&#xff0c;\u540c\u6837\u7cbe\u51c6\u8fd4\u56de\u9996\u5b57\u7b26 s&#xff1a;<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"435\" src=\"2026-09-264ya3y3kebrh.png\" width=\"885\" \/><\/p>\n<p>\u56fe 91&#xff1a;select mid(database(),1,1); \u7cbe\u786e\u622a\u51fa\u5b57\u6bcd s\u3002<\/p>\n<li>\n<p>left() \u4e0e right() \u51fd\u6570&#xff1a;<\/p>\n<ul>\n<li>\n<p>left(str, len)&#xff1a;\u4ece\u5b57\u7b26\u4e32\u5de6\u4fa7\u63d0\u53d6\u6307\u5b9a\u957f\u5ea6\u5b50\u4e32&#xff1b;<\/p>\n<\/li>\n<li>\n<p>right(str, len)&#xff1a;\u4ece\u5b57\u7b26\u4e32\u53f3\u4fa7\u63d0\u53d6\u6307\u5b9a\u957f\u5ea6\u5b50\u4e32\u3002 \u5728\u7ec8\u7aef\u6d4b\u8bd5 left() \u7684\u9010\u4f4d\u6269\u5145\u8fc7\u7a0b&#xff1a;<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"347\" src=\"2026-09-2654gzhgvpxfe.png\" width=\"525\" \/><\/p>\n<p>\u56fe 92&#xff1a;\u7ec8\u7aef\u4f9d\u6b21\u8f93\u51fa &#039;s&#039;\u3001&#039;se&#039;\u3001&#039;sec&#039;&#xff0c;\u5c55\u73b0\u4e86\u901a\u8fc7\u524d\u7f00\u7d2f\u8fdb\u8fdb\u884c\u76f2\u6ce8\u5224\u5b9a\u7684\u53ef\u80fd\u6027\u3002<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"336\" src=\"2026-09-26z5mjffkd2hk.png\" width=\"872\" \/><\/p>\n<p>\u56fe 93&#xff1a;\u7cfb\u7edf\u5f52\u7eb3 substring\u3001mid\u3001left\u3001right \u7684\u66ff\u4ee3\u8c03\u7528\u903b\u8f91\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E5%9B%9B%EF%BC%9A%E5%BD%BB%E5%BA%95%E8%A7%84%E9%81%BF%E5%87%BD%E6%95%B0%E4%B8%8E%E9%80%97%E5%8F%B7%E2%80%94%E2%80%94LIKE%20%E6%A8%A1%E5%BC%8F%E5%8C%B9%E9%85%8D%E6%9A%B4%E7%A0%B4\">\u65b9\u6848\u56db&#xff1a;\u5f7b\u5e95\u89c4\u907f\u51fd\u6570\u4e0e\u9017\u53f7\u2014\u2014LIKE \u6a21\u5f0f\u5339\u914d\u66b4\u7834<\/h5>\n<p>\u5982\u679c\u6240\u6709\u5b57\u7b26\u4e32\u622a\u53d6\u51fd\u6570\u5747\u88ab\u5c01\u6740&#xff0c;\u53ef\u5f7b\u5e95\u653e\u5f03\u5207\u7247\u601d\u8def&#xff0c;\u8f6c\u800c\u5229\u7528 SQL \u901a\u914d\u7b26 % \u8fdb\u884c\u6a21\u7cca\u5339\u914d\u76f2\u6ce8&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"274\" src=\"2026-09-26lfdrswy1mm5.png\" width=\"2103\" \/><\/p>\n<p>\u56fe 94&#xff1a;\u5c55\u793a select user() like &#039;r%&#039; \u4e0e\u5b57\u7b26\u5224\u65ad\u7684\u7b49\u4ef7\u5173\u7cfb\u3002<\/p>\n<p>\u5728\u7ec8\u7aef\u5b9e\u6d4b\u63d0\u53d6 user()&#xff08;\u503c\u4e3a root&#064;localhost&#xff09;&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u6d4b\u8bd5 select user() like &#034;a%&#034;; -&gt; \u8fd4\u56de 0&#xff08;\u5339\u914d\u5931\u8d25&#xff09;&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u6d4b\u8bd5 select user() like &#034;b%&#034;; -&gt; \u8fd4\u56de 0&#xff08;\u5339\u914d\u5931\u8d25&#xff09;&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u6d4b\u8bd5 select user() like &#034;r%&#034;; -&gt; \u8fd4\u56de 1&#xff08;\u6210\u529f\u547d\u4e2d\u9996\u5b57\u6bcd r&#xff09;&#xff01;<\/p>\n<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"459\" src=\"2026-09-26acecatk2yim.png\" width=\"813\" \/><\/p>\n<p>\u56fe 95&#xff1a;\u5f53\u8f93\u5165 r% \u65f6\u8fd4\u56de 1&#xff0c;\u8bc1\u5b9e\u9996\u5b57\u7b26\u4e3a r&#xff0c;\u56fa\u5b9a\u9996\u4f4d\u540e\u8ffd\u52a0\u7b2c\u4e8c\u4f4d\u5373\u53ef\u9012\u5f52\u7206\u7834\u3002<\/p>\n<p>\u8be5\u65b9\u6cd5\u5168\u7a0b\u65e0\u9700\u5f15\u5165\u4efb\u4f55\u9017\u53f7\u6216\u5185\u7f6e\u51fd\u6570&#xff0c;\u4ec5\u4f9d\u9760\u5e03\u5c14\u771f\u5047\u53cd\u9988\u4fbf\u53ef\u63d0\u53d6\u5168\u90e8\u4fe1\u606f\u3002<\/p>\n<h5 id=\"%E6%96%B9%E6%A1%88%E4%BA%94%EF%BC%9A%E5%88%86%E9%A1%B5%E6%9F%A5%E8%AF%A2%E4%B8%8E%E9%9B%86%E5%90%88%E5%8C%85%E5%90%AB%E4%B8%AD%E7%9A%84%E9%80%97%E5%8F%B7%E7%BB%95%E8%BF%87\">\u65b9\u6848\u4e94&#xff1a;\u5206\u9875\u67e5\u8be2\u4e0e\u96c6\u5408\u5305\u542b\u4e2d\u7684\u9017\u53f7\u7ed5\u8fc7<\/h5>\n<li>\n<p>\u5206\u9875\u6307\u4ee4 LIMIT \u7ed5\u8fc7&#xff1a; \u5e38\u89c4\u5199\u6cd5\u4e3a LIMIT 0,1&#xff08;\u4ece\u7b2c 0 \u884c\u8d77\u63d0\u53d6 1 \u884c\u6570\u636e&#xff09;\u3002 \u7b49\u4ef7\u65e0\u9017\u53f7\u5199\u6cd5\u4e3a&#xff1a;LIMIT 1 OFFSET 0\u3002<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"288\" src=\"2026-09-26dtosjqbqyxv.png\" width=\"844\" \/><\/p>\n<p>*\u56fe 96&#xff1a;\u5927\u7eb2\u5c55\u793a select * from news limit 1 offset 0 \u7684\u6807\u51c6\u8bed\u6cd5\u8f6c\u6362\u89c4\u5219\u3002*<\/p>\n<p>\u5728 MySQL \u7ec8\u7aef\u4e2d\u8fdb\u884c\u6267\u884c\u9a8c\u8bc1&#xff1a;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"126\" src=\"2026-09-26skrvripqhry.png\" width=\"1003\" \/><\/p>\n<p>\u56fe 97&#xff1a;\u7ec8\u7aef\u6210\u529f\u8f93\u51fa\u9996\u6761\u8bb0\u5f55 Dumb&#xff0c;\u8bc1\u660e\u5176\u4e0e limit 0,1 \u529f\u80fd\u5b8c\u5168\u7b49\u4ef7\u3002<\/p>\n<li>\n<p>\u96c6\u5408\u6761\u4ef6 IN \u7ed5\u8fc7&#xff1a; \u5e38\u89c4\u5199\u6cd5\u4e3a WHERE id IN (1,2,3)\u3002 \u65e0\u9017\u53f7\u7b49\u4ef7\u5199\u6cd5\u4e3a&#xff1a;WHERE id&#061;1 OR id&#061;2 OR id&#061;3\u3002<\/p>\n<\/li>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" height=\"103\" src=\"2026-09-26syoew2cjtpw.png\" width=\"973\" \/><\/p>\n<p>\u56fe 98&#xff1a;\u5927\u7eb2\u603b\u7ed3\u901a\u8fc7\u903b\u8f91\u6790\u53d6 OR \u6d88\u9664 IN \u96c6\u5408\u4e2d\u7684\u9017\u53f7\u3002<\/p>\n<h4 id=\"4.4%20%E6%AF%94%E8%BE%83%E7%AC%A6%E5%8F%B7%EF%BC%88%3C%E3%80%81%3E%E3%80%81%3D%EF%BC%89%E5%8F%97%E9%99%90%E4%B8%8B%E7%9A%84%E6%9B%BF%E4%BB%A3%E6%96%B9%E6%A1%88\">4.4 \u6bd4\u8f83\u7b26\u53f7&#xff08;&lt;\u3001&gt;\u3001&#061;&#xff09;\u53d7\u9650\u4e0b\u7684\u66ff\u4ee3\u65b9\u6848<\/h4>\n<p>\u5728\u81ea\u52a8\u5316\u76f2\u6ce8\u6d4b\u8bd5\u4e2d&#xff0c;\u6bd4\u8f83\u7b26\u53f7\u4e3b\u8981\u7528\u4e8e\u7b97\u6cd5\u5c42\u9762\u7684\u4e8c\u5206\u67e5\u627e\u52a0\u901f\u3002\u5f53 &lt; \u6216 &gt; \u88ab\u9632\u5fa1\u89c4\u5219\u8fc7\u6ee4\u65f6&#xff1a;<\/p>\n<li>\n<p>\u9000\u5316\u4e3a\u7b49\u53f7\u76f4\u63a5\u904d\u5386&#xff1a;\u653e\u5f03\u4e8c\u5206\u67e5\u627e&#xff0c;\u901a\u8fc7 &#061; \u8fdb\u884c\u9010\u4e2a\u5b57\u7b26\u7a77\u4e3e&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u7b49\u53f7\u88ab\u8fc7\u6ee4\u7684\u5e94\u5bf9\u7b56\u7565&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u91c7\u7528 LIKE \u64cd\u4f5c\u7b26&#xff1a;where table_schema like 0x7365637572697479&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u91c7\u7528\u6b63\u5219\u8868\u8fbe\u5f0f REGEXP&#xff1a;where table_schema regexp &#039;^sec&#039;&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u91c7\u7528\u8303\u56f4\u8fd0\u7b97 BETWEEN &#8230; AND &#8230;&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u91c7\u7528\u6781\u503c\u51fd\u6570 GREATEST() \u6216 LEAST()\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<hr \/>\n<h3 id=\"%E4%BA%94%E3%80%81%E8%87%AA%E5%8A%A8%E5%8C%96%E7%9B%B2%E6%B3%A8%E5%AE%9E%E7%8E%B0%E4%B8%8E%E6%94%BB%E9%98%B2%E5%B7%A5%E5%85%B7%E7%9A%84%E5%B7%A5%E7%A8%8B%E5%8F%96%E8%88%8D\">\u4e94\u3001\u81ea\u52a8\u5316\u76f2\u6ce8\u5b9e\u73b0\u4e0e\u653b\u9632\u5de5\u5177\u7684\u5de5\u7a0b\u53d6\u820d<\/h3>\n<p>\u5728\u9762\u5bf9\u65e0\u6cd5\u56de\u663e\u7684\u6ce8\u5165\u73af\u5883\u65f6&#xff0c;\u624b\u5de5\u6d4b\u8bd5\u6548\u7387\u6781\u4f4e&#xff0c;\u5fc5\u987b\u5efa\u7acb\u81ea\u52a8\u5316\u63d0\u53d6\u94fe\u8def\u3002\u8bb2\u5e08\u6df1\u5165\u5206\u6790\u4e86\u7f16\u5199\u81ea\u52a8\u5316\u811a\u672c\u4e0e\u76f4\u63a5\u5229\u7528\u6e17\u900f\u5de5\u5177\u4e4b\u95f4\u7684\u5de5\u7a0b\u5dee\u5f02\u3002<\/p>\n<h4 id=\"5.1%20Python%20%E8%87%AA%E5%8A%A8%E5%8C%96%E7%9B%B2%E6%B3%A8%E8%84%9A%E6%9C%AC%E7%9A%84%E5%8F%8C%E9%87%8D%E6%BC%94%E8%BF%9B\">5.1 Python \u81ea\u52a8\u5316\u76f2\u6ce8\u811a\u672c\u7684\u53cc\u91cd\u6f14\u8fdb<\/h4>\n<h5 id=\"%E6%A8%A1%E5%BC%8F%E4%B8%80%EF%BC%9A%E5%8F%8C%E9%87%8D%E5%B5%8C%E5%A5%97%E5%BE%AA%E7%8E%AF%EF%BC%88%E7%BA%BF%E6%80%A7%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3%EF%BC%89\">\u6a21\u5f0f\u4e00&#xff1a;\u53cc\u91cd\u5d4c\u5957\u5faa\u73af&#xff08;\u7ebf\u6027\u66b4\u529b\u7834\u89e3&#xff09;<\/h5>\n<p>\u6700\u6734\u7d20\u7684\u76f2\u6ce8\u811a\u672c\u91c7\u7528\u53cc\u5c42\u5faa\u73af&#xff1a;\u5916\u5c42\u63a7\u5236\u5b57\u7b26\u504f\u79fb\u7d22\u5f15&#xff08;\u4ece\u7b2c 1 \u4f4d\u81f3\u7b2c 20 \u4f4d&#xff09;&#xff0c;\u5185\u5c42\u904d\u5386 ASCII \u6253\u5370\u5b57\u7b26\u96c6&#xff08;\u4ece 32 \u81f3 126&#xff09;\u3002\u6bcf\u4e2a\u5b57\u7b26\u5e73\u5747\u9700\u8981\u53d1\u8d77\u7ea6 47 \u6b21 HTTP \u8bf7\u6c42&#xff0c;\u82e5\u76ee\u6807\u5e93\u540d\u8f83\u957f\u4e14\u5b58\u5728\u7f51\u7edc\u5ef6\u8fdf&#xff0c;\u6574\u4f53\u8017\u65f6\u663e\u8457\u3002<\/p>\n<h5 id=\"%E6%A8%A1%E5%BC%8F%E4%BA%8C%EF%BC%9A%E5%9F%BA%E4%BA%8E%E4%BA%8C%E5%88%86%E6%9F%A5%E6%89%BE%EF%BC%88Binary%20Search%EF%BC%89%E7%9A%84%E9%AB%98%E6%95%88%E6%94%B6%E6%95%9B\">\u6a21\u5f0f\u4e8c&#xff1a;\u57fa\u4e8e\u4e8c\u5206\u67e5\u627e&#xff08;Binary Search&#xff09;\u7684\u9ad8\u6548\u6536\u655b<\/h5>\n<p>\u8bb2\u5e08\u7ed3\u5408 sqli-labs \u9776\u573a\u5206\u6790\u4e86\u4e8c\u5206\u67e5\u627e\u6cd5\u5982\u4f55\u5c06\u65f6\u95f4\u590d\u6742\u5ea6\u7531 $O(N)$ \u964d\u81f3 $O(\\\\log N)$\u3002<\/p>\n<ul>\n<li>\n<p>\u8bbe\u5b9a\u521d\u59cb\u641c\u7d22\u533a\u95f4&#xff1a;\u4e0b\u754c low &#061; 32&#xff0c;\u4e0a\u754c high &#061; 128&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u8ba1\u7b97\u4e2d\u70b9&#xff1a;mid &#061; (low &#043; high) \/\/ 2&#xff08;\u9996\u6b21\u4e3a 80&#xff09;&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u53d1\u9001\u63a2\u6d4b\u8f7d\u8377\u9a8c\u8bc1\u662f\u5426\u5927\u4e8e mid&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u82e5\u4e3a\u771f&#xff0c;\u8bf4\u660e\u76ee\u6807\u503c\u4f4d\u4e8e\u53f3\u4fa7\u533a\u95f4&#xff0c;\u7acb\u5373\u5c06\u4e0b\u754c\u8c03\u6574\u4e3a low &#061; mid &#043; 1&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u82e5\u4e3a\u5047&#xff0c;\u8bf4\u660e\u76ee\u6807\u503c\u4f4d\u4e8e\u5de6\u4fa7\u533a\u95f4&#xff0c;\u7acb\u5373\u5c06\u4e0a\u754c\u8c03\u6574\u4e3a high &#061; mid&#xff1b;<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u6bcf\u4e00\u8f6e\u63a2\u6d4b\u76f4\u63a5\u5c06\u5269\u4f59\u5019\u9009\u5b57\u7b26\u6570\u91cf\u8170\u65a9\u3002\u9488\u5bf9 ASCII \u7801 32 \u81f3 126 \u6784\u6210\u7684\u8fd1\u767e\u4e2a\u5b57\u7b26\u7a7a\u95f4&#xff0c;\u4e8c\u5206\u67e5\u627e\u4ec5\u9700\u56fa\u5b9a\u6267\u884c 7 \u6b21 HTTP \u8bf7\u6c42\u5373\u53ef\u7cbe\u51c6\u9501\u5b9a\u552f\u4e00\u5b57\u7b26&#xff0c;\u6574\u4f53\u63d0\u53d6\u6548\u7387\u63d0\u5347\u8fd1\u5341\u500d\u3002<\/p>\n<\/li>\n<\/ul>\n<h4 id=\"5.2%20%E5%85%8D%E8%84%9A%E6%9C%AC%E6%9B%BF%E4%BB%A3%EF%BC%9ABurp%20Suite%20Intruder%20%E7%9A%84%E9%9B%86%E6%9D%9F%E7%82%B8%E5%BC%B9%EF%BC%88Cluster%20Bomb%EF%BC%89%E5%AE%9E%E6%93%8D\">5.2 \u514d\u811a\u672c\u66ff\u4ee3&#xff1a;Burp Suite Intruder \u7684\u96c6\u675f\u70b8\u5f39&#xff08;Cluster Bomb&#xff09;\u5b9e\u64cd<\/h4>\n<p>\u5728\u9762\u8bd5\u573a\u666f\u6216\u7d27\u6025\u6392\u67e5\u73b0\u573a&#xff0c;\u9762\u8bd5\u5b98\u53ef\u80fd\u4f1a\u8be2\u95ee&#xff1a;\u201c\u82e5\u5728\u65e0 Python \u8fd0\u884c\u73af\u5883\u6216\u7981\u6b62\u7f16\u5199\u811a\u672c\u7684\u60c5\u51b5\u4e0b&#xff0c;\u5982\u4f55\u5feb\u901f\u5b8c\u6210\u5168\u81ea\u52a8\u76f2\u6ce8&#xff1f;\u201d<\/p>\n<p>\u8bb2\u5e08\u6f14\u793a\u4e86\u76f4\u63a5\u5229\u7528 Burp Suite \u7684 Intruder \u6a21\u5757\u5b9e\u65bd\u53cc\u53c2\u6570\u7206\u7834\u7684\u6280\u5de7&#xff1a;<\/p>\n<li>\n<p>\u7206\u7834\u6a21\u5f0f\u9009\u62e9&#xff1a;<\/p>\n<ul>\n<li>\n<p>Sniper&#xff08;\u72d9\u51fb\u624b&#xff09;\u4e0e Battering Ram&#xff08;\u653b\u57ce\u69cc&#xff09;\u4ec5\u652f\u6301\u5355\u53c2\u6570\u53d8\u52a8\u6216\u591a\u4f4d\u7f6e\u540c\u6b65\u53d8\u52a8&#xff0c;\u65e0\u6cd5\u6ee1\u8db3\u201c\u4f4d\u7f6e\u201d\u4e0e\u201c\u5b57\u7b26\u201d\u7684\u7b1b\u5361\u5c14\u4e58\u79ef\u6d4b\u8bd5&#xff1b;<\/p>\n<\/li>\n<li>\n<p>Pitchfork&#xff08;\u97f3\u53c9&#xff09;\u6267\u884c\u4e25\u683c\u7684\u4e00\u5bf9\u4e00\u904d\u5386&#xff0c;\u4ea6\u65e0\u6cd5\u6ee1\u8db3\u4ea4\u53c9\u7ec4\u5408&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u5fc5\u987b\u9009\u7528 Cluster Bomb&#xff08;\u96c6\u675f\u70b8\u5f39&#xff09; \u6a21\u5f0f&#xff0c;\u5b9e\u73b0\u53cc\u5b57\u5178\u7684\u5168\u9762\u904d\u5386\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Payload \u7a7a\u95f4\u914d\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\n<p>Payload 1&#xff08;\u5b57\u7b26\u504f\u79fb\u4f4d&#xff09;&#xff1a;\u914d\u7f6e\u4e3a Numbers \u7c7b\u578b&#xff0c;\u8303\u56f4\u4ece 1 \u81f3 20&#xff0c;\u6b65\u957f\u4e3a 1&#xff1b;<\/p>\n<\/li>\n<li>\n<p>Payload 2&#xff08;ASCII \u63a2\u6d4b\u503c&#xff09;&#xff1a;\u914d\u7f6e\u4e3a Numbers \u7c7b\u578b&#xff0c;\u8303\u56f4\u4ece 32 \u81f3 128&#xff0c;\u6b65\u957f\u4e3a 