Sqlmap Bulk Scan Burpsuite request logging

Sqlmap can batch scan the log file containing request, and the request log file can be obtained by burpsuite.

As a result, the Sqlmap combined with the Burpsuite tool allows for a more efficient, carpet-based scan of the application for SQL injection vulnerabilities.

The scanning method usually has two kinds of Windows scan and Linux scan.

One, under Windows Scan configuration

1. Configure Burpsuite to record all request records and save them in the specified folder.

Because the Windows Sqlmap tool needs to use Python, my sqlmap path is placed under C:\Python27\sqlmap,

The record file that collects the request is named the C:\Python27\sqlmap\sqlmap.txt file.

2. Execute command: sqlmap.py-l sqlmap.txt--batch-smart to inject scan of all request saved in Sqlmap.txt.

Batch: will automatically select Yes

Smart: Heuristic quick judgment, save time.

The last URL that the window version of Sqlmap can inject will be saved to the C:\Users\Administrator\.sqlmap folder.

Second, Linux under Scan configuration

1. Linux under Scan configuration and under the Windows Scan configuration basically the same, input command burpsuite can pop up burpsuite main window

2. Similarly, set the log file on the Burpsuite to record the request and save it to the path you want to save.

2. Perform a command scan as with Windows, Sqlmap.py-l sqlmap.txt--batch-smart is not verbose.

Third, the matters needing attention

Finally, it is important to note that if the Sqlmap version on Windows is too low, it will affect the results of the scan, most likely

Scan the SQL injection vulnerability, before scanning may wish to check the specific version of Sqlmap, try to use the higher version of the Sqlmap,

Here is the information I found in my own environment.

• View Sqlmap version information under Linux:

[Email protected]:~/sqlmap# sqlmap--version1.0-dev-nongit-201602180a89

• Windows check out the version information you see

c:\python27\sqlmap>sqlmap.py--version    sqlmap/0.9 - automatic SQL injection and database Takeover Tool    http://sqlmap.sourceforge.netsqlmap/0.9  Continue...

Sqlmap Bulk Scan Burpsuite request logging