A powerful SQL injection tool--sqlmap

1. Preface
The injection tool under Windows is good and expensive, free Ah D, Ming boy and so on, we don't need to spend
Time to find what cracked havij, pangolin and so on, especially the tool is likely to be tied to the Trojan horse. In fact
The injection tools under Linux are also very powerful, and not too much to say, can completely replace all the injections under Windows
Tools.
As in the backtrack system there is a very rich injection tool, for MSSQL, MYSQL, Oracle and other various
Database, and these tools are free and open source, we can also be used to repair
Replace the appropriate injection tool for your own use.

This article introduces the Sqlmap is an open source penetration testing tool, it can automatically detect and use SQL
Inject the vulnerability to take over the database server. It is equipped with a powerful detection engine that provides the ultimate penetration tester with a
Many wretched features can be dragged to the library, can access the underlying file system, and can also be performed via an out-of-band connection on the operating system
's command.

2. Sqlmap Command Detailed
For ease of use I have translated the Sqlmap options, and there may be some inappropriate places,
Please point out that you can send me an e-mail: [email protected]. If I have time, I will give this tool a Chinese version.

Options (optional):
--version Display the program's version number and exit
-H,--help displays this help message and exits
-V VERBOSE verbose level: 0-6 (default = 1)

Target (destination):
At a minimum, you need to set one of these options to set the destination URL.

-D Direct connects directly to the database.
-u URL,--url=url destination URL.
-l list resolves the target from the log of the burp or WebScarab agent.
-R RequestFile loading HTTP requests from a file.
-G googledork The result of processing Google dork as the destination URL.
-C configfile Load options from the INI configuration file.

Request::
These options can be used to specify how to connect to the destination URL.

--data=data data strings sent via post
--cookie=cookie HTTP Cookie Header
--cookie-urlencode URL encoding generated by cookie injection
--drop-set-cookie Ignore Set-cookie header information for response
--user-agent=agent specifying the HTTP user-agent header
--random-agent using a randomly selected HTTP User-agent header
--referer=referer specifying the HTTP referer header
--headers=headers line break, add other HTTP headers
--auth-type=atype HTTP Authentication type (base, digest, or NTLM) (Basic, Digest or NTLM)
--auth-cred=acred HTTP Authentication credentials (user name: password)
--auth-cert=acert HTTP Authentication certificate (key_file,cert_file)
--proxy=proxy using an HTTP proxy to connect to the destination URL
--proxy-cred=pcred HTTP proxy authentication credentials (user name: password)
--ignore-proxy ignoring the system default HTTP proxy
--delay=delay delay time in seconds between each HTTP request
--timeout=timeout time to wait for the connection to time out (default is 30 seconds)
--retries=retries time the connection is reconnected after timeout (default 3)
--scope=scope regular expression of filter targets from the provided agent log
--safe-url=safurl URL addresses that are frequently accessed during testing
--safe-freq=safreq test requests between two visits, give a secure URL


Optimization (optimized):
These options can be used to optimize the performance of Sqlmap.

-O Turn on all optimization switches
--predict-output prediction of common query output
--keep-alive using a persistent HTTP (S) connection
--null-connection retrieving page lengths from no actual HTTP response body
--threads=threads Maximum http (S) request concurrency (default = 1)

Injection (injection):
These options can be used to specify which parameters are tested, provide custom injection payloads, and optional tamper scripts.

-p testparameter parameters to test (S)
--dbms=dbms the DBMS of the forced backend for this value
--os=os the DBMS operating system for the forced backend is this value
--prefix=prefix Injecting payload String prefix
--suffix=suffix Injecting payload string suffix
--tamper=tamper using the given script (S) to tamper with the injected data


Detection (detection):
These options can be used to specify how the contents of the HTTP response page are parsed and compared when the SQL blinds are made.

--level=level level of test Execution (1-5, default = 1)
--risk=risk risk of performing tests (0-3, default = 1)
--string=string when query is valid when the page matches a string
--regexp=regexp a regular expression on a page when the query is valid
--text-only based on comparing pages in text content only

Techniques (Tips):
These options can be used to adjust specific SQL injection tests.

