POST injected Profile
POST injection is a form of injection, I believe we all know that in previous lessons POST \ GET parameter passing two kinds of ways.
POST injection is to be injected using the POST parameter passing, no different in essence and GET type.
POST-risk injection point
Login box, and data query box and other interactive framed
classic POST injection case: 'or 1 = 1 #
How Sqlmap be injected into the type of SQL injection POST
--forms sqlmap to read the page in the form POST parameter passing Parameter name and then pass SQL injection
-r 1.txt sqlmap read packet files SQL injection, injection can play at a number of tests that point * Tell Sqlmap
post injection
在填写表单的时候提交使用post传参
一般是在用户名框或者密码框尝试
sqlmap如何跑post注入
方法一：sqlmap.py -u http://xxxxxx --form
方法二：通过抓包的方式，保存在文件中，在注入点加上 * 号提示sqlmap，同时有些注入点，是需要登录的状态下的权限，而一般的sqlmap是没有权限的，但是通过抓包的方式存在cookie