SQLMAP自动注入

sqlmap是一款非常强大的开源sql自动化注入工具，可以用来检测和利用sql注入漏洞【动态页面中get/post参数、cookie、HTTP头】。它由Python语言开发而成，因此运行需要安装python环境。但在kali中已经集成。其功能完善，有强大的引擎，适用几乎所有数据库，，可自动进行数据榨取，也可对检测与利用的自动化处理（数据库指纹、访问底层文件系统、执行操作系统命令），还可以做XSS漏洞检测。

五种漏洞检测技术

• 基于布尔的盲注检测
• 基于时间的盲注检测
  • ‘ and (select * from (select(sleep(20)))a)–
• 基于错误的检测
• 基于UNION联合查询的检测
  • 适用于通过循环直接输出联合查询结果，否则只显示第一项结果
• 基于堆叠的检测
  • ；堆叠多个查询语句
  • 适用于非select的数据修改、删除操作

支持的数据库

• MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase , SAP MaxDB

其他特性

• 数据库直接连接 -d
  • 不通过SQL注入，制定身份认证信息、IP、端口
• 与burpsuite、google结合使用，支持正则表达式限定测试目标
• Get、post、cookie、Referer、User-Agent（随机或指定）
  • Cookie过期后自动处理Set-Cookie头，更新cookie信息
• 限速：最大并发、延迟发送
• 支持Basic，Digest，NTLM，CA身份认证
• 数据库版本、用户、权限、hash枚举和字典破解、暴力破解表列名称
• 文件上传下载、UDF\启动并执行存储过程、操作系统命令执行、访问windows注册表
• 与W3af、metasploit集成结合使用，基于数据库服务进程提权和上传执行后门

SQLMAP安装

更新

sqlmap --update 

git clone https://github.com/sqlmapproject/sqlmap.git

git pull

参数详解

        ___
       __H__
 ___ ___["]_____ ___ ___  {1.2.7.28#dev}
|_ -| . [(]     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V          |_|   http://sqlmap.org

Usage: sqlmap.py [options]

Options:
  -h, --help            Show basic help message and exit
  -hh                   Show advanced help message and exit
  --version             Show program's version number and exit
  -v VERBOSE            Verbosity level: 0-6 (default 1) 

  Target:  // 目标
    At least one of these options has to be provided to define the
    target(s)

    -d DIRECT           Connection string for direct database connection    // 连接数据库
    -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")  // 指定url
    -l LOGFILE          Parse target(s) from Burp or WebScarab proxy log file   // 指定相关日志文件
    -x SITEMAPURL       Parse target(s) from remote sitemap(.xml) file        // 指定站点体贴
    -m BULKFILE         Scan multiple targets given in a textual file     // 指定保存多个url的文件
    -r REQUESTFILE      Load HTTP request from a file              // 指定包含http头部的url的文件(可用于post方法)
    -g GOOGLEDORK       Process Google dork results as target URLs
    -c CONFIGFILE       Load options from a configuration INI file      // 将命令保存文件，然后指定执行

  Request:  // 请求
    These options can be used to specify how to connect to the target URL

