nginx lua防火墙防SQL注入配置
82人参与 • 2025-07-14 • MsSqlserver
一、防火墙配置
二、下载安装文件
1. 下载程序
cd /opt wget https://github.com/luajit/luajit/archive/refs/tags/v2.0.5.tar.gz -o luajit-v2.0.5.tar.gz wget https://github.com/simpl/ngx_devel_kit/archive/v0.3.4.tar.gz -o ngx_devel_kit-0.3.4.tar.gz wget https://github.com/openresty/lua-nginx-module/archive/v0.10.9rc7.tar.gz -o lua-nginx-module-0.10.9rc7.tar.gz wget http://nginx.org/download/nginx-1.19.3.tar.gz -o nginx-1.19.3.tar.gz
2. 逐项解压
tar -xzvf luajit-v2.0.5.tar.gz tar -xzvf ngx_devel_kit-0.3.4.tar.gz tar -xzvf lua-nginx-module-0.10.9rc7.tar.gz tar -xzvf nginx-1.19.3.tar.gz
三、安装
1. 安装lua环境
cd /opt/luajit-2.0.5/ make && make install export luajit_lib=/usr/local/lib export luajit_inc=/usr/local/include/luajit-2.0 echo "/usr/local/lib" >> /etc/ld.so.conf ldconfig
2. 安装nginx，需要包含nginx lua模块
cd /opt/nginx-1.19.3 ./configure --prefix=/usr/local/nginx \ --add-module=/opt/ngx_devel_kit-0.3.4 \ --add-module=/opt/lua-nginx-module-0.10.9rc7 make && make install
四、配置lua防火墙
1. 下载lua防火墙代码
cd /usr/local/nginx/conf git clone https://github.com/loveshell/ngx_lua_waf.git
2. 加载lua防火墙配置，vi /usr/local/nginx/conf/nginx.conf，http中加入以下红色部分配置
http {
# 其它配置
...
lua_package_path "/usr/local/nginx/conf/ngx_lua_waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file /usr/local/nginx/conf/ngx_lua_waf/init.lua;
access_by_lua_file /usr/local/nginx/conf/ngx_lua_waf/waf.lua;
}
3. 修改防火墙配置rulepath值，vi /usr/local/nginx/conf/ngx_lua_waf/config.lua
# 默认值是`/usr/local/nginx/conf/waf/wafconf/` /waf 改为 /ngx_lua_waf rulepath = "/usr/local/nginx/conf/ngx_lua_waf/wafconf/"
4. 启动nginx
/usr/local/nginx/sbin/nginx
五、测试
1. 测试url中的关键字，出现拦截页面表示配置成功， 拦截参数在/usr/local/nginx/conf/ngx_lua_waf/wafconf/url文件
2. 测试post关键字
六、准备演示环境
1. 前端演示页面
<html>
<head>
<title>登陆</title>
<meta charset="utf-8">
</head>
<body>
<div>
用户名:<input type="text" name="user" id="txtuser"><br>
密码:<input type="password" name="pwd" id="txtpassword"><br>
<input type="button" onclick="login('login')" value="登陆"> <br>
<div id="divmsg"></div>
<script>
function login(action) {
var httprequest = new xmlhttprequest()
httprequest.onreadystatechange = function () {
if (httprequest.readystate == 4) {
document.getelementbyid("divmsg").innertext = httprequest.responsetext
}
}
httprequest.open('post', `/api/${action}`, true)
httprequest.setrequestheader(
'content-type',
'application/x-www-form-urlencoded'
)
var user = document.getelementbyid("txtuser").value
var pwd = document.getelementbyid("txtpassword").value
var str = `username=${user}&password=${pwd}`
httprequest.send(str)
}
</script>
</div>
</body>
</html>2. 服务端演示代码，模拟sql注入
@autowired
jdbctemplate jdbctemplate;
/**
* 拼sql查询
*
* @param user
* @return
*/
@postmapping("/login")
public string login(user user) {
string sql = "select * from sys_user where user_name = '" + user.getusername() + "' and pass_word = '" + user.getpassword() + "'";
system.out.println("sql:");
system.out.println(sql);
list<map<string, object>> maps = jdbctemplate.queryforlist(sql);
system.out.println(maps.size());
if (maps.size() > 0) {
return"login success";
} else {
return"login fail";
}
}3. nginx代理设置
location /api/ {
proxy_set_header host $http_host;
proxy_set_header x-real-ip $remote_addr;
proxy_set_header remote-host $remote_addr;
proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
proxy_pass http://192.168.1.18:8093/;
}4. 配置拦截参数（lua防火墙通过检测post表单中的关键字实现拦截）。
# 设置sql注入的关键参数 echo "'\s+or\s+" >> /usr/local/nginx/conf/ngx_lua_waf/wafconf/post # 重新加载，使配置生效 /usr/local/nginx/sbin/nginx -s reload
七、效果演示
1. 正常登陆
2. 注入成功，在配置post拦截参数以前的效果
3. 注入被拦截，在配置post拦截参数以后的效果
到此这篇关于nginx lua防火墙防sql注入配置的文章就介绍到这了,更多相关nginx lua防止sql注入内容请搜索代码网以前的文章或继续浏览下面的相关文章希望大家以后多多支持代码网！
赞 (0)
您想发表意见！！点此发布评论
发表评论