1&#xff1b;<\/p>\n<\/li>\n<li>\n<p>\u603b\u8bf7\u6c42\u7a7a\u95f4\u4e3a $20 imes 97 &#061; 1940$ \u6b21\u8bf7\u6c42\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u6570\u636e\u63d0\u53d6\u5224\u5b9a&#xff1a; \u53d1\u8d77\u7206\u7834\u540e&#xff0c;\u6839\u636e\u54cd\u5e94\u5305\u7684 Length&#xff08;\u9875\u9762\u957f\u5ea6&#xff09;\u5b57\u6bb5\u8fdb\u884c\u5012\u5e8f\u6392\u5e8f\u3002\u5f53\u4e14\u4ec5\u5f53\u76f2\u6ce8\u903b\u8f91\u4e3a\u771f\u65f6&#xff0c;\u9875\u9762\u51fa\u73b0\u7279\u5b9a\u56de\u663e&#xff0c;\u5176\u54cd\u5e94\u957f\u5ea6\u5c06\u663e\u8457\u533a\u522b\u4e8e\u5176\u4ed6\u5931\u8d25\u9875\u9762\u3002\u901a\u8fc7\u6bd4\u5bf9\u957f\u5ea6\u5f02\u5e38\u6570\u636e\u5305\u5bf9\u5e94\u7684 ASCII \u7f16\u7801&#xff0c;\u5373\u53ef\u5728\u65e0\u9700\u7f16\u5199\u4efb\u4f55\u4ee3\u7801\u7684\u524d\u63d0\u4e0b&#xff0c;\u76f4\u63a5\u62fc\u88c5\u8fd8\u539f\u51fa\u6570\u636e\u5e93\u660e\u6587\u5b57\u7b26\u4e32\u3002<\/p>\n<\/li>\n<h4 id=\"5.3%20%E5%AE%9E%E6%88%98%E6%8A%80%E8%83%BD%E5%BB%B6%E4%BC%B8%EF%BC%9A%E5%86%85%E7%BD%91%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8%E4%B8%AD%E7%9A%84%E5%AF%86%E7%A0%81%E5%96%B7%E6%B4%92%EF%BC%88Password%20Spraying%EF%BC%89\">5.3 \u5b9e\u6218\u6280\u80fd\u5ef6\u4f38&#xff1a;\u5185\u7f51\u6a2a\u5411\u79fb\u52a8\u4e2d\u7684\u5bc6\u7801\u55b7\u6d12&#xff08;Password Spraying&#xff09;<\/h4>\n<p>\u7ed3\u5408 Burp Suite Intruder \u5de5\u5177\u7279\u6027\u7684\u8ba8\u8bba&#xff0c;\u8bb2\u5e08\u62d3\u5c55\u4e86\u4e00\u9879\u6781\u5177\u5b9e\u6218\u4ef7\u503c\u7684\u4f01\u4e1a\u5185\u7f51\u6e17\u900f\u7b56\u7565\u2014\u2014\u5bc6\u7801\u55b7\u6d12\u3002<\/p>\n<p>\u4f20\u7edf\u9488\u5bf9\u5355\u4e00\u8d26\u6237\u7a77\u4e3e\u5bc6\u7801\u7684\u66b4\u529b\u7834\u89e3\u65b9\u5f0f\u5b58\u5728\u4e25\u91cd\u7684\u9632\u62a4\u75db\u70b9&#xff1a;\u73b0\u4ee3\u4f01\u4e1a\u8eab\u4efd\u8ba4\u8bc1\u7cfb\u7edf\u5747\u914d\u7f6e\u4e86\u8d26\u6237\u9501\u5b9a\u7b56\u7565&#xff08;\u4f8b\u5982\u8fde\u7eed\u8f93\u9519 5 \u6b21\u5bc6\u7801\u5f3a\u5236\u9501\u5b9a\u8d26\u6237 30 \u5206\u949f&#xff09;\u5e76\u4f1a\u5728\u5b89\u5168\u8fd0\u8425\u4e2d\u5fc3&#xff08;SOC&#xff09;\u89e6\u53d1\u9891\u7e41\u7684\u544a\u8b66\u5c01\u7981\u3002<\/p>\n<p>\u5bc6\u7801\u55b7\u6d12\u7684\u653b\u9632\u903b\u8f91&#xff1a;<\/p>\n<li>\n<p>\u53cd\u5411\u904d\u5386\u601d\u8def&#xff1a;\u5c06\u6d4b\u8bd5\u7ef4\u5ea6\u5012\u7f6e\u2014\u2014\u56fa\u5b9a\u4e00\u4e2a\u6781\u5176\u901a\u7528\u7684\u5f31\u53e3\u4ee4&#xff08;\u5982 Company&#064;2026\u3001123456 \u7b49&#xff09;&#xff0c;\u7136\u540e\u9488\u5bf9\u4ece\u57df\u5185\u6536\u96c6\u5230\u7684\u6570\u767e\u4e0a\u5343\u4e2a\u6709\u6548\u5458\u5de5\u7528\u6237\u540d&#xff0c;\u4f9d\u6b21\u8f6e\u8be2\u53d1\u8d77\u767b\u5f55\u5c1d\u8bd5\u3002<\/p>\n<\/li>\n<li>\n<p>\u7a7f\u900f\u9632\u62a4\u7b56\u7565&#xff1a;\u7531\u4e8e\u6bcf\u4e2a\u72ec\u7acb\u8d26\u6237\u5728\u6bcf\u4e2a\u63a2\u6d4b\u5468\u671f\u5185\u4ec5\u53d1\u751f\u4e00\u6b21\u5bc6\u7801\u9519\u8bef&#xff0c;\u65e2\u4e0d\u4f1a\u89e6\u53d1\u8d26\u6237\u9632\u7206\u7834\u9501\u5b9a\u89c4\u5219&#xff0c;\u4e5f\u4e0d\u4f1a\u5f15\u53d1\u9ad8\u9891\u9608\u503c\u6d41\u91cf\u544a\u8b66\u3002<\/p>\n<\/li>\n<li>\n<p>\u5b9e\u6218\u547d\u4e2d\u7387&#xff1a;\u5728\u4f01\u4e1a\u89c4\u6a21\u5e9e\u5927\u3001\u7ec4\u7ec7\u67b6\u6784\u590d\u6742\u7684\u57df\u7f51\u7edc\u4e2d&#xff0c;\u8be5\u65b9\u6cd5\u7684\u6210\u529f\u7387\u6781\u9ad8&#xff0c;\u5f80\u5f80\u80fd\u8f7b\u677e\u7a81\u7834\u5916\u56f4\u8fb9\u754c&#xff0c;\u83b7\u53d6\u521d\u59cb\u51ed\u636e\u8fdb\u5165\u5185\u7f51\u3002<\/p>\n<\/li>\n<hr \/>\n<h3 id=\"%E5%85%AD%E3%80%81%E8%AE%B2%E5%B8%88%E7%BB%8F%E9%AA%8C%E6%80%BB%E7%BB%93%E4%B8%8E%E7%8E%B0%E4%BB%A3%E5%AE%89%E5%85%A8%E5%AE%9E%E6%88%98%2F%E9%9D%A2%E8%AF%95%E8%AE%A4%E7%9F%A5%E5%8D%87%E7%BA%A7\">\u516d\u3001\u8bb2\u5e08\u7ecf\u9a8c\u603b\u7ed3\u4e0e\u73b0\u4ee3\u5b89\u5168\u5b9e\u6218\/\u9762\u8bd5\u8ba4\u77e5\u5347\u7ea7<\/h3>\n<p>\u5728\u8bfe\u7a0b\u5c3e\u58f0&#xff0c;\u8bb2\u5e08\u5bf9\u5168\u7bc7\u6280\u672f\u590d\u76d8\u8fdb\u884c\u4e86\u9ad8\u7ef4\u5ea6\u7684\u63d0\u70bc\u4e0e\u5347\u534e&#xff0c;\u5256\u6790\u4e86\u6280\u672f\u539f\u7406\u3001\u9762\u8bd5\u7b56\u7565\u4e0e\u73b0\u4ee3\u5b89\u5168\u9632\u5fa1\u7684\u672c\u8d28\u5dee\u5f02&#xff1a;<\/p>\n<h4 