欢迎使用CSDN-markdown编辑器

sqlmap 源码分析第一天

1. sqlmap的基本流程
   a. 检测环境：checkEnvironment()
   b. 设置path :setPaths(modulePath())
   c. 将命令存储起来以便以后使用cmdLineOptions.update(cmdLineParser().dict)
   {‘code’: None, ‘getUsers’: None, ‘getPasswordHashes’: None, ‘excludeSysDbs’: None, ‘uChar’: None, ‘skip’: None, ‘prefix’: None, ‘osShell’: None, ‘googlePage’: None, ‘query’: None, ‘randomAgent’: None, ‘testSkip’: None, ‘authType’: None, ‘safeUrl’: None, ‘requestFile’: None, ‘predictOutput’: None, ‘wizard’: None, ‘stopFail’: None, ‘forms’: None, ‘pivotColumn’: None, ‘dropSetCookie’: None, ‘dbmsCred’: None, ‘risk’: None, ‘sqlFile’: None, ‘rParam’: None, ‘getCurrentUser’: None, ‘notString’: None, ‘getRoles’: None, ‘getPrivileges’: None, ‘testParameter’: None, ‘tbl’: None, ‘showVersion’: None, ‘trafficFile’: None, ‘regData’: None, ‘osSmb’: None, ‘level’: None, ‘dumpTable’: None, ‘outputDir’: None, ‘skipWaf’: None, ‘timeout’: None, ‘firstChar’: None, ‘torPort’: None, ‘charset’: None, ‘regRead’: None, ‘binaryFields’: None, ‘checkTor’: None, ‘commonTables’: None, ‘direct’: None, ‘tmpPath’: None, ‘titles’: None, ‘getSchema’: None, ‘timeSec’: None, ‘paramDel’: None, ‘safeReqFile’: None, ‘regKey’: None, ‘limitStart’: None, ‘crawlExclude’: None, ‘user’: None, ‘flushSession’: None, ‘loadCookies’: None, ‘dnsName’: None, ‘csvDel’: None, ‘offline’: None, ‘method’: None, ‘tmpDir’: None, ‘disablePrecon’: None, ‘osBof’: None, ‘invalidLogical’: None, ‘getCurrentDb’: None, ‘hexConvert’: None, ‘proxyFile’: None, ‘mobile’: None, ‘answers’: None, ‘host’: None, ‘dependencies’: None, ‘cookie’: None, ‘proxy’: None, ‘regexp’: None, ‘optimize’: None, ‘limitStop’: None, ‘search’: None, ‘uFrom’: None, ‘noCast’: None, ‘testFilter’: None, ‘eta’: None, ‘csrfToken’: None, ‘threads’: None, ‘logFile’: None, ‘os’: None, ‘col’: None, ‘rFile’: None, ‘proxyCred’: None, ‘verbose’: None, ‘crawlDepth’: None, ‘updateAll’: None, ‘privEsc’: None, ‘forceDns’: None, ‘getAll’: None, ‘header’: None, ‘invalidBignum’: None, ‘regType’: None, ‘getDbs’: None, ‘freshQueries’: None, ‘uCols’: None, ‘smokeTest’: None, ‘wFile’: None, ‘udfInject’: None, ‘invalidString’: None, ‘tor’: None, ‘forceSSL’: None, ‘ignore401’: None, ‘beep’: None, ‘disableColoring’: None, ‘configFile’: None, ‘scope’: None, ‘authFile’: None, ‘isDba’: None, ‘torType’: None, ‘regVal’: None, ‘dummy’: None, ‘mnemonics’: None, ‘skipUrlEncode’: None, ‘referer’: None, ‘liveTest’: None, ‘purgeOutput’: None, ‘retries’: None, ‘osPwn’: None, ‘extensiveFp’: None, ‘secondOrder’: None, ‘advancedHelp’: None, ‘batch’: None, ‘headers’: None, ‘authCred’: None, ‘osCmd’: None, ‘suffix’: None, ‘smart’: None, ‘regDel’: None, ‘shLib’: None, ‘sitemapUrl’: None, ‘identifyWaf’: None, ‘msfPath’: None, ‘dumpAll’: None, ‘getHostname’: None, ‘sessionFile’: None, ‘safePost’: None, ‘noEscape’: None, ‘getTables’: None, ‘safeFreq’: None, ‘agent’: None, ‘sqlmapShell’: None, ‘lastChar’: None, ‘string’: None, ‘dbms’: None, ‘forceThreads’: None, ‘dumpWhere’: None, ‘tamper’: None, ‘hpp’: None, ‘runCase’: None, ‘delay’: None, ‘evalCode’: None, ‘cleanup’: None, ‘csrfUrl’: None, ‘getBanner’: None, ‘profile’: None, ‘getComments’: None, ‘bulkFile’: None, ‘db’: None, ‘excludeCol’: None, ‘dumpFormat’: None, ‘alert’: None, ‘nullConnection’: None, ‘skipStatic’: None, ‘parseErrors’: None, ‘getCount’: None, ‘dFile’: None, ‘data’: None, ‘regAdd’: None, ‘ignoreProxy’: None, ‘getColumns’: None, ‘url’: u’http://cxzx.szedu.com/article.php?id=2323‘, ‘googleDork’: None, ‘pickledOptions’: None, ‘saveConfig’: None, ‘sqlShell’: None, ‘pageRank’: None, ‘tech’: None, ‘textOnly’: None, ‘cookieDel’: None, ‘commonColumns’: None, ‘keepAlive’: None}

   d. sql注入检测开始：dataToStdout(“[*] starting at %s\n\n” % time.strftime(“%X”), forceOutput=True)
   e. 设置一些基本的属性init()
   f. 准备工作做完后，开始进行注入： start()
   g.小小解析一下start() 函数： 这个函数检测get post cookie user-agent 这些是否是动态的，还要检测页面是否是动态的，最后进行sql注入检测。
   h.进入主函数： 判断程序是否对配置文件有权限；判断 目标网站有几个，大于1 输出sqlmap got a total of %d targets
   对与每一网站设置： url，method，data,cookie
   for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets:
   i，具体的注入。。。。。。。。。。。。。。。。。。。。。。