    --method=METHOD     Force usage of given HTTP method (e.g. PUT)
    --data=DATA         Data string to be sent through POST    //指定传递参数（POST）
    --param-del=PARA..  Character used for splitting parameter values  //变量分隔符
    --cookie=COOKIE     HTTP Cookie header value
    --cookie-del=COO..  Character used for splitting cookie values
    --load-cookies=L..  File containing cookies in Netscape/wget format
    --drop-set-cookie   Ignore Set-Cookie header from response   //忽略网页响应的新cookies
    --user-agent=AGENT  HTTP User-Agent header value
    --random-agent      Use randomly selected HTTP User-Agent header value    //随机User-Agent
    --host=HOST         HTTP Host header value     //指定host名称
    --referer=REFERER   HTTP Referer header value      //指定referer头
    -H HEADER, --hea..  Extra header (e.g. "X-Forwarded-For: 127.0.0.1")
    --headers=HEADERS   Extra headers (e.g. "Accept-Language: fr\nETag: 123") //指定请求头部信息（参数用\n分隔）
    --auth-type=AUTH..  HTTP authentication type (Basic, Digest, NTLM or PKI)  //用于HTTP协议认证
    --auth-cred=AUTH..  HTTP authentication credentials (name:password)
    --auth-file=AUTH..  HTTP authentication PEM cert/private key file    // 用于客户端认证
    --ignore-code=IG..  Ignore HTTP error code (e.g. 401)
    --ignore-proxy      Ignore system default proxy settings
    --ignore-redirects  Ignore redirection attempts
    --ignore-timeouts   Ignore connection timeouts
    --proxy=PROXY       Use a proxy to connect to the target URL       // 指定代理服务器
    --proxy-cred=PRO..  Proxy authentication credentials (name:password)
    --proxy-file=PRO..  Load proxy list from a file
    --tor               Use Tor anonymity network
    --tor-port=TORPORT  Set Tor proxy port other than default
    --tor-type=TORTYPE  Set Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))
    --check-tor         Check to see if Tor is used properly
    --delay=DELAY       Delay in seconds between each HTTP request   //http(s)请求之间得延迟时间，单位秒
    --timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)    // 超时时间
    --retries=RETRIES   Retries when the connection timeouts (default 3)       // 重试次数
    --randomize=RPARAM  Randomly change value for given parameter(s)  //指定请求需要随机值的参数，如id
    --safe-url=SAFEURL  URL address to visit frequently during testing
    --safe-post=SAFE..  POST data to send to a safe URL
    --safe-req=SAFER..  Load safe HTTP request from a file
    --safe-freq=SAFE..  Test requests between two visits to a given safe URL
    --skip-urlencode    Skip URL encoding of payload data         // 跳过url的编码
    --csrf-token=CSR..  Parameter used to hold anti-CSRF token
    --csrf-url=CSRFURL  URL address to visit to extract anti-CSRF token
    --force-ssl         Force usage of SSL/HTTPS    // 使用https协议
    --hpp               Use HTTP parameter pollution method    // 使用HTTP参数污染方法 ，绕过WAF/IPS/IDS的有效方法
    --eval=EVALCODE     Evaluate provided Python code before the request (e.g.  // 利用代码修改url中的参数值
                        "import hashlib;id2=hashlib.md5(id).hexdigest()")

  Optimization:    //优化性能
    These options can be used to optimize the performance of sqlmap

    -o                  Turn on all optimization switches      // 开启以下三个参数，除--threads
    --predict-output    Predict common queries output // 根据返回值和和统计表内容，不断缩小检测范围，提高效率
                                                                                 （与--thread参数不兼容）
    --keep-alive        Use persistent HTTP(s) connections   //使用http(s)长连接,减小开销  与--proxy不兼容
    --null-connection   Retrieve page length without actual HTTP response body //只获取返回页面的大小
                                                         ，而非内容常用于盲注，与--text-only不兼容

    --threads=THREADS   Max number of concurrent HTTP(s) requests (default 1)  // 并发线程数

  Injection:  // 注入
    These options can be used to specify which parameters to test for,
    provide custom injection payloads and optional tampering scripts

    -p TESTPARAMETER    Testable parameter(s)     // 指定扫描的参数
    --skip=SKIP         Skip testing for given parameter(s)   // 跳过指定参数的扫描
    --skip-static       Skip testing parameters that not appear to be dynamic
    --param-exclude=..  Regexp to exclude parameters from testing (e.g. "ses")
    --dbms=DBMS         Force back-end DBMS to provided value   // 指定扫描目标扫描的数据库类型版本
    --dbms-cred=DBMS..  DBMS authentication credentials (user:password)   // 指定数据库账号密码
    --os=OS             Force back-end DBMS operating system to provided value  //指定扫描目标的操作系统
    --invalid-bignum    Use big numbers for invalidating values   // 使用大的数字使参数失效，如id=99999999
    --invalid-logical   Use logical operations for invalidating values  //使用逻辑操作使参数失效
    --invalid-string    Use random strings for invalidating values    // 使用随机字符串使参数失效
    --no-cast           Turn off payload casting mechanism       // 关闭有效载荷释放机制
                                                   //  榨取数据时，sqlmap将所有结果转换为字符串，并用空格代替NULL结果  
                                                   //  在老版本mysql数据库需要开启此开关 
    --no-escape         Turn off string escaping mechanism     //  关闭字符串转义机制
    --prefix=PREFIX     Injection payload prefix string           // 在payload前面加前缀
    --suffix=SUFFIX     Injection payload suffix string           // 在payload前面加后缀
    --tamper=TAMPER     Use given script(s) for tampering injection data   // 使用脚本注入，常用于绕过WAF，IDS

