2021新版數(shù)據(jù)庫(kù)安全性實(shí)驗(yàn)報(bào)告

1、2021新版數(shù)據(jù)庫(kù)安全性實(shí)驗(yàn)報(bào)告2020年新版數(shù)據(jù)庫(kù)安全性實(shí)驗(yàn)報(bào)告 1 ntFrccsssingLogi #NS Pali cyTsolEecuti oiiLogin# rollcyEventrr ocesllngLozin#rollcyEventrr ocesllngLozin#sI Ul 1 bJtLL Adm i m str saZ xxxx013199ZX_2ZXJ_xxxx0131952CREATE USER JhonFOR LOGIN ZXJ_xxxx013199-DROP USER Jhondb0-安全性I二U用戶r INFORHkriCJf SCHEMA* -呂 Jhon乞 W

2、ary占._xxxx013199 (52JK |SnoSnam 已StetLlSCilySphoneSI20天津5210d涼NULLS3東方紅30_MJLL斗豐秦霜20天津NULL55拘民30上海NULL菱羊20陜西18NULLNULLfJLLfJLL用戶Mary對(duì)S, P, J三個(gè)表有SELECT和INSERT權(quán)力 GOGRANT SELECT,INSERTON STO MaryGRANT SELECT,INSERTON PTO MaryGRANT SELECT,INSERTON JTO MaryGO檢驗(yàn)如下：SQLQuery4.$ql - wi,.J(9 (S5) SQLQueryl.sq

3、l - wi.er-PCwinter (54JTUSE gorigcheagSELECT * 痿礬 m一Trr口結(jié)果Lj満息SnoSnamsStatusSphortfi1藥I搭益20天潭NULL2S210_NULL3$3東方紅30_NULL4S4豐秦期20天津NULL5S5為民30上海NULLI s00SIP2J22WQS2P3JI2400S2P3J22200S2P3J4250QS2P3J52400S2PSJI200S2P5J22100S3PIJI2200S3P3JI220QS斗P5JI2100S4P6J3230054P6J4220QS5P2J42100S5P3JI2200S5P6J22200

4、S5P6J42500AUZALtiALtZNULLDELETEFROM SPJWHERE Sno =S3OR Sno =S4SnoPnoJnoQTYk忸PlJI2200SIPlJ32LQQSIPlJ42700SIP2J2210052P3JI2400S2P3J2220052P3J4250QS2P3J52400S2P5JI2400S2P5J22100S5P2J42100S5P3JI2200S5PEJ22200S5PSJ42500米NULLNULLAUZNULL把對(duì)用戶Tom授予的所有權(quán)力收回GOREVOKE DELETE , update ( QTY)ON SPJFROM TomREVOKE IN

5、SERTON SFROM TOMGOg|lNSERTIMTO S (Sruo)VALUES (1S7* j I消息號(hào)孫級(jí)別2狀瓦形第行拒絕了對(duì)對(duì)象(數(shù)據(jù)庫(kù)gongch 7架構(gòu) 02 )的INSERT飆限*對(duì)用戶Mary增加SPJ表的SELECT權(quán)力GOGRANT SELECTON SPJTO MaryGO拒絕Mary對(duì)表P的INSERT權(quán)限。DENY INSERTON PTO Mary5 .在student數(shù)據(jù)庫(kù)中創(chuàng)建角色STUDBA，將查詢和更新SC表的權(quán)限授予角色STUDBA。USE StudentCREATE ROLE STUDBAGRANT SELECT , UPDATEON SCTO

6、 STUDBA6.兩個(gè)同學(xué)為一組(自由搭配)，在自己的數(shù)據(jù)庫(kù)服務(wù)器上分別為對(duì)方創(chuàng)建一個(gè) 登錄名，在student數(shù)據(jù)庫(kù)中為登錄名映射數(shù)據(jù)庫(kù)用戶，將數(shù)據(jù)庫(kù)用戶加入 STUDBA角色中。然后用對(duì)方為自己創(chuàng)建的登錄名和對(duì)方的數(shù)據(jù)庫(kù)服務(wù)器建立 連接，對(duì)對(duì)方的數(shù)據(jù)庫(kù)進(jìn)行操作，驗(yàn)證所授予的權(quán)限。CREATE LOGIN OTHWITH PASSWORD=123CREATE user NI for log in OTHEXEC SP_ADDROLEMEMBER STUDBA , NI實(shí)驗(yàn)截圖如下：玄件叫 興郞 mm qi Eiti n貞吵 *譚儀訂 ui.ii) ini：i iiB：p #*； 8 皿三 豈

7、創(chuàng)ssjfwa-j-j I HI*-JL 3 d 蟲玄件叫 興郞 mm qi Eiti n貞吵 *譚儀訂 ui.ii) ini：i iiB：p #*； 8 皿三 豈創(chuàng)ssjfwa-j-j I HI*-JL 3 d 蟲*5jsauh*)a K*7 QMrrl - 4L匸總El -3jL iEAaBKn,險(xiǎn)TL尹hr 9III Tf-酸宅Arf晉刖干劇亍云尊*HXGT口仲. Iff龍 !丄 34T丄巌顧I期豪=上 iiKSW . Sr-WT lb* I4M J JHSK j AID 丄 RJLMJ TM39XI5LK!他U39X15LCSX2KHjOSUO:3KHHjOSUO-3UKMmuaMi77期wnHJMIP*M5*5n泊僭略n*43口力換nsMHnsixc-V17Vli.MMSLWHZ77MKISLDT實(shí)驗(yàn)總結(jié)：還是沒怎么明白為什么當(dāng)允許用戶擁有兩個(gè)權(quán)限時(shí)(例如：查詢和插入)但是檢驗(yàn)時(shí)查詢時(shí)沒有問題的，而插入就有問題的(如下圖顯示的錯(cuò)誤)INSERTINTO ( Sno)VALUES( S10)SQLQutfy.il - Wl-X_?1WLI1IH (55)* 呂QLQu申花旳I - wLer-PCwnr (54): INSTERTIHT-0 F Pncr Fzi-airjfi,匚 口工口工評(píng)亡:tgihic；Lwses JP0劇俠，j