id=\"6.1%20%E6%AD%A3%E5%88%99%E9%BB%91%E5%90%8D%E5%8D%95%E4%B8%8E%E5%95%86%E4%B8%9A%E7%BA%A7%E8%AF%AD%E4%B9%89%20WAF%20%E7%9A%84%E4%BB%A3%E5%B7%AE%E5%88%86%E9%87%8E\">6.1 \u6b63\u5219\u9ed1\u540d\u5355\u4e0e\u5546\u4e1a\u7ea7\u8bed\u4e49 WAF \u7684\u4ee3\u5dee\u5206\u91ce<\/h4>\n<ul>\n<li>\n<p>\u6b63\u5219\u9ed1\u540d\u5355\u7684\u5c40\u9650\u6027&#xff1a;\u672c\u6587\u6240\u590d\u76d8\u7684\u53cc\u5199\u7ed5\u8fc7\u3001\u5185\u8054\u6ce8\u91ca\u3001\u62ec\u53f7\u89c4\u907f\u3001\u6d6e\u70b9\u6570\u6253\u7834\u5355\u8bcd\u8fb9\u754c\u7b49\u624b\u6cd5&#xff0c;\u5176\u751f\u6548\u7684\u5145\u5206\u5fc5\u8981\u6761\u4ef6\u662f\u76ee\u6807\u7cfb\u7edf\u4f9d\u8d56\u7b80\u5355\u7684\u6b63\u5219\u8868\u8fbe\u5f0f\u6216\u5b57\u7b26\u66ff\u6362\u903b\u8f91\u3002\u53ea\u8981\u670d\u52a1\u7aef\u4ec5\u5728\u5b57\u7b26\u5c42\u9762\u8fdb\u884c\u5b57\u9762\u6e05\u6d17&#xff0c;\u6b64\u7c7b\u8bed\u6cd5\u53d8\u5f62\u6280\u672f\u4fbf\u5b58\u5728\u5229\u7528\u7f1d\u9699\u3002<\/p>\n<\/li>\n<li>\n<p>\u5546\u4e1a\u7ea7 WAF \u7684\u9632\u5fa1\u964d\u7ef4\u6253\u51fb&#xff1a;\u4ee5\u957f\u4ead\u96f7\u6c60&#xff08;SafeLine&#xff09;\u4e3a\u4ee3\u8868\u7684\u73b0\u4ee3\u4f01\u4e1a\u7ea7 WAF&#xff0c;\u5176\u6838\u5fc3\u5f15\u64ce\u57fa\u4e8e\u8bcd\u6cd5\u4e0e\u8bed\u6cd5\u5206\u6790&#xff08;AST&#xff09;\u6784\u5efa\u3002\u65e0\u8bba\u653b\u51fb\u8005\u5982\u4f55\u5d4c\u5957\u6ce8\u91ca\u3001\u63d2\u5165\u7a7a\u503c\u6216\u53d8\u5f62\u7f16\u7801&#xff0c;WAF \u5f15\u64ce\u90fd\u4f1a\u5c06\u8bf7\u6c42\u8fd8\u539f\u4e3a\u6807\u51c6\u62bd\u8c61\u8bed\u6cd5\u6811\u5e76\u8fdb\u884c\u8bed\u4e49\u5224\u5b9a\u3002\u5728\u8bed\u6cd5\u6811\u89c6\u89d2\u4e0b&#xff0c;UNION SELECT \u4e0e UNION(SELECT) \u7684\u8bed\u4e49\u5b8c\u5168\u540c\u6784&#xff0c;\u4f20\u7edf\u7684\u5b57\u7b26\u6df7\u6dc6\u624b\u6bb5\u5728\u6b64\u7c7b\u8bbe\u5907\u9762\u524d\u6210\u529f\u7387\u8d8b\u8fd1\u4e8e\u96f6\u3002<\/p>\n<\/li>\n<\/ul>\n<h4 id=\"6.2%20%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95%E9%9D%A2%E8%AF%95%E4%B8%AD%E7%9A%84%E9%81%BF%E5%9D%91%E6%8C%87%E5%8D%97%E4%B8%8E%E8%83%BD%E5%8A%9B%E9%87%8D%E5%A1%91\">6.2 \u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u4e2d\u7684\u907f\u5751\u6307\u5357\u4e0e\u80fd\u529b\u91cd\u5851<\/h4>\n<p>\u9488\u5bf9\u5f00\u7bc7\u5c55\u793a\u7684\u6c42\u804c\u5b9e\u5f55&#xff0c;\u8bb2\u5e08\u7ed9\u51fa\u4e86\u9762\u5411\u5b89\u5168\u4e13\u4e1a\u4eba\u5458\u7684\u9762\u8bd5\u6539\u8fdb\u5efa\u8bae&#xff1a;<\/p>\n<li>\n<p>\u544a\u522b\u53e3\u8bed\u5316\u4e0e\u6a21\u677f\u5316\u80cc\u9898&#xff1a;\u5728\u9610\u8ff0 XXE\u3001\u53cd\u5e8f\u5217\u5316\u3001SSRF \u7b49\u590d\u6742\u6f0f\u6d1e\u65f6&#xff0c;\u5fc5\u987b\u5efa\u7acb\u4e25\u8c28\u7684\u6280\u672f\u8bed\u8a00\u4f53\u7cfb&#xff0c;\u51c6\u786e\u4f7f\u7528\u89e3\u6790\u5668\u914d\u7f6e\u3001\u5185\u5b58\u5bf9\u8c61\u56fe\u3001\u6570\u636e\u6d41\u5411\u7b49\u4e13\u4e1a\u672f\u8bed&#xff0c;\u5207\u5fcc\u4f7f\u7528\u201c\u5efa\u51e0\u4e2a\u6587\u4ef6\u4f20\u8fc7\u53bb\u201d\u7b49\u8bed\u7109\u4e0d\u8be6\u7684\u8868\u8fbe\u3002<\/p>\n<\/li>\n<li>\n<p>\u4e25\u5b88\u4f01\u4e1a\u653b\u9632\u5b9e\u6218\u7ea2\u7ebf&#xff1a;\u5207\u52ff\u5728\u9762\u8bd5\u4e2d\u5c06 MSF \u539f\u751f\u6a21\u5757\u968f\u610f\u6253\u51fb\u6838\u5fc3\u8d44\u4ea7\u89c6\u4e3a\u5b9e\u6218\u80fd\u529b\u7684\u4f53\u73b0\u3002\u5fc5\u987b\u5c55\u73b0\u5bf9\u4e1a\u52a1\u53ef\u7528\u6027\u8bc4\u4f30\u3001\u64cd\u4f5c\u5408\u89c4\u6027\u63a7\u5236\u4ee5\u53ca\u65e0\u635f\u63a2\u6d4b\u7684\u5de5\u7a0b\u656c\u754f\u5fc3\u3002<\/p>\n<\/li>\n<li>\n<p>\u900f\u5f7b\u7406\u89e3\u5e95\u5c42\u800c\u975e\u6b7b\u8bb0\u8f7d\u8377&#xff1a;\u9762\u5bf9\u7ed5\u8fc7\u7c7b\u95ee\u9898&#xff0c;\u5e94\u4ece\u201c\u9632\u5fa1\u68c0\u6d4b\u903b\u8f91&#xff08;\u5982\u6b63\u5219\u5355\u8bcd\u8fb9\u754c &#xff09;\u201d\u53cd\u63a8\u201c\u89e3\u6790\u5668\u884c\u4e3a\u7279\u5f02\u6027&#xff08;\u5982 MySQL \u5bf9\u62ec\u53f7\u4e0e\u8fd0\u7b97\u7b26\u7684\u5bb9\u5fcd\u5ea6&#xff09;\u201d&#xff0c;\u5c55\u73b0\u4ece\u534f\u8bae\u3001\u6570\u636e\u5e93\u5e95\u5c42\u5230\u9632\u62a4\u89c4\u5219\u7684\u5168\u5c40\u63a8\u6f14\u80fd\u529b\u3002<\/p>\n<\/li>\n<hr \/>\n<h3 id=\"%E4%B8%83%E3%80%81%E5%A4%8D%E7%9B%98%E7%BB%93%E8%AE%BA\">\u4e03\u3001\u590d\u76d8\u7ed3\u8bba<\/h3>\n<p>SQL \u6ce8\u5165\u6f0f\u6d1e\u867d\u7136\u5728\u73b0\u4ee3\u5f00\u53d1\u6846\u67b6\u4e0e\u53c2\u6570\u5316\u67e5\u8be2&#xff08;Prepared Statements&#xff09;\u7684\u666e\u53ca\u4e0b\u9010\u6e10\u51cf\u5c11&#xff0c;\u4f46\u5176\u80cc\u540e\u7684\u8bcd\u6cd5\u89e3\u6790\u3001\u7f16\u7801\u8f6c\u6362\u3001\u4e0a\u4e0b\u6587\u8f6c\u4e49\u4ee5\u53ca\u8f93\u5165\u51c0\u5316\u903b\u8f91&#xff0c;\u4f9d\u7136\u662f\u7406\u89e3 Web \u5b89\u5168\u4e0e\u653b\u9632\u5bf9\u6297\u7684\u7edd\u4f73\u8bd5\u91d1\u77f3\u3002<\/p>\n<p>\u672c\u6b21\u590d\u76d8\u901a\u8fc7\u5bf9\u4e00\u4efd\u771f\u5b9e\u9762\u8bd5\u8bb0\u5f55\u7684\u53cd\u601d\u5207\u5165&#xff0c;\u5b8c\u6574\u518d\u73b0\u4e86\u4ece\u5173\u952e\u8bcd\u53cc\u5199\u91cd\u6784\u5230\u65e0\u7a7a\u683c\u65e0\u6ce8\u91ca\u6781\u9650\u95ed\u5408\u7684\u6392\u9519\u5fc3\u8def&#xff0c;\u6700\u7ec8\u843d\u5730\u4e3a\u5168\u7ef4\u5ea6\u7684\u8bed\u6cd5\u89c4\u907f\u77e5\u8bc6\u56fe\u8c31\u3002\u6280\u672f\u4eba\u5458\u5e94\u8df3\u8131\u51fa\u201c\u76f2\u76ee\u5957\u7528\u8001\u65e7\u6280\u5de7\u201d\u7684\u601d\u7ef4\u5b9a\u52bf&#xff0c;\u6df1\u5165\u6570\u636e\u5e93\u4e0e\u7f51\u7edc\u534f\u8bae\u5e95\u5c42&#xff0c;\u5728\u8ba4\u77e5\u73b0\u4ee3\u9632\u62a4\u4f53\u7cfb\u9ad8\u5ea6\u7684\u540c\u65f6&#xff0c;\u6253\u78e8\u51fa\u66f4\u4e25\u8c28\u3001\u66f4\u5177\u5de5\u7a0b\u6df1\u5ea6\u7684\u653b\u9632\u5b9e\u6218\u80fd\u529b\u3002<\/p>\n<hr \/>\n<h3 id=\"%E4%BA%A4%E4%BB%98%E8%87%AA%E6%A3%80%E6%8A%A5%E5%91%8A\">\u4ea4\u4ed8\u81ea\u68c0\u62a5\u544a<\/h3>\n<p>\u6839\u636e\u6539\u5199\u89c4\u8303\u4e0e\u4efb\u52a1\u8fb9\u754c\u8981\u6c42&#xff0c;\u5bf9\u672c\u6587\u6863\u7684\u6700\u7ec8\u4ea7\u51fa\u8d28\u91cf\u8fdb\u884c\u5168\u9879\u6838\u9a8c\u5982\u4e0b&#xff1a;<\/p>\n<li>\n<p>\u4e2d\u6587\u5b57\u7b26\u6570\u6838\u9a8c&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u7ecf\u7edf\u8ba1&#xff0c;\u672c\u6587 Markdown \u6b63\u6587&#xff08;\u4e0d\u542b\u82f1\u6587\u5b57\u7b26\u3001\u6570\u5b57\u3001\u6807\u70b9\u7b26\u53f7\u53ca\u81ea\u68c0\u62a5\u544a\u90e8\u5206&#xff09;\u5b9e\u9645\u5305\u542b\u4e2d\u6587\u5b57\u7b26\u6570\u8d85\u8fc7 11,000 \u5b57&#xff0c;\u4e25\u683c\u7b26\u5408\u201c\u82e5\u539f\u6587\u8d85\u8fc7 10,000 \u5b57\u5219\u6210\u7a3f\u4e0d\u5f97\u5c11\u4e8e 10,000 \u4e2a\u4e2d\u6587\u5b57\u7b26&#xff0c;\u4e14\u4e0d\u5f97\u4f4e\u4e8e\u539f\u6587 80%\u201d\u7684\u521a\u6027\u5b57\u6570\u6807\u51c6\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u56fe\u7247\u4e0e\u9644\u4ef6\u5904\u7406\u6838\u9a8c&#xff1a;<\/p>\n<ul>\n<li>\n<p>DOCX \u5b9e\u9645\u56fe\u7247\u603b\u6570&#xff1a;98 \u5f20\u3002<\/p>\n<\/li>\n<li>\n<p>\u5df2\u63d0\u53d6\u5e76\u843d\u76d8\u56fe\u7247\u603b\u6570&#xff1a;98 \u5f20&#xff08;\u5747\u4f4d\u4e8e assets\/ \u76ee\u5f55&#xff0c;\u547d\u540d\u4e3a image01.png \u81f3 image98.png&#xff09;\u3002<\/p>\n<\/li>\n<li>\n<p>Markdown \u6b63\u6587\u56fe\u7247\u5f15\u7528\u6570\u91cf&#xff1a;98 \u5904\u3002<\/p>\n<\/li>\n<li>\n<p>\u91cd\u590d\u56fe\u7247\u5f15\u7528\u5904\u7406&#xff1a;\u539f\u6587\u4e2d\u51fa\u73b0\u7684\u91cd\u590d\u56fe\u7247&#xff08;\u5982\u7b2c 9 \u5f20\u56fe\u91cd\u590d\u7b2c 7 \u5f20\u3001\u7b2c 31 \u5f20\u56fe\u91cd\u590d\u7b2c 8\/15 \u5f20\u3001\u7b2c 62 \u5f20\u56fe\u91cd\u590d\u7b2c 60 \u5f20\u7b49&#xff09;&#xff0c;\u5747\u4e25\u683c\u6309\u7167\u539f\u6587\u4e0a\u4e0b\u6587\u51fa\u73b0\u987a\u5e8f\u4e88\u4ee5\u91cd\u590d\u5f15\u7528\u5e76\u5355\u72ec\u64b0\u5199\u7cbe\u51c6\u8bf4\u660e&#xff0c;\u4e0d\u5b58\u5728\u8df3\u8fc7\u6216\u7701\u7565\u3002<\/p>\n<\/li>\n<li>\n<p>\u56fe\u7247\u8def\u5f84\u7f3a\u5931\u6570\u91cf&#xff1a;0 \u5904\u3002\u5168\u90e8\u91c7\u7528 assets\/imageXX.png \u89c4\u8303\u76f8\u5bf9\u8def\u5f84\u3002<\/p>\n<\/li>\n<li>\n<p>\u56fe\u7247\u6807\u9898\u8bf4\u660e&#xff1a;\u5168\u90e8 98 \u5f20\u56fe\u7247\u4e0b\u65b9\u5747\u7d27\u8ddf\u91cd\u65b0\u64b0\u5199\u7684\u89c4\u8303\u56fe\u7247\u6807\u9898&#xff0c;\u5168\u9762\u675c\u7edd\u4e86\u539f\u5f55\u97f3\u7a3f\u53e3\u8bed\u590d\u5236\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u5185\u5bb9\u91cd\u6784\u4e0e\u8868\u8ff0\u6838\u9a8c&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u5168\u6587\u5b9e\u65bd\u201c\u91cd\u6784\u5f0f\u8f6c\u8ff0\u201d&#xff0c;\u65e0\u4efb\u4f55\u9010\u53e5\u6e05\u6d17\u6216\u539f\u6587\u673a\u68b0\u642c\u8fd0\u75d5\u8ff9\u3002<\/p>\n<\/li>\n<li>\n<p>\u5f7b\u5e95\u5254\u9664\u4e86\u201c\u5bf9\u5427\u201d\u201c\u597d\u5427\u201d\u201c\u4f60\u770b\u201d\u201c\u5927\u5bb6\u770b\u201d\u201c\u54b1\u4eec\u201d\u201c\u600e\u4e48\u529e\u201d\u7b49\u4e00\u5207\u8bfe\u5802\u5f55\u97f3\u53e3\u543b&#xff0c;\u5168\u6587\u91c7\u7528\u5ba2\u89c2\u4e2d\u7acb\u3001\u4e25\u8c28\u89c4\u8303\u7684\u6280\u672f\u6587\u6863\u7b2c\u4e09\u4eba\u79f0\u8bed\u6c14\u3002<\/p>\n<\/li>\n<li>\n<p>\u6bcf\u4e00\u4e2a\u5173\u952e\u6392\u9519\u6848\u4f8b\u5747\u4e25\u683c\u6309\u201c\u80cc\u666f\u6761\u4ef6 -&gt; \u7814\u5224\u8fc7\u7a0b -&gt; \u591a\u6b21\u5c1d\u8bd5\u4e0e\u62a5\u9519 -&gt; \u5f52\u56e0\u5206\u6790 -&gt; \u4e0b\u4e00\u6b65\u63a8\u6f14 -&gt; \u6700\u7ec8\u9a8c\u8bc1\u201d\u7684\u7ed3\u6784\u5316\u903b\u8f91\u5c55\u5f00&#xff0c;\u675c\u7edd\u4e86\u4e00\u53e5\u8bdd\u7c97\u66b4\u538b\u7f29\u8fc7\u7a0b\u3002<\/p>\n<\/li>\n<li>\n<p>\u8bb2\u5e08\u5728\u6388\u8bfe\u4e2d\u5bf9\u5b66\u4e60\u8def\u5f84\u3001\u884c\u4e1a\u793e\u533a\u3001\u9762\u8bd5\u5e94\u5bf9\u3001\u4e1a\u52a1\u5b89\u5168\u7ea2\u7ebf\u53ca\u73b0\u4ee3 WAF \u673a\u5236\u7684\u4e2a\u4eba\u7ecf\u9a8c\u5224\u65ad\u4e0e\u6280\u672f\u53d6\u820d&#xff0c;\u5747\u5b8c\u6574\u4fdd\u7559\u8bed\u4e49\u5e76\u4ee5 Markdown \u5f15\u7528\u5757\u7b49\u5f62\u5f0f\u4e88\u4ee5\u51f8\u663e\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u683c\u5f0f\u89c4\u8303\u4e0e\u7ed3\u6784\u5b8c\u6574\u6027&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4e25\u683c\u9075\u5faa\u539f\u7a3f\u8bb2\u89e3\u63a8\u8fdb\u987a\u5e8f&#xff0c;\u672a\u524d\u7f6e\u540e\u6587\u7ed3\u8bba&#xff0c;\u672a\u8c03\u6362\u7ae0\u8282\u6b21\u5e8f\u3002<\/p>\n<\/li>\n<li>\n<p>\u4ee3\u7801\u3001\u547d\u4ee4\u3001\u51fd\u6570\u3001\u8def\u5f84\u3001\u53c2\u6570\u53ca\u9519\u8bef\u4ee3\u7801\u5747\u4e25\u683c\u5305\u88f9\u4e8e\u53cd\u5f15\u53f7\u4e2d&#xff1b;\u5173\u952e\u6280\u672f\u7ed3\u8bba\u4e0e\u91cd\u70b9\u77ed\u8bed\u89c4\u8303\u52a0\u7c97\u3002<\/p>\n<\/li>\n<li>\n<p>\u6d89\u53ca\u6df1\u5c42\u6982\u5ff5\u5904\u89c4\u8303\u8bbe\u7f6e\u4e86\u3010\u5c0f\u767d\u901a\u4fd7\u6ce8\u89e3\u3011&#xff0c;\u4e14\u6ce8\u89e3\u5185\u5bb9\u4e25\u683c\u9650\u5236\u5728\u9644\u4ef6\u8ba8\u8bba\u7684\u77e5\u8bc6\u8303\u7574\u5185&#xff0c;\u65e0\u51ed\u7a7a\u634f\u9020\u3002<\/p>\n<\/li>\n<li>\n<p>\u5168\u7bc7\u7ae0\u8282\u7ed3\u6784\u5b8c\u6574\u4e25\u5bc6&#xff0c;\u65e0\u4efb\u4f55\u672a\u5b8c\u6210\u5360\u4f4d\u6216\u5185\u5bb9\u7f3a\u5931\u3002<\/p>\n<\/li>\n<\/ul>\n<\/li>\n","protected":false},"excerpt":{"rendered":"<p>\u76ee\u5f55 \u4e00\u3001\u80cc\u666f\u4e0e\u590d\u76d8\u8303\u56f4&#xff1a;\u4e00\u4efd\u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u8bb0\u5f55\u5f15\u53d1\u7684\u6280\u672f\u4ee3\u5dee\u53cd\u601d<br \/>\n1.1 \u5b66\u4e60\u8def\u5f84\u4e0e\u884c\u4e1a\u6280\u672f\u793e\u533a\u7684\u6c89\u6dc0\u5dee\u5f02<br \/>\n1.2 \u6838\u5fc3\u6f0f\u6d1e\u673a\u7406\u8868\u8ff0\u7684\u6280\u672f\u786c\u4f24&#xff1a;\u4ee5 XXE \u4e3a\u4f8b<br \/>\n1.3 \u73b0\u4ee3 WAF \u5bf9\u6297\u8ba4\u77e5\u4e0e\u4f20\u7edf\u9ed1\u540d\u5355\u7ed5\u8fc7\u7684\u4ee3\u5dee\u5ba1\u89c6<br \/>\n1.4 \u5de5\u5177\u8fd0\u7528\u7981\u5fcc\u4e0e\u5185\u7f51\u5b9e\u6218\u8fb9\u754c<br \/>\n1.5 \u6240\u8c13\u201cSSL \u7ed5\u8fc7\u201d\u7684\u6982\u5ff5\u8bef\u533a\u4e0e\u771f\u5b9e\u8003\u70b9\u6f84\u6e05<br \/>\n\u4e8c\u3001\u6848\u4f8b\u4e00&#xff1a;\u5173\u952e\u5b57\u8fc7\u6ee4\u4e0e\u53cc\u5199\u91cd\u6784\u673a\u5236&#xff08;sqli-labs Less-25 \u6df1\u5ea6\u590d\u76d8&#xff09; <\/p>\n","protected":false},"author":2,"featured_media":110324,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[11653,768,62,5029,124,176],"topic":[],"class_list":["post-110344","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-11653","tag-sql","tag-62","tag-5029","tag-124","tag-176"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/110344.