IBM Security AppScan Glass Box???????μ??????????
???????????? ???????[ 2014/8/4 15:27:52 ] ??????????????? ???????
????AppScan ??????Σ???????淢???????????? AppScan ?? Username ?? Password ???????"'"??????????????????"Syntax error: Encountered "'" at line 1?? column 63. "???????? Response ?в?δ???? SQL ??????????? AppScan ????ж??????? SQL ????????
????? 3. ??????????????
??
???????????????д????????????????????????????????????????????? SQL ?????????????? 4 ?????Glass Box ??????????????????????????? g'[number]b???????????????????????????????? SQL ?????????????? Glass Box ???ж?????????? SQL ????????
????? 4.SQL ?????
????3. ??????????Σ??????????????????????????
?????????? AltoroJ ???????????????????????ú?в??????? Glass Box ??????????????????AppScan ???????? Username ?? Password ???????????"4ppSc4n"??"A' OR '7659'='7659"??????????????? SQL ????????AppScan ?г???"SQL ?????????·"???????????"???? / ???"?????????????????????? doLogin ??? servlet ?У???? 5 ?????
????? 5.AppScan “???? / ???”
????
??????????? WEB-IBF/web.xml ?е??????????ж??????????? LoginServlet.java ????С?
?????嵥 1.web.xml ????е? LoginServlet ????
<servlet-mapping>
<servlet-name>LoginServlet</servlet-name>
<url-pattern>/doLogin</url-pattern>
</servlet-mapping>
<servlet>
<description>
</description>
<display-name>
LoginServlet</display-name>
<servlet-name>LoginServlet</servlet-name>
<servlet-class>
com.ibm.rational.appscan.altoromutual.servlet.LoginServlet
</servlet-class>
</servlet>
?????? LoginServlet.java ????????????????????ж?????????λ??????????????????????????????????????????????????
?????嵥 2. LoginServlet.java ????д???????????
????if (!DBUtil.isValidUser(username?? password))
???????????????? DBUtil ???е? isValidUser ????????????????????? sql ???
?????嵥 3. ????????? SQL ???
????ResultSet resultSet = statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID
????= '"+ user +"' AND PASSWORD='" + password + "'");
????/* BAD - user input should always be sanitized */
???????????????????????????????????????????????????λ????? java ????????Щ???裬???????????£????????????????????????????? Glass Box ????????????????????????????λ????????????Glass Box ??????????????λ????????緽????????????????????к??????????????????????????? 6 ?????
????? 6. Glass Box ???????
??
???????
??????в??????????????????ó??????????????????踲????????????????????????????????в?????????????????????????????????????????????? Glass Box ???б???????в?????в?????????????????????Ч??????????????????????????
??????
???·???
??????????????????
2023/3/23 14:23:39???д?ò??????????
2023/3/22 16:17:39????????????????????Щ??
2022/6/14 16:14:27??????????????????????????
2021/10/18 15:37:44???????????????
2021/9/17 15:19:29???·???????·
2021/9/14 15:42:25?????????????
2021/5/28 17:25:47??????APP??????????
2021/5/8 17:01:11