--technique=tech SQL injection Technology test (default Beust)
Delay time of--time-sec=timesec DBMS response (default is 5 seconds)
--union-cols=ucols set range for test union query injection
--union-char=uchar characters used for brute-force guessing of the number of columns

Fingerprint (fingerprint):
-F,--fingerprint performs check of extensive DBMS version thumbprint

Enumeration (enum):
These options can be used to enumerate the information of the backend database management system, the structure in the table, and the data. In addition, you can also run your own
of SQL statements.
-B,--banner retrieves the identity of the database management system
--current-user Retrieving database management system Current user
--CURRENT-DB Retrieving database management system current database
--IS-DBA detecting whether the DBMS current user is DBA
--users Enumerating Database management system users
--passwords enumeration of database management system user password hashes
--privileges enumerate the permissions of the database management system user
--roles enumerating the roles of database management system users
--dbs Enumeration Database Management System Database
--tables enumeration of tables in the DBMS database
--columns Enumerating DBMS database table columns
--dump the table entries in the database of the DUMP database management system
--dump-all dumps all the entries in the DBMS database table
--search Search column (s), table (s) and/or database name (s)
-D DB name of the database to enumerate
-T TBL database table to be enumerated
-C COL The database column to enumerate
-u user for enumerating database users
--exclude-sysdbs to exclude system databases when enumerating tables
--start=limitstart first query output into search
--stop=limitstop the output of the last query into the search
--first=firstchar character retrieval of the first query output word
--last=lastchar the output character retrieval of the last query
--sql-query=query the SQL statement to execute
--sql-shell tips for Interactive SQL shell

Brute forces (brute force):
These options can be used to run brute force checks.

--common-tables Check Existence common table
--common-columns Check existence Common column

user-defined function Injection (user-defined functions injection):
These options can be used to create user-defined functions.

--udf-inject injecting user-defined functions
--shared-lib=shlib local path to shared library

File system access (Access FileSystem):
These options can be used to access the underlying file system of the backend database management system.

--file-read=rfile reading files from the backend database management System file system
--file-write=wfile editing a local file on the backend database management System file system
The absolute path to the file written by the database management system on the--file-dest=dfile backend

Operating system access (operating system accesses):
These options can be used to access the underlying operating system of the back-end database management system.

--os-cmd=oscmd executing operating system commands
--os-shell the shell of an interactive operating system
--os-pwn get an OOB shell,meterpreter or VNC
--os-smbrelay One-click to get an OOB shell,meterpreter or VNC
--os-bof stored Procedure Buffer Overflow utilization
--PRIV-ESC Database Process User privilege elevation
--msf-path=msfpath Metasploit Framework Local installation path
--tmp-path=tmppath absolute path to remote temp file directory


Windows Registry access:
These options can be used to access the Windows registry of the back-end database management system.

--reg-read read a Windows registry key value
--reg-add write a Windows registry key value data
--reg-del deleting Windows registry key values
--reg-key=regkey Windows registry key
--reg-value=regval Windows registry key values
--reg-data=regdata Windows registry key value data
--reg-type=regtype Windows registry key value types

General (Normal):

These options can be used to set some general working parameters.
-T trafficfile log all HTTP traffic to a text file
-S Sessionfile save and restore all data for retrieving session files
--flush-session Refresh the current target session file
--fresh-queries ignores query results stored in the session file
--eta shows the estimated time of arrival for each output
--update Update Sqlmap
--save file save option to INI profile
--batch never asks for user input, and uses all default configurations.

Miscellaneous (Miscellaneous):
--BEEP alert when SQL injection is found
Detection and testing of--check-payload IDs for injection payloads
--cleanup Sqlmap specific UDF and table cleanup DBMS
--forms parsing and testing of target URLs
--gpage=googlepage using Google dork results from the specified page number
--page-rank Google dork Results Display page rank (PR)
--parse-errors parsing the database management system error message from the response page
--replicate copy dump data to a sqlite3 database
--tor using the default Tor (VIDALIA/PRIVOXY/POLIPO) proxy address
--wizard Simple Wizard Interface for novice users

3. What is OOB?

The Transport Layer protocol uses out-of-band data (OUT-OF-BAND,OOB) to send some important data if the communicating party has
When important data needs to be notified, the protocol can send the data to the other person quickly. In order to send this data, the association
Instead of using the same channel as the normal data, a different channel is used. Socket mechanism support for Linux systems
Low-level protocols send and receive out-of-band data. But the TCP protocol doesn't really have out-of-band data. In order to send important co-
Protocol, TCP provides a mechanism called emergency mode (Urgentmode). The TCP protocol sets the Urg bit in the data segment, indicating
Enter emergency mode. The receiver can take special care of the emergency mode. It's easy to see that data is not easy in this way
is blocked, you can receive the data in a timely manner by capturing the Sigurg signal in our server-side program or using a
The recv function of the OOB flag is accepted.

A powerful SQL injection tool--sqlmap