  Detection:    // 检测
    These options can be used to customize the detection phase

    --level=LEVEL       Level of tests to perform (1-5, default 1)   // 检测级别 （/usr/share/sqlmap/xml/payloads）
    --risk=RISK         Risk of tests to perform (1-3, default 1)    // 风险级别
    --string=STRING     String to match when query is evaluated to True //查询计算为True时要匹配的字符串
    --not-string=NOT..  String to match when query is evaluated to False  //查询计算为False时要匹配的字符串
    --regexp=REGEXP     Regexp to match when query is evaluated to True   //当查询被评估为True时匹配的正则表达式
    --code=CODE         HTTP code to match when query is evaluated to True  //查询评估为True时要匹配的HTTP代码
    --text-only         Compare pages based only on the textual content    //仅根据文本内容比较页面
    --titles            Compare pages based only on their titles        //仅根据标题比较页面

  Techniques:   // 技术
    These options can be used to tweak testing of specific SQL injection
    techniques

    --technique=TECH    SQL injection techniques to use (default "BEUSTQ")  //指定扫描的技术（如报错、时间等）
    --time-sec=TIMESEC  Seconds to delay the DBMS response (default 5)      //基于时间注入的延时
    --union-cols=UCOLS  Range of columns to test for UNION query SQL injection  //联合查询的列数
    --union-char=UCHAR  Character to use for bruteforcing number of columns  // 指定联合查询时的数值，默认NULL
    --union-from=UFROM  Table to use in FROM part of UNION query SQL injection   
    --dns-domain=DNS..  Domain name used for DNS exfiltration attack
    --second-url=SEC..  Resulting page URL searched for second-order response  // 响应的结果在另一个url页面中
    --second-req=SEC..  Load second-order HTTP request from file

  Fingerprint:
    -f, --fingerprint   Perform an extensive DBMS version fingerprint  \\ 查询数据库版本，操作系统，架构等

  Enumeration:  // 枚举
    These options can be used to enumerate the back-end database
    management system information, structure and data contained in the
    tables. Moreover you can run your own SQL statements

    -a, --all           Retrieve everything   // 检索一切
    -b, --banner        Retrieve DBMS banner   // 查询数据库的banner信息（数据库版本）
    --current-user      Retrieve DBMS current user     //当前数据库用户
    --current-db        Retrieve DBMS current database   // 当前使用的数据库
    --hostname          Retrieve DBMS server hostname     // 查询主机名
    --is-dba            Detect if the DBMS current user is DBA
    --users             Enumerate DBMS users    // 查询数据库用户
    --passwords         Enumerate DBMS users password hashes
    --privileges        Enumerate DBMS users privileges // 枚举用户的权限信息（-U 指定用户 -CU 当前用户）
    --roles             Enumerate DBMS users roles    
    --dbs               Enumerate DBMS databases   // 枚举当前所有的数据库
    --tables            Enumerate DBMS database tables
    --columns           Enumerate DBMS database table columns
    --schema            Enumerate DBMS schema       // 枚举元数据库中的信息
    --count             Retrieve number of entries for table(s)
    --dump              Dump DBMS database table entries     // 将枚举的信息存储下来
    --dump-all          Dump all DBMS databases tables entries
    --search            Search column(s), table(s) and/or database name(s)
    --comments          Check for DBMS comments during enumeration
    -D DB               DBMS database to enumerate
    -T TBL              DBMS database table(s) to enumerate
    -C COL              DBMS database table column(s) to enumerate
    -X EXCLUDE          DBMS database identifier(s) to not enumerate // 
    -U USER             DBMS user to enumerate      // 指定用户
    --exclude-sysdbs    Exclude DBMS system databases when enumerating tables
    --pivot-column=P..  Pivot column name
    --where=DUMPWHERE   Use WHERE condition while table dumping
    --start=LIMITSTART  First dump table entry to retrieve    // 通过start和stop参数选择查询的数据量（行数）
    --stop=LIMITSTOP    Last dump table entry to retrieve0
    --first=FIRSTCHAR   First query output word character to retrieve
    --last=LASTCHAR     Last query output word character to retrieve
    --sql-query=QUERY   SQL statement to be executed
    --sql-shell         Prompt for an interactive SQL shell
    --sql-file=SQLFILE  Execute SQL statements from given file(s)

