作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2008, Vol. 34 ›› Issue (5): 134-135,. doi: 10.3969/j.issn.1000-3428.2008.05.046

• 安全技术 • 上一篇    下一篇

基于TDS协议的安全性测试技术

余 静,鲁云萍   

  1. (江南计算技术研究所,无锡 214083)
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2008-03-05 发布日期:2008-03-05

Test Technique of Security Based on TDS Protocol

YU Jing, LU Yun-ping   

  1. (Jiangnan Institute of Computing Technology, Wuxi 214083)
  • Received:1900-01-01 Revised:1900-01-01 Online:2008-03-05 Published:2008-03-05

摘要: 在分析SQL Server数据库通信框架和TDS协议结构的基础上,编写了Fuzzer工具——TDS_fuzzer。该测试工具针对TDS协议设计特殊数据包,实现了数据转变、字符串、字段组合这3种测试方法。通过测试MS SQL Server的2个重要漏洞,验证了其有效性。

关键词: 表格格式数据流协议, MS SQL Server数据库, 基于块的协议分析, 模糊化处理

Abstract: This paper introduces TDS protocol and communication between SQL Server database systems. Fuzzer for TDS protocol is done. Special packets are designed and three test methods of data mutation, string and field combination are implemented. The validity of the tool is proved by testing two known vulnerabilities of MS SQL Server.

Key words: TDS protocol, MS SQL Server, block-based protocol analysis, fuzzing

中图分类号: