Url

‫‪ URL‬ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬

‫‪URL‬‬ ‫ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬ ‫ﻣﻘﺪﻣﻪ‬ ‫ﺩﺭ ﺑﻴﻦ ﺗﻤﺎﻣﻲ ﺗﻜﻨﻴﻜﻬﺎﻱ ﻫﻚ ‪ ،‬ﻫﻚ ﻛﺮﺩﻥ ﺍﺯ ﻃﺮﻳﻖ ﻭﺏ ﻳﻜﻲ ﺍﺯ ﺯﻳﺒﺎﺗﺮﻳﻦ ﺗﻜﻨﻴﻚ ﻫﺎ ﻣﻲ ﺑﺎﺷﺪ‪ .‬ﺍﺳﺘﻔﺎﺩﻩ ﺍﺯ‬ ‫ﺩﺳﺘﻮﺭﺍﺕ ﺍﺟﺮﺍﻳﻲ ﺍﺯ ﻃﺮﻳﻖ ﻣﺮﻭﺭﮔﺮ ﻭﺏ ﺑﺮﺍﻱ ﺍﻧﺠﺎﻡ ﺣﻤﻼﺕ ﺧﺮﺍﺑﻜﺎﺭﺍﻧﻪ ﭘﺮ ﺍﺯ ﺭﻳﺰﻩ ﻛﺎﺭﻳﻬﺎﻱ ﻧﺎﺏ ﻭ‬ ‫ﺩﺭﺧﺸﺎﻥ ﺍﺳﺖ‪ .‬ﺩﺭ ﻣﻘﺎﺑﻞ ﺗﻤﺎﻣﻲ ﺗﻜﻨﻴﻚ ﻫﺎﻱ ﭘﻴﭽﻴﺪﻩ ﻭ ﻣﺸﻜﻞ ﻫﻚ‪ ،‬ﻫﻚ ﻛﺮﺩﻥ ﺍﺯ ﻃﺮﻳﻖ ﻭﺏ ﺳﺎﺩﻩ ﻭ ﺟﺰﻳﻲ‬ ‫ﻣﻲ ﺑﺎﺷﺪ‪ .‬ﺑﻪ ﻋﻨﻮﺍﻥ ﻳﻚ ﻣﺜﺎﻝ ﺳﺎﺩﻩ ﺁﻳﺎ ﺷﻤﺎ ﻣﻲ ﺩﺍﻧﻴﺪ ﻛﻪ ﻓﻘﻂ ﺑﺎ ﻗﺮﺍﺭ ﺩﺍﺩﻥ ﻳﻚ “‪ ”%%‬ﻣﻲ ﺗﻮﺍﻥ ﺍﻣﻨﻴﺖ‬ ‫ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ ﻭﺏ ﺷﻤﺎ ﺭﺍ ﺑﻪ ﺧﻄﺮ ﺍﻧﺪﺍﺧﺖ؟!‬ ‫ﻣﻲ ﺗﻮﺍﻥ ﺍﻳﻨﮕﻮﻧﻪ ﻓﺮﺽ ﻛﺮﺩ ﻛﻪ ﻫﻚ ﻛﺮﺩﻥ ﺍﺯ ﻃﺮﻳﻖ ﻭﺏ ﻣﺎﻧﻨﺪ ﻳﻚ ﻋﻤﻞ ﺟﺮﺍﺣﻲ ﻛﻮﭼﻚ ﺍﺯ ﻃﺮﻳﻖ ﻓﻘﻂ ﻳﻚ‬ ‫ﺳﻮﺭﺍﺥ ﺭﻳﺰ ﻣﻲ ﺑﺎﺷﺪ‪ .‬ﺩﺭ ﺍﺑﺘﺪﺍ ﺧﻴﻠﻲ ﻇﺮﻳﻒ ﻭ ﻛﻮﭼﻚ ﺍﺳﺖ ﻭﻟﻲ ﺩﺭ ﻋﻤﻖ ﻛﺎﺭ ﺟﺰﻭ ﻋﻤﻴﻖ ﺗﺮﻳﻦ ﻭ ﭘﻴﭽﻴﺪﻩ‬ ‫ﺗﺮﻳﻦ ﺳﻴﺴﺘﻢ ﻫﺎ ﻣﻲ ﺑﺎﺷﺪ‪.‬‬ ‫‪ URL‬ﺑﻌﻀﻲ ﻣﻮﺍﻗﻊ ﻓﻘﻂ ﺗﻨﻬﺎ ﺭﺍﻩ ﺍﺭﺗﺒﺎﻃﻲ ﺑﺎ ﺳﻴﺴﺘﻢ ﻫﺎﻱ ﺑﺰﺭﮒ ﻭ ﭘﻴﭽﻴﺪﻩ ﺍﻱ ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ﺩﺍﺭﺍﻱ ﺍﻣﻦ‬ ‫ﺗﺮﻳﻦ ﺩﻳﻮﺍﺭ ﻫﺎﻱ ﺁﺗﺶ ﻣﻲ ﺑﺎﺷﻨﺪ! ﺩﺭ ﺍﻳﻦ ﻣﻘﺎﻟﻪ ﻓﻘﻂ ﻗﺼﺪ ﺁﻥ ﺭﺍ ﺩﺍﺭﻡ ﻛﻪ ﺩﺭﺑﺎﺭﻩ ‪ URL‬ﺑﺤﺚ ﻛﻨﻢ ﻭ ﺍﻳﻨﻜﻪ ﺑﻪ‬ ‫ﻃﻮﺭ ﻛﻠﻲ ‪ URL‬ﭼﻴﺴﺖ ؟ ﻭ ﭼﮕﻮﻧﻪ ﺑﻪ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻛﻤﻚ ﻣﻲ ﻛﻨﺪ؟ ﻭ ﻳﺎ ﺑﺪ ﺑﻪ ﻛﺎﺭ ﺑﺮﺩﻥ ﺁﻥ ﻣﻤﻜﻦ ﺍﺳﺖ ﭼﻪ‬ ‫ﺧﺼﺎﺭﺗﻬﺎﻱ ﺑﻪ ﺳﻴﺴﺘﻢ ﻭﺍﺭﺩ ﺷﻮﺩ؟‬ ‫ﺑﺎ ﻣﺜﺎﻟﻬﺎﻱ ﻇﺮﻳﻔﻲ ﻛﻪ ﺩﺭ ﺍﻳﻦ ﻣﺒﺤﺚ ﺯﺩﻩ ﻣﻲ ﺷﻮﺩ ﺗﻮﻟﻴﺪ ﻛﻨﻨﺪﮔﺎﻥ ﺑﺮﻧﺎﻣﻪ ﻫﺎﻱ ﻭﺏ ﻭ ﮔﺮﻭﻫﻬﺎﻱ ﻛﻪ ﺩﺭ ﺯﻣﻴﻨﻪ‬ ‫ﺗﻜﻨﻮﻟﻮﮊﻱ ﺍﻃﻼﻋﺎﺕ ﻛﺎﺭ ﻣﻲ ﻛﻨﻨﺪ ﺑﻪ ﺧﻄﺮﻱ ﻛﻪ ﺗﺎ ﺣﺪﻱ ﺁﻧﻬﺎ ﺭﺍ ﺗﻬﺪﻳﺪ ﻣﻲ ﻛﻨﺪ ﭘﻲ ﻣﻲ ﺑﺮﻧﺪ‪.‬‬ ‫ﺍﻛﺜﺮ ﺣﻤﻼﺕ ﻭﺏ ﺑﺴﻴﺎﺭ ﻇﺮﻳﻒ ﺍﺳﺖ ‪ .‬ﻧﻔﻮﺫﮔﺮﺍﻥ ﺑﺎ ﻗﺪﻣﻬﺎﻱ ﻛﻮﭼﻚ ﺷﺮﻭﻉ ﻣﻲ ﻛﻨﻨﺪ ﻣﺎﻧﻨﺪ ﺍﻳﻨﻜﻪ ﺳﺎﻳﺖ ﻭﺏ‬ ‫ﭼﮕﻮﻧﻪ ﻭ ﺑﺮﺍﻱ ﭼﻪ ﺳﺎﺧﺘﻪ ﺷﺪﻩ ﺍﺳﺖ‪ .‬ﻫﺮ ﺗﺤﻘﻴﻖ ﻭ ﺟﺴﺘﺠﻮﻱ ﺑﻴﺸﺘﺮ ﺩﺭ ﺳﺎﻳﺖ ‪ ،‬ﻧﻔﻮﺫﮔﺮ ﺭﺍ ﺑﻪ ﻗﺴﻤﺘﻬﺎﻱ‬ ‫ﻋﻤﻴﻖ ﺗﺮ ﺩﺍﺧﻠﻲ ﻫﺪﺍﻳﺖ ﻣﻲ ﻛﻨﺪ‪ .‬ﻇﺮﺍﻓﺖ ﺍﻳﻨﮕﻮﻧﻪ ﺣﻤﻼﺕ ﺑﻪ ﺍﻳﻦ ﺍﺳﺖ ﻛﻪ ﻧﻔﻮﺫﮔﺮ ﻓﻘﻂ ﺑﻪ ﻳﻚ ﺍﺑﺰﺍﺭ ﺍﺣﺘﻴﺎﺝ‬

‫ﺩﺍﺭﺩ ‪ :‬ﻳﻚ ﻣﺮﻭﺭﮔﺮ ﻭﺏ !‬ ‫ﻣﻮﺍﺭﺩﻱ ﻛﻪ ﺩﺭ ﺍﻳﻨﺠﺎ ﻗﺼﺪ ﺗﻮﺿﻴﺢ ﺁﻥ ﺭﺍ ﺩﺍﺭﻳﻢ ﻋﺒﺎﺭﺗﻨﺪ ﺍﺯ‪:‬‬ ‫‪-‬‬

‫ﺳﺎﺧﺘﻤﺎﻥ ‪URL‬‬

‫‪-‬‬

‫ﺭﻣﺰﮔﺬﺍﺭﻱ ‪URL‬‬

‫‪-‬‬

‫ﻛﺪﻫﺎﻱ ﺍﺳﻜﻲ ﻧﻤﺎﻳﺶ ﺩﺍﺩﻩ ﺷﺪﻩ ﺩﺭ ﻫﮕﺰﺍ ﺩﺳﻴﻤﺎﻝ ﻭ ﻳﻮﻧﻲ ﻛﺪ‬

‫‪-‬‬

‫‪ Meta-character‬ﻫﺎ ﻭ ﺗﺎﺛﻴﺮﺍﺕ ﺁﻧﻬﺎ ﺑﺮ ﺑﺮﻧﺎﻣﻪ ﻫﺎﻱ ﻛﺎﺭﺑﺮﺩﻱ‬

‫‪-‬‬

‫ﻓﺮﻣﻬﺎﻱ ‪ HTML‬ﻭ ﺍﺭﺟﺎﻉ ﭘﺎﺭﺍﻣﺘﺮﻫﺎ‬

‫ﺩﺭ ﺍﻳﻨﺠﺎ ﻓﺮﺽ ﺑﺮ ﺍﻳﻦ ﺍﺳﺖ ﻛﻪ ﺧﻮﺍﻧﻨﺪﮔﺎﻥ ﻋﺰﻳﺰ ﺑﺎ ﭘﺮﻭﺗﻜﻞ ‪ HTTP‬ﻭ ‪ HTML‬ﺁﺷﻨﺎ ﻣﻲ ﺑﺎﺷﻨﺪ‪.‬‬

‫ﺳﺎﺧﺘﻤﺎﻥ ‪URL‬‬

‫‪WWW.WebSecurityMgz.com‬‬

‫‪1‬‬

‫‪ URL‬ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬ ‫‪ URL‬ﺩﺭ ﺍﺻﻞ ﻣﻜﺎﻧﻴﺰﻣﻲ ﺑﺮﺍﻱ ﻣﺸﺨﺺ ﻛﺮﺩﻥ ﻣﻨﺎﺑﻊ ﺍﻳﻨﺘﺮﻧﺖ ﺭﻭﻱ ﻭﺏ ﻭ ﻳﺎ ﺳﺮﻭﺭﻫﺎﻱ ‪ FTP‬ﻫﺴﺘﻨﺪ ﻭ‬ ‫ﺷﺎﻣﻞ ﻻﻳﻪ ﭘﺮﻭﺗﻜﻞ ﺑﺮﻧﺎﻣﻪ ﻫﺎﻱ ﻛﺎﺭﺑﺮﺩﻱ ﻣﻲ ﺑﺎﺷﻨﺪ ﻛﻪ ﻫﺮ ﻛﺪﺍﻡ ﺩﺭﺧﻮﺍﺳﺘﻬﺎﻳﻲ ﺭﺍ ﺭﻭﻱ ﻳﻚ ﺳﺮﻭﺭ ﻭﺏ ﻣﻲ‬ ‫ﺳﺎﺯﻧﺪ‪.‬‬ ‫ﺍﻳﻦ ﺳﺎﺧﺘﻤﺎﻥ ﻋﻤﻮﻣﻲ ﻳﻚ ‪ URL‬ﺍﺳﺖ‪:‬‬

‫‪Protocol://Server/Path/to/resource?parameter‬‬

‫‪Protocol‬‬ ‫ﭘﺮﻭﺗﻜﻞ ﻻﻳﻪ ‪ .Application‬ﻋﻤﻮﻣﻲ ﺗﺮﻳﻦ ﺍﺳﺘﻔﺎﺩﻩ ‪ URL‬ﻫﺎ ﺩﺭ ﺩﺭﺧﻮﺍﺳﺘﻬﺎﻱ ﻣﻨﺎﺑﻊ ﺍﺯ ﺳﺮﻭﺭﻫﺎﻱ ﻭﺏ ﻣﻲ‬ ‫ﺑﺎﺷﺪ‪ ( HTTP Server ) .‬ﺑﻨﺎﺑﺮﺍﻳﻦ ﻋﻤﻮﻣﻲ ﺗﺮﻳﻦ ﭘﺮﻭﺗﻜﻞ ‪ HTTP‬ﻣﻲ ﺑﺎﺷﺪ ﻭ ﺑﻘﻴﻪ ﭘﺮﻭﺗﻜﻠﻬﺎ ﻣﺎﻧﻨﺪ ‪، https‬‬ ‫‪ pop3 ، telnet ، ldap ، ftp‬ﻭ ﻏﻴﺮﻩ ﺑﺴﺘﮕﻲ ﺑﻪ ﺁﻥ ﺩﺍﺭﻧﺪ ﻛﻪ ﻣﺮﻭﮔﺮ ﻭ ﻳﺎ ﺳﺮﻭﺭ ﭼﻪ ﭼﻴﺰﻱ ﺭﺍ ﭘﺸﺘﻴﺒﺎﻧﻲ ﻣﻲ‬ ‫ﻛﻨﺪ‪.‬‬

‫‪Server‬‬ ‫ﻧﺎﻡ ﺣﻮﺯﻩ ‪ ، DNS‬ﻧﺎﻡ ‪ Netbios‬ﻳﺎ ﺁﺩﺭﺱ ‪ IP‬ﻳﻚ ﻣﻴﺰﺑﺎﻥ ﻭ ﻳﺎ ﻳﻚ ﺷﺒﻜﻪ‬

‫‪Path/to/resource‬‬ ‫ﻣﺴﻴﺮ ﺩﺍﻳﺮﻛﺘﻮﺭﻱ ‪ ،‬ﺷﺎﻣﻞ ﻧﺎﻡ ﻣﻨﺎﺑﻌﻲ ﻛﻪ ﺩﺭﺧﻮﺍﺳﺖ ﺷﺪﻩ ﺍﻧﺪ ﻭ ﺍﻳﻦ ﻣﻨﺎﺑﻊ ﻣﻲ ﺗﻮﺍﻧﻨﺪ ﻳﻚ ﻓﺎﻳﻞ ﺍﻳﺴﺘﺎ ﺑﺎﺷﻨﺪ‬ ‫ﻭ ﻳﺎ ﻳﻚ ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ ﻛﻪ ﺑﻪ ﺻﻮﺭﺕ ﭘﻮﻳﺎ ﺧﺮﻭﺟﻲ ﺭﺍ ﺗﻮﻟﻴﺪ ﻣﻲ ﻛﻨﻨﺪ‪.‬‬

‫‪Parameters‬‬ ‫ﺑﻪ ﺻﻮﺭﺕ ﻋﻤﻠﻲ ‪ ،‬ﭘﺎﺭﺍﻣﺘﺮﻫﺎ ﻫﻨﮕﺎﻣﻲ ﺑﻪ ﻳﻚ ﻣﻨﺒﻊ ﺍﺭﺟﺎﻉ ﺩﺍﺩﻩ ﻣﻲ ﺷﻮﻧﺪ ﻛﻪ ﻳﻚ ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ ﻭ ﻳﺎ ﻳﻚ‬ ‫ﺑﺮﻧﺎﻣﻪ ﻭﺟﻮﺩ ﺩﺍﺷﺘﻪ ﺑﺎﺷﺪ ﻛﻪ ﺑﻪ ﺻﻮﺭﺕ ﭘﻮﻳﺎ ﺧﺮﻭﺟﻲ ﺗﻮﻟﻴﺪ ﻛﻨﺪ‪.‬‬ ‫ﺷﻜﻞ ‪ ١‬ﺍﻧﻮﺍﻉ ‪ URL‬ﺭﺍ ﻧﺸﺎﻥ ﻣﻲ ﺩﻫﺪ‪ URL .‬ﻧﺸﺎﻥ ﺩﺍﺩﻩ ﺷﺪﻩ ﺩﺭ ﺷﻜﻞ ‪-١‬ﺍﻟﻒ ﺧﻴﻠﻲ ﻭﺍﺿﺢ ﻭ ﺭﻭﺷﻦ‬ ‫ﺍﺳﺖ‪ .‬ﻓﺎﻳﻞ ‪ Monalisa.html‬ﻳﻚ ﺩﺭﺧﻮﺍﺳﺘﻲ ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ﺍﺯ ﺳﺮﻭﺭﻱ ﺑﻪ ﻧﺎﻡ ‪www.blueballoon.com‬‬ ‫ﺷﺪﻩ ﺍﺳﺖ‪ .‬ﻣﻮﻗﻌﻴﺖ ﻓﺎﻳﻞ ‪ Monalsia.html‬ﺩﺭ ﻭﺏ ﺳﺎﻳﺖ‬

