Record an API interface SQL injection practice

Catalog

0x01 Ideas ：google hacking grammar asmx?wsdl

0x02  Found two interfaces And can call in different places

0x03 Grab the bag repeat Judge

0x04 Warehouse

---

To guide the A tutor

0x01 Ideas ：google hacking grammar asmx?wsdl

Click on url：domain/WebServices/InboxWS.asmx

0x02  Found two interfaces And can call in different places

Firefox grabbing

test

0x03 Grab the bag repeat Judge

Four parameters plus ' newspaper nynax error It can be inferred that sql Inject

Last use sqlmap Run out sqlserver database Delay Injection

Because of the proximity here 12 The point interface service is unstable Get here first

0x04 Warehouse

sqlmap grammar

python sqlmap.py -r 1.txt --batch

        python sqlmap.py -r 1.txt --dbs --batch

nudges