IBM Security AppScan Glass Box???????μ??????????

????? 3. ??????????????

??
???????????????д????????????????????????????????????????????? SQL ?????????????? 4 ?????Glass Box ??????????????????????????? g'[number]b???????????????????????????????? SQL ?????????????? Glass Box ???ж?????????? SQL ????????

????? 4.SQL ?????

????3. ??????????Σ??????????????????????????
?????????? AltoroJ ???????????????????????ú?в??????? Glass Box ??????????????????AppScan ???????? Username ?? Password ???????????"4ppSc4n"??"A' OR '7659'='7659"??????????????? SQL ????????AppScan ?г???"SQL ?????????·"???????????"???? / ???"?????????????????????? doLogin ??? servlet ?У???? 5 ?????

????? 5.AppScan “???? / ???”

????
??????????? WEB-IBF/web.xml ?е??????????ж??????????? LoginServlet.java ????С?
?????嵥 1.web.xml ????е? LoginServlet ????
<servlet-mapping>
<servlet-name>LoginServlet</servlet-name>
<url-pattern>/doLogin</url-pattern>
</servlet-mapping>
<servlet>
<description>
</description>
<display-name>
LoginServlet</display-name>
<servlet-name>LoginServlet</servlet-name>
<servlet-class>
com.ibm.rational.appscan.altoromutual.servlet.LoginServlet
</servlet-class>
</servlet>
?????? LoginServlet.java ????????????????????ж?????????λ??????????????????????????????????????????????????
?????嵥 2. LoginServlet.java ????д???????????
????if (!DBUtil.isValidUser(username?? password))
???????????????? DBUtil ???е? isValidUser ????????????????????? sql ???
?????嵥 3. ????????? SQL ???
????ResultSet resultSet = statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID
????= '"+ user +"' AND PASSWORD='" + password + "'");
????/* BAD - user input should always be sanitized */
???????????????????????????????????????????????????λ????? java ????????Щ???裬???????????￡????????????????????????????? Glass Box ????????????????????????????λ????????????Glass Box ??????????????λ????????緽????????????????????к??????????????????????????? 6 ?????

????? 6. Glass Box ???????

??
???????
??????в??????????????????ó??????????????????踲????????????????????????????????в?????????????????????????????????????????????? Glass Box ???б???????в?????в?????????????????????Ч??????????????????????????