‫‪ www.blueballoon.com‬ﻣﺴﻴﺮ‬

‫‪ /pictures/davinchi‬ﻣﻲ ﺑﺎﺷﺪ‪ URL .‬ﻧﺸﺎﻥ ﺩﺍﺩﻩ ﺷﺪﻩ ﺩﺭ ﺷﻜﻞ ‪-١‬ﺏ ﻣﺜﺎﻟﻲ ﺍﺯ ﻳﻚ ﭘﺮﻭﺗﻜﻞ ﺩﻳﮕﺮ ﻣﻲ‬ ‫ﺑﺎﺷﺪ ‪ .‬ﺍﻳﻦ ﭘﺮﻭﺗﻜﻞ ﺑﺎﻋﺚ ﻣﻲ ﺷﻮﺩ ﻛﻪ ﻛﺎﺭﺑﺮ ﻳﻚ ﺍﺭﺗﺒﺎﻁ ‪ FTP‬ﺑﺮﺍﻱ ﻳﻚ ﻛﺎﺭﺑﺮ ‪ anonymous‬ﺑﺎ ﺳﺮﻭﺭ‬ ‫‪ www.blueballoon.com‬ﺑﺮﻗﺮﺍﺭ ﻛﻨﺪ ﻭ ﻓﺎﻳﻞ ‪ img_viewer.exe‬ﺭﺍ ﺍﺯ ﺩﺍﻳﺮﻛﺘﻮﺭﻱ ‪ /pub/‬ﺩﺭﻳﺎﻓﺖ ﻛﻨﺪ‪.‬‬ ‫‪ URL‬ﻧﺸﺎﻥ ﺩﺍﺩﻩ ﺷﺪﻩ ﺩﺭ ﺷﻜﻞ ‪-٢‬ﺝ ﺍﺯ ﻳﻚ ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ ﺩﺭﺧﻮﺍﺳﺘﻲ ﺭﺍ ﻛﺮﺩﻩ ﺍﺳﺖ‪ .‬ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ‬ ‫‪ View.asp‬ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ﺩﺭ ﺩﺍﻳﺮﻛﺘﻮﺭﻱ ‪ News‬ﻗﺮﺍﺭ ﺩﺍﺭﺩ‪ .‬ﻳﻚ ﭘﺎﺭﺍﻣﺘﺮ ﺑﻪ ﺑﺮﻧﺎﻣﻪ ﺍﺭﺟﺎﻉ ﻣﻲ ﺷﻮﺩ ‪ ID .‬ﻛﻪ‬ ‫ﻣﺤﺘﻮﻱ ﻳﻚ ﺭﻗﻢ ‪ 820620‬ﻣﻲ ﺑﺎﺷﺪ‪.‬‬

‫‪http:// www.blueballoon.com/pictures/davinchi/monalisa.html‬‬ ‫ﻣﺴﻴﺮ ﻓﺎﻳﻠﻲ ﻛﻪ ﺩﺭﺧﻮﺍﺳﺖ ﺷﺪﻩ ﺍﺳﺖ‬

‫‪Server Name‬‬

‫‪Protocol‬‬

‫ﺍﻟﻒ‬ ‫‪ftp:// 192.168.17.33/pub/img_viewer.exe‬‬ ‫ﻣﺴﻴﺮ ﻓﺎﻳﻞ ﺩﺭﺧﻮﺍﺳﺖ ﺷﺪﻩ‬

‫ﻧﺎﻡ ﺳﺮﻭﺭ‬

‫‪Protocol‬‬

‫ﺏ‬ ‫‪http:// www.ITIran.com/News/View.asp?ID=820620‬‬ ‫ﭘﺎﺭﺍﻣﺘﺮ ﺍﺭﺟﺎﻉ ﺷﺪﻩ ﺑﻪ ﺑﺮﻧﺎﻣﻪ‬

‫ﻣﺴﻴﺮ ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ‬

‫‪View.asp‬ﻛﺎﺭﺑﺮﺩﻱ‬

‫ﺩﺭﺧﻮﺍﺳﺖ ﺷﺪﻩ‬

‫‪WWW.WebSecurityMgz.com‬‬

‫ﻧﺎﻡ ﺳﺮﻭﺭ‬

‫‪Protocol‬‬ ‫‪2‬‬

‫‪ URL‬ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬

‫ﺣﺎﻝ ﺍﺟﺎﺯﻩ ﺑﺪﻫﻴﺪ ﻛﻪ ﺑﻪ ﭼﮕﻮﻧﮕﻲ ﺍﺭﺟﺎﻉ ﭘﺎﺭﺍﻣﺘﺮﻫﺎ ﺑﻪ ﺑﺮﻧﺎﻣﻪ ﻫﺎﻱ ﻛﺎﺭﺑﺮﺩﻱ ﻧﮕﺎﻫﻲ ﺩﺍﺷﺘﻪ ﺑﺎﺷﻴﻢ‪.‬‬

