DWVA Tutorial (ii)--SQL injection

Welcome to the SQL injection section, this time we are using the Sqlmap tool.

We have detected the existence of the classic parameter ID, with a cheeky statement: SQL injection vulnerabilities exist.

So how do we prove it?

Good habits, first grab the bag, get the method submitted, pulled out the almighty sqlmap.

Focus, knock on the blackboard, crazy time: 302?

Here we ignore it (it is not not understood to say) direct carriage to see what will happen.

"Fake It!!" My sqlmap has never been a reliable!! "Cough, this sentence I have been shouting for two months."

The reason is very simple, sqlmap access to the page was reset to the login interface.

So here we have to give it a cookie: Of course, the cookie was captured when it was caught in front of the packet.

Perfect Infusion ~

At the end of the time, sprinkle the flowers, without breaking the saying ~

What the? No post injection method?

Dwvasql injection By default, there is no post injection method, of course, by modifying the source code to implement post submission,

Here we are not to discuss, the usual, work contact with real cases to publish the tutorial.

So, here it is.

I can lose a personal public number weak, fan too little has been no passion for writing,

If you like technology, like Parrotsec, like two times, look forward to meet you.

It's not what Lori controls, just like the girl paper happened to be Lori, hum ~

DWVA Tutorial (ii)--SQL injection