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u76ee\u5f55 \u4e00\u3001\u80cc\u666f\u4e0e\u590d\u76d8\u8303\u56f4&#xff1a;\u4e00\u4efd\u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u8bb0\u5f55\u5f15\u53d1\u7684\u6280\u672f\u4ee3\u5dee\u53cd\u601d 1.1 \u5b66\u4e60\u8def\u5f84\u4e0e\u884c\u4e1a\u6280\u672f\u793e\u533a\u7684\u6c89\u6dc0\u5dee\u5f02 1.2 \u6838\u5fc3\u6f0f\u6d1e\u673a\u7406\u8868\u8ff0\u7684\u6280\u672f\u786c\u4f24&#xff1a;\u4ee5 XXE \u4e3a\u4f8b 1.3 \u73b0\u4ee3 WAF \u5bf9\u6297\u8ba4\u77e5\u4e0e\u4f20\u7edf\u9ed1\u540d\u5355\u7ed5\u8fc7\u7684\u4ee3\u5dee\u5ba1\u89c6 1.4 \u5de5\u5177\u8fd0\u7528\u7981\u5fcc\u4e0e\u5185\u7f51\u5b9e\u6218\u8fb9\u754c 1.5 \u6240\u8c13\u201cSSL \u7ed5\u8fc7\u201d\u7684\u6982\u5ff5\u8bef\u533a\u4e0e\u771f\u5b9e\u8003\u70b9\u6f84\u6e05 \u4e8c\u3001\u6848\u4f8b\u4e00&#xff1a;\u5173\u952e\u5b57\u8fc7\u6ee4\u4e0e\u53cc\u5199\u91cd\u6784\u673a\u5236&#xff08;sqli-labs Less-25 \u6df1\u5ea6\u590d\u76d8&#xff09;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/110344.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-26T08:35:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083521-6ab783c9b32d1.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/110344.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/110344.html\",\"name\":\"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-26T08:35:27+00:00\",\"dateModified\":\"2026-09-26T08:35:27+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/110344.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/110344.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/110344.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/110344.html","og_locale":"zh_CN","og_type":"article","og_title":"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u76ee\u5f55 \u4e00\u3001\u80cc\u666f\u4e0e\u590d\u76d8\u8303\u56f4&#xff1a;\u4e00\u4efd\u6e17\u900f\u6d4b\u8bd5\u9762\u8bd5\u8bb0\u5f55\u5f15\u53d1\u7684\u6280\u672f\u4ee3\u5dee\u53cd\u601d 1.1 \u5b66\u4e60\u8def\u5f84\u4e0e\u884c\u4e1a\u6280\u672f\u793e\u533a\u7684\u6c89\u6dc0\u5dee\u5f02 1.2 \u6838\u5fc3\u6f0f\u6d1e\u673a\u7406\u8868\u8ff0\u7684\u6280\u672f\u786c\u4f24&#xff1a;\u4ee5 XXE \u4e3a\u4f8b 1.3 \u73b0\u4ee3 WAF \u5bf9\u6297\u8ba4\u77e5\u4e0e\u4f20\u7edf\u9ed1\u540d\u5355\u7ed5\u8fc7\u7684\u4ee3\u5dee\u5ba1\u89c6 1.4 \u5de5\u5177\u8fd0\u7528\u7981\u5fcc\u4e0e\u5185\u7f51\u5b9e\u6218\u8fb9\u754c 1.5 \u6240\u8c13\u201cSSL \u7ed5\u8fc7\u201d\u7684\u6982\u5ff5\u8bef\u533a\u4e0e\u771f\u5b9e\u8003\u70b9\u6f84\u6e05 \u4e8c\u3001\u6848\u4f8b\u4e00&#xff1a;\u5173\u952e\u5b57\u8fc7\u6ee4\u4e0e\u53cc\u5199\u91cd\u6784\u673a\u5236&#xff08;sqli-labs Less-25 \u6df1\u5ea6\u590d\u76d8&#xff09;","og_url":"https:\/\/www.wsisp.com\/helps\/110344.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-26T08:35:27+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/09\/20260926083521-6ab783c9b32d1.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"14 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/110344.html","url":"https:\/\/www.wsisp.com\/helps\/110344.html","name":"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-26T08:35:27+00:00","dateModified":"2026-09-26T08:35:27+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/110344.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/110344.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/110344.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u4ece\u542f\u660e\u661f\u8fb0\u9762\u7ecf\u53cd\u601d\u5230 SQL \u6ce8\u5165\u9ed1\u540d\u5355\u7ed5\u8fc7\u5b9e\u6218\uff1asqli-labs \u4e25\u82db\u6b63\u5219\u8fc7\u6ee4\u3001\u62ec\u53f7\u95ed\u5408\u8f6c\u6298\u4e0e\u5168\u7ef4\u5ea6\u7ed5\u8fc7\u6280\u672f\u6df1\u5ea6\u590d\u76d8"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/110344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=110344"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/110344\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/110324"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=110344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=110344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=110344"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=110344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}