‫‪WWW.WebSecurityMgz.com‬‬

‫‪3‬‬

‫‪ URL‬ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬

‫ﺭﻭﺍﻧﺸﻨﺎﺳﻲ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬ ‫ﺍﻳﻦ ﺩﻓﻌﻪ ﺑﺮﺍﻱ ﺯﻧﮓ ﺗﻔﺮﻳﺢ ﻣﻲ ﺧﻮﺍﻫﻴﻢ ﭘﺎﻣﻮﻧﻮ ﺗﻮ ﻛﻔﺶ ﻧﻔﻮﺫﮔﺮﺍﻥ ﺑﻜﻨﻴﻢ !‬ ‫ﻧﻔﻮﺫﮔﺮﺍﻥ ﭼﻪ ﻛﺎﺭ ﻣﻲ ﻛﻨﻨﺪ؟ ﺑﻪ ﺻﻮﺭﺕ ﻣﺨﺘﺼﺮ‪ ،‬ﻧﻔﻮﺫﮔﺮﺍﻥ ﻗﺪﺭﺕ ﺯﻳﺎﺩﻱ ﺩﺭ ﺍﺳﺘﻘﺮﺍ ﺩﺍﺭﻧﺪ! ﻳﻌﻨﻲ ﺍﺯ ﺭﻭﻱ‬ ‫ﺷﻮﺍﻫﺪ ﻭ ﻣﺪﺍﺭﻙ ﻣﻮﺟﻮﺩ ﻣﻲ ﺗﻮﺍﻧﻨﺪ ﺧﻴﻠﻲ ﭼﻴﺰﻫﺎ ﺭﺍ ﭘﻴﺶ ﺑﻴﻨﻲ ﻛﻨﻨﺪ!‬ ‫ﺁﻧﻬﺎ ﻣﻲ ﺗﻮﺍﻧﻨﺪ ﺑﺎ ﺧﻮﺍﻧﺪﻥ ﺑﻌﻀﻲ ﺧﻄﻮﻁ ﺩﺭ ﺳﺎﻳﺖ ﺷﻤﺎ ﻣﺘﻮﺟﻪ ﺑﺸﻮﻧﺪ ﻛﻪ ﭼﻪ ﭼﻴﺰﻱ ﺩﺭ ﺣﺎﻝ ﺍﻧﺠﺎﻡ ﺍﺳﺖ ‪،‬‬ ‫ﺳﭙﺲ ﺑﺎ ﺗﺮﻛﻴﺐ ﻛﺮﺩﻥ ﺧﻴﻠﻲ ﺍﺯ ﭼﻴﺰﻫﺎﻱ ﻛﻮﭼﻜﻲ ﻛﻪ ﺑﻪ ﺩﺳﺖ ﺁﻭﺭﺩﻩ ﺍﻧﺪ ‪ ،‬ﺑﻪ ﻣﻜﺎﻧﻴﺴﻤﻬﺎﻱ ﺩﺍﺧﻠﻲ ﺩﻳﮕﺮ ﻧﻴﺰ‬ ‫ﭘﻲ ﻣﻲ ﺑﺮﻧﺪ‪.‬‬ ‫ﺍﺟﺎﺯﻩ ﺑﺪﻫﻴﺪ ﺑﻪ ‪ URL‬ﻧﺸﺎﻥ ﺩﺍﺩﻩ ﺷﺪﻩ ﺩﺭ ﺷﻜﻞ ‪-١‬ﺝ ﻧﮕﺎﻫﻲ ﺩﺍﺷﺘﻪ ﺑﺎﺷﻴﻢ‪:‬‬

‫‪http:// www.ITIran.com/News/View.asp?ID=820620‬‬ ‫ﺍﻳﻦ ‪ URL‬ﺍﺯ ﻳﻚ ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ ﻭ ﻳﺎ ﻳﻚ ﺑﺮﻧﺎﻣﻪ ﻛﻮﭼﻚ ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ﺑﻪ ﺻﻮﺭﺕ ﺧﻮﺩﻛﺎﺭ ﺧﺮﻭﺟﻲ ﻫﺎﻱ‬ ‫ﺧﻮﺩﺵ ﺭﺍ ﺍﺯ ﺭﻭﻱ ﭘﺎﺭﺍﻣﺘﺮﻫﺎﻱ ﺍﺭﺟﺎﻉ ﺷﺪﻩ ﺑﻪ ﺑﺮﻧﺎﻣﻪ ﺗﻮﻟﻴﺪ ﻣﻲ ﻛﻨﺪ‪ .‬ﭼﻪ ﺍﻃﻼﻋﺎﺕ ﺩﻳﮕﺮﻱ ﺭﺍ ﻣﻲ ﺗﻮﺍﻥ ﺍﺯ ﺩﻝ‬ ‫ﺍﻳﻦ ‪ URL‬ﺑﻴﺮﻭﻥ ﻛﺸﻴﺪ؟!‬ ‫ﺑﺎ ﺍﻭﻟﻴﻦ ﺍﺳﺘﻨﺘﺎﺝ ‪ ،‬ﻣﻲ ﺗﻮﺍﻥ ﺍﺯ ﺭﻭﻱ ﻧﺎﻡ ﻣﻨﺒﻊ ‪ View.asp‬ﻣﺘﻮﺟﻪ ﺷﺪ ﻛﻪ ﺍﻳﻦ ﻓﺎﻳﻞ ﺑﺎ ﭘﺴﻮﻧﺪ ‪ .asp‬ﻣﻲ ﺑﺎﺷﺪ‬ ‫ﺍﻳﻦ ﻓﺎﻳﻞ ﺑﻪ ﺻﻮﺭﺕ ﻣﻄﻤﺌﻦ ﻳﻚ ﻓﺎﻳﻞ )‪ Microsoft Active Server Page (ASP‬ﻣﻲ ﺑﺎﺷﺪ‪ .‬ﻓﺎﻳﻠﻬﺎﻱ ‪ASP‬‬ ‫ﻧﻴﺰ ﺗﻘﺮﻳﺒﺎ ﺑﻪ ﺻﻮﺭﺕ ﺍﻧﺤﺼﺎﺭﻱ ﺭﻭﻱ ﺳﺮﻭﻫﺎﻱ ‪ IIS WEB Server‬ﺍﺟﺮﺍ ﻣﻲ ﺷﻮﻧﺪ‪.‬ﺑﻨﺎﺑﺮﺍﻳﻦ ﺳﺮﻭﺭ ﺳﺎﻳﺖ‬ ‫‪ www.ITIran.com‬ﺑﻪ ﺍﺣﺘﻤﺎﻝ ﺯﻳﺎﺩ ﻳﻚ ﻭﻳﻨﺪﻭﺯ ﺳﺮﻭﺭ ‪ NT/2000/XP‬ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ‪ IIS‬ﺭﻭﻱ ﺁﻥ ﺍﺟﺮﺍ‬ ‫ﺷﺪﻩ ﺍﺳﺖ‪.‬‬ ‫ﺧﺐ‪ ،‬ﺣﺎﻻ ﻧﮕﺎﻫﻲ ﺑﻪ ﭘﺎﺭﺍﻣﺘﺮﻫﺎ ﺩﺍﺷﺘﻪ ﺑﺎﺷﻴﻢ‪ .‬ﻣﺎ ﻧﺸﺎﻧﻪ ﻫﺎﻱ ﺑﻴﺸﺘﺮﻱ ﺭﺍ ﻛﺸﻒ ﻣﻲ ﻛﻨﻴﻢ‪ .‬ﭘﺎﺭﺍﻣﺘﺮ‬ ‫‪ ID=820620‬ﺩﺭ ﺍﺻﻞ ﻳﻚ ﺷﻤﺎﺭﻩ ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ﺷﻤﺎﺭﻩ ﺍﻧﺤﺼﺎﺭﻱ ﻳﻚ ﺧﺒﺮ ﺍﺳﺖ ﻛﻪ ﺑﺎﻳﺪ ﺩﺭ ﭘﺎﻳﮕﺎﻩ ﺩﺍﺩﻩ‬ ‫ﻭﺟﻮﺩ ﺩﺍﺷﺘﻪ ﺑﺎﺷﺪ‪ .‬ﺍﻣﺎ ﻣﺤﺒﻮﺏ ﺗﺮﻳﻦ ﻭ ﻋﻤﻮﻣﻲ ﺗﺮﻳﻦ ﺍﻧﺘﺨﺎﺏ ﺑﺮﺍﻱ ﭘﺎﻳﮕﺎﻩ ﺩﺍﺩﻩ ﺭﻭﻱ ﻭﻳﻨﺪﻭﺯ‬ ‫‪ ، NT/2000/XP‬ﻣﻌﻤﻮﻻ ‪ Microsofte SQL Server‬ﻭ ﻳﺎ ‪ Microsofte Access‬ﻣﻲ ﺑﺎﺷﺪ‪ .‬ﺍﮔﺮ ﻳﻚ‬ ‫ﺳﺎﻳﺖ ﻛﻮﭼﻚ ﺑﺎﺷﺪ ﻣﻤﻜﻦ ﺍﺳﺖ ﻛﻪ ﺍﺯ ‪ Access‬ﺍﺳﺘﻔﺎﺩﻩ ﻛﻨﺪ‪ .‬ﺑﻨﺎﺑﺮﺍﻳﻦ ﻓﺎﻳﻞ ‪ View.asp‬ﺷﺒﺎﻫﺖ ﺯﻳﺎﺩﻱ ﺑﻪ‬ ‫ﻓﺎﻳﻠﻲ ﺩﺍﺭﺩ ﻛﻪ ﻳﻚ ‪ SQL Query‬ﺑﺮﺍﻱ ﺳﺮﻭﺭ ﭘﺎﻳﮕﺎﻩ ﺩﺍﺩﻩ ﻣﻲ ﺳﺎﺯﺩ ﺗﺎ ﺑﻪ ﻭﺳﻴﻠﻪ ﭘﺎﺭﺍﻣﺘﺮ ﺍﺭﺟﺎﻉ ﺷﺪﻩ ﺑﺎ ﺁﻥ‬ ‫ﺟﺰﻳﻴﺎﺕ ﺑﻴﺸﺘﺮﻱ ﺭﺍ ﺍﺯ ﭘﺎﻳﮕﺎﻩ ﺩﺍﺩﻩ ﻧﻤﺎﻳﺶ ﺩﻫﺪ‪.‬‬ ‫ﺍﻣﺎ ﺑﺎ ﻧﮕﺎﻫﻲ ﺯﻳﺮﻛﺎﻧﻪ ﺗﺮ ﺑﻪ ﭘﺎﺭﺍﻣﺘﺮ ﺍﺭﺟﺎﻉ ﺷﺪﻩ ﻣﻲ ﺗﻮﺍﻥ ﺩﺭﻳﺎﻓﺖ ﻛﻪ ﺍﻳﻦ ﭘﺎﺭﺍﻣﺘﺮ ﺷﺎﻣﻞ ﺳﻪ ﻗﺴﻤﺖ ﻣﻲ ﺑﺎﺷﺪ‬ ‫‪:‬‬ ‫‪ID=820620‬‬

‫ﻛﻪ ﻧﺸﺎﻧﮕﺮ ﺍﻳﻦ ﻣﻮﺿﻮﻉ ﺍﺳﺖ ﻛﻪ ﺧﺒﺮ ﻧﻤﺎﻳﺶ ﺩﺍﺩﻩ ﺷﺪﻩ ﺑﺮﺍﻱ ﺳﺎﻝ ‪ ٨٢‬ﻭ ﻣﺎﻩ ‪ ٠٦‬ﻳﻌﻨﻲ ﺷﻬﺮﻳﻮﺭ ﻭ ﺭﻭﺯ ‪٢٠‬‬ ‫ﻣﻲ ﺑﺎﺷﺪ!‬ ‫ﺍﻣﺎ ﺟﺰﻳﻴﺎﺕ ﺑﻴﺸﺘﺮﻱ ﺭﺍ ﻣﻲ ﺗﻮﺍﻥ ﺍﺯ ﺍﻳﻦ ﭘﺎﺭﺍﻣﺘﺮ ﻫﺎ ﻓﻬﻤﻴﺪ ﻭ ﻣﺎ ﺩﺭ ﺁﻳﻨﺪﻩ‪ ،‬ﺑﻴﺸﺘﺮ ﺭﻭﻱ ﺗﻜﻨﻴﻚ ﻫﺎﻱ ﻧﻘﺸﻪ‬ ‫ﺑﺮﺩﺍﺭﻱ ﺍﺯ ﭘﺎﻳﻴﻦ ﺑﻪ ﺑﺎﻻ ﺑﺤﺚ ﻣﻲ ﻛﻨﻴﻢ‪.‬‬

‫‪WWW.WebSecurityMgz.com‬‬

‫‪4‬‬

‫‪ URL‬ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬

‫ﺭﻣﺰ ﻧﮕﺎﺭﻱ ‪URL‬‬ ‫ﺑﻪ ﺧﻮﺩﻱ ﺧﻮﺩ ﻳﻚ ‪ URL‬ﻫﻴﭻ ﭼﻴﺰﻱ ﻧﻴﺴﺖ ﺑﻪ ﺟﺰ ﺭﺷﺘﻪ ﻫﺎﻱ ﺍﻟﻔﺒﺎﻳﻲ ﻭ ﺑﻌﻀﻲ ﻧﺸﺎﻧﻪ ﻫﺎﻳﻲ ﺩﺭﻭﻥ ﺁﻥ!‬ ‫ﻣﺠﻤﻮﻋﻪ ﻛﺎﺭﺍﻛﺘﺮﻫﺎﻱ ﺍﻧﺘﺨﺎﺏ ﺷﺪﻩ ﺑﺮﺍﻱ ﻣﺸﺨﺺ ﻛﺮﺩﻥ ﻳﻚ ‪ ، URL‬ﺭﺷﺘﻪ ﻫﺎﻳﻲ ﺷﺎﻣﻞ ﻧﺸﺎﻧﻪ ﻫﺎﻱ ﺯﻳﺮ ﻣﻲ‬ ‫ﺑﺎﺷﻨﺪ‪:‬‬ ‫ﺭﺷﺘﻪ ﻫﺎﻱ ﻋﺪﺩﻱ ﻭ ﺍﻟﻔﺒﺎﻳﻲ‬ ‫ﻧﺸﺎﻧﻪ ﻫﺎﻱ ﺍﺧﺘﺼﺎﺻﻲ‬ ‫ﻛﺎﺭﺍﻛﺘﺮﻫﺎﻱ ﻣﺨﺼﻮﺹ ﺩﻳﮕﺮ‬

‫‪A-Z , a-z , 0-9‬‬ ‫‪“; / : @ & = + $ , < > # %‬‬ ‫* ~ ! ‪( ) { } | \ ^ [ ] ‘- _ .‬‬

‫ﺧﻴﻠﻲ ﺍﺯ ﺩﻓﻌﺎﺕ‪ ،‬ﻳﻚ ﺭﺷﺘﻪ ‪ URL‬ﺷﺎﻣﻞ ﺣﺮﻭﻑ‪ ،‬ﺍﻋﺪﺍﺩ ﻭ ﻧﺸﺎﻧﻪ ﻫﺎﻱ ﺭﺯﺭﻭ ﺷﺪﻩ ﻣﻲ ﺑﺎﺷﺪ ﻛﻪ ﻣﻌﻨﻲ‬

‫ﻣﺨﺼﻮﺹ ﺩﺭﻭﻥ ﻳﻚ ‪ URL‬ﺩﺍﺭﺩ‪.‬ﻛﺎﺭﺍﻛﺘﺮﻫﺎﻱ ﻣﺨﺼﻮﺹ ﺩﻳﮕﺮ ﻣﻌﻨﺎﻱ ﭼﻨﺪﺍﻥ ﻣﺨﺼﻮﺻﻲ ﺑﺮﺍﻱ ‪URL‬‬ ‫ﻧﺪﺍﺭﻧﺪ‪.‬ﺑﻪ ﻫﺮ ﺟﻬﺖ ﺁﻧﻬﺎ ﻣﻤﻜﻦ ﺍﺳﺖ ﻣﻌﻨﺎﻱ ﻣﺨﺼﻮﺻﻲ ﺑﺮﺍﻱ ﺳﺮﻭﻳﺲ ﺩﻫﻨﺪﻩ ﻭﺏ ﻭ ﻳﺎ ﺑﺮﻧﺎﻣﻪ ﻛﺎﺭﺑﺮﺩﻱ ﻛﻪ‬ ‫ﺍﺯ ﻃﺮﻳﻖ ﻭﺏ ﺩﺭﺧﻮﺍﺳﺖ ﺷﺪﻩ ﺍﺳﺖ ‪ ،‬ﺩﺍﺷﺘﻪ ﺑﺎﺷﻨﺪ‪.‬‬ ‫ﺗﻔﺴﻴﺮ ﺑﻌﻀﻲ ﺍﺯ ﺍﻳﻨﮕﻮﻧﻪ ﻛﺎﺭﺍﻛﺘﺮﻫﺎﻱ ﻣﺨﺼﻮﺹ ﺩﺭ ﺟﺪﻭﻝ ‪ ٢‬ﻧﻤﺎﻳﺶ ﺩﺍﺩﻩ ﺷﺪﻩ ﺍﺳﺖ‪.‬‬

‫‪WWW.WebSecurityMgz.com‬‬

‫‪5‬‬

‫‪ URL‬ﺷﻤﺸﻴﺮ ﻧﻔﻮﺫﮔﺮﺍﻥ ﻭﺏ‬

‫ﺟﺪﻭﻝ ﺷﻤﺎﺭﻩ ‪٢‬‬ ‫ﻛﺎﺭﺍﻛﺘﺮ ﻣﺨﺼﻮﺹ‬

‫?‬

‫ﺗﻔﺴﻴﺮ‬ ‫ﺟﺪﺍﻛﻨﻨﺪﻩ ﺭﺷﺘﻪ ﻫﺎﻱ ﭘﺮﺳﺸﻨﺎﻣﻪ ﻫﺎ ‪ .‬ﺑﺨﺸﻲ ﺍﺯ ‪ URL‬ﻛﻪ ﺩﺭ ﺳﻤﺖ ﺭﺍﺳﺖ ? ﻗﺮﺍﺭ‬ ‫‪١‬‬

‫ﺩﺍﺭﺩﻳﻚ ﺭﺷﺘﻪ ﭘﺮﺳﺸﻨﺎﻣﻪ ﻣﻲ ﺑﺎﺷﺪ‪.‬‬

‫&‬

‫ﭘﺎﺭﺍﻣﺘﺮ ﺟﺪﺍﻛﻨﻨﺪﻩ‪ .‬ﺑﺮﺍﻱ ﺟﺪﺍ ﻛﺮﺩﻥ ﭘﺎﺭﺍﻣﺘﺮ ﻫﺎﻱ ‪ Name=Value‬ﺑﻪ ﻛﺎﺭ ﻣﻲ ﺭﻭﺩ‪.‬‬

‫=‬

‫ﻧﺎﻡ ﭘﺎﺭﺍﻣﺘﺮ ﺭﺍ ﺍﺯ ﺍﺭﺯﺷﻲ ﻛﻪ ﺩﺍﺭﺩ ﺟﺪﺍ ﻣﻲ ﻛﻨﺪ‪.‬‬

‫‪+‬‬

‫ﺑﻪ ﻋﻨﻮﺍﻥ ﺟﺎﻱ ﺧﺎﻟﻲ ﺗﻔﺴﻴﺮ ﻣﻲ ﺷﻮﺩ‪.‬‬

‫‪:‬‬

‫ﺟﺪﺍﻛﻨﻨﺪﻩ ﭘﺮﻭﺗﻜﻞ‪ .‬ﺁﻥ ﺑﺨﺶ ﺍﺯ ﺭﺷﺘﻪ ‪ URL‬ﺍﺯ ﺁﻏﺎﺯ ﺗﺎ ﭘﺎﻳﺎﻥ ﻧﺸﺎﻧﻪ ‪ :‬ﭘﺮﻭﺗﻜﻞ‬ ‫ﺍﺳﺘﻔﺎﺩﻩ ﺷﺪﻩ ﺩﺭ ﻻﻳﻪ ‪ Application‬ﺭﺍ ﻣﺸﺨﺺ ﻣﻲ ﻛﻨﺪ‪.‬‬

‫‪#‬‬

‫ﻳﻚ ﻣﻮﺿﻮﻉ ﺭﺍ ﺩﺭﻭﻥ ﻳﻚ ﺻﻔﺤﻪ ﻭﺏ ﻣﺸﺨﺺ ﻣﻲ ﻛﻨﺪ‪ .‬ﺑﺮﺍﻱ ﻣﺜﺎﻝ ‪URL‬‬ ‫‪www.acmt-art.com/index.html#gallery‬‬

‫ﻭ‬

‫‪www.acmt-‬‬

‫‪ art.com/index.html#purchase‬ﺩﻭ ﻣﻜﺎﻥ ﻣﺘﻔﺎﻭﺕ ﺭﺍ ﺩﺭﻭﻥ ﻳﻚ ﺻﻔﺤﻪ‬ ‫)‪ (index.html‬ﻧﺸﺎﻥ ﻣﻲ ﺩﻫﺪ‪.‬‬

‫‪%‬‬ ‫@‬

‫ﺍﻳﻦ ﻛﺎﺭﺍﻛﺘﺮ ﺑﺮﺍﻱ ﻣﺸﺨﺺ ﻛﺮﺩﻥ ﻛﺪﻫﺎﻱ ﻫﮕﺰﺍﺩﺳﻴﻤﺎﻝ ﻣﻲ ﺑﺎﺷﺪ‪.‬‬ ‫ﻫﻨﮕﺎﻣﻲ ﻛﻪ ﺩﺭ ﺁﺩﺭﺳﻬﺎﻱ ﻣﻴﻞ ﺩﺭ ﺍﻳﻨﺘﺮﻧﺖ ﺍﺳﺘﻔﺎﺩﻩ ﻣﻲ ﻛﻨﻴﻢ ﺩﺭ‬

‫‪URL‬ﻫﺎﻱ‬

‫‪ mailto:‬ﺍﺳﺘﻔﺎﺩﻩ ﻣﻲ ﺷﻮﺩ‪ .‬ﻫﻤﭽﻨﻴﻦ ﻫﻨﮕﺎﻣﻲ ﻛﻪ ﺑﺨﻮﺍﻫﻴﻢ ﻧﺎﻡ ﻛﺎﺭﺑﺮﻱ ﺭﺍ ﺑﻪ ﻫﻤﺮﺍﻩ‬ ‫ﺍﺳﻢ ﺭﻣﺰ ﺁﻥ ﺑﻪ ﻳﻚ ﭘﺮﻭﺗﻜﻠﻲ ﻣﺎﻧﻨﺪ ‪ FTP‬ﺍﺭﺟﺎﻉ ﺩﻫﻴﻢ‪.‬‬

‫~‬

‫ﺑﺮﺍﻱ ﻣﺸﺨﺺ ﻛﺮﺩﻥ ﺩﺍﻳﺮﻛﺘﻮﺭﻱ ﺧﺼﻮﺻﻲ ﻳﻚ ﻛﺎﺭﺑﺮ ﺩﺭ ﺳﻴﺴﺘﻤﻬﺎﻳﻲ ﻛﻪ ﭼﻨﺪ‬ ‫ﻛﺎﺭﺑﺮﻩ‬

‫ﻣﻲ‬

‫ﺑﺎﺷﻨﺪ‬

‫ﺍﺳﺘﻔﺎﺩﻩ‬

‫ﻣﻲ‬

‫ﺷﻮﺩ‪.‬‬

‫ﺑﺮﺍﻱ‬

‫ﻣﺜﺎﻝ‪:‬‬

‫‪ http://server/~user_login_id/‬ﻳﺎ ﺑﺮﺍﻱ ﻣﺜﺎﻝ ﺩﻳﮕﺮ ﺑﻪ ‪ URL‬ﺯﻳﺮ ﻧﮕﺎﻫﻲ‬ ‫ﺑﻴﺎﻧﺪﺍﺯﻳﺪ ‪ http://www.cs.purdue.edu/~saumil/maps :‬ﺣﺴﺎﺏ ﻛﺎﺭﺑﺮﻱ‬ ‫‪ saumil‬ﺭﺍ ﺩﺭ ﻳﻚ ﺩﺍﻳﺮﻛﺘﻮﺭﻱ ﺩﺭﻭﻥ ﻳﻚ ﺳﻴﺴﺘﻢ ﻣﺸﺨﺺ ﻣﻲ ﻛﻨﺪ‪.‬‬

‫ﺗﻬﻴﻪ ﻛﻨﻨﺪﻩ‪:‬‬ ‫ﺍﻣﻴﺮ ﺣﺴﻴﻦ ﺷﺮﻳﻔﻲ ‪[email protected] ،‬‬ ‫‪ ٢٧‬ﻣﻬﺮﻣﺎﻩ ‪١٣٨٢‬‬

‫ﻣﻨﺒﻊ‪:‬‬ ‫‪Web Hacking , Stuart McClure,Saumil Shah , Shreeraj Shah -١‬‬

‫‪- Query‬‬

‫‪WWW.WebSecurityMgz.com‬‬

‫‪6‬‬

‫‪1‬‬