  Brute force:  // 暴力破解
    These options can be used to run brute force checks

    --common-tables     Check existence of common tables   // 破解表名称
    --common-columns    Check existence of common columns  // 破解列名称

  User-defined function injection:  // 用户自定义函数注入
    These options can be used to create custom user-defined functions

    --udf-inject        Inject custom user-defined functions
    --shared-lib=SHLIB  Local path of the shared library

  File system access:
    These options can be used to access the back-end database management
    system underlying file system

    --file-read=RFILE   Read a file from the back-end DBMS file system // 读取目标系统文件
    --file-write=WFILE  Write a local file on the back-end DBMS file system  // 写文件
    --file-dest=DFILE   Back-end DBMS absolute filepath to write to   // 上传文件存储的位置（目标地址）

  Operating system access:    // 操作系统访问
    These options can be used to access the back-end database management
    system underlying operating system

    --os-cmd=OSCMD      Execute an operating system command //执行cmd命令
    --os-shell          Prompt for an interactive operating system shell //提示输入交互式操作系统shell
    --os-pwn            Prompt for an OOB shell, Meterpreter or VNC
    --os-smbrelay       One click prompt for an OOB shell, Meterpreter or VNC
    --os-bof            Stored procedure buffer overflow exploitation
    --priv-esc          Database process user privilege escalation
    --msf-path=MSFPATH  Local path where Metasploit Framework is installed
    --tmp-path=TMPPATH  Remote absolute path of temporary files directory

  Windows registry access:   // windows注册表访问
    These options can be used to access the back-end database management
    system Windows registry

    --reg-read          Read a Windows registry key value
    --reg-add           Write a Windows registry key value data
    --reg-del           Delete a Windows registry key value
    --reg-key=REGKEY    Windows registry key
    --reg-value=REGVAL  Windows registry key value
    --reg-data=REGDATA  Windows registry key value data
    --reg-type=REGTYPE  Windows registry key value type

  General:
    These options can be used to set some general working parameters

    -s SESSIONFILE      Load session from a stored (.sqlite) file   // 指定会话文件存放位置
    -t TRAFFICFILE      Log all HTTP traffic into a textual file  //  指定流量文件存放位置
    --batch             Never ask for user input, use the default behavior   // 所有提示都用默认选项
    --binary-fields=..  Result fields having binary values (e.g. "digest")
    --check-internet    Check Internet connection before assessing the target
    --crawl=CRAWLDEPTH  Crawl the website starting from the target URL   // 爬取信息，指定爬取深度
    --crawl-exclude=..  Regexp to exclude pages from crawling (e.g. "logout")
    --csv-del=CSVDEL    Delimiting character used in CSV output (default ",")  //指定csv文件数据的分隔符
    --charset=CHARSET   Blind SQL injection charset (e.g. "0123456789abcdef")    // 强制字符编码
    --dump-format=DU..  Format of dumped data (CSV (default), HTML or SQLITE)
    --encoding=ENCOD..  Character encoding used for data retrieval (e.g. GBK)
    --eta               Display for each output the estimated time of arrival
    --flush-session     Flush session files for current target    // 清空会话数据
    --forms             Parse and test forms on target URL
    --fresh-queries     Ignore query results stored in session file  // 忽略session查询结果
    --har=HARFILE       Log all HTTP traffic into a HAR file
    --hex               Use hex conversion during data retrieval  以16进制进行数据传输
    --output-dir=OUT..  Custom output directory path // 指定输出目录
    --parse-errors      Parse and display DBMS error messages from responses  // 分析数据库内建报错信息
    --save=SAVECONFIG   Save options to a configuration INI file         //  编辑配置文件
    --scope=SCOPE       Regexp to filter targets from provided proxy log   //从日志文件通过正则表达式过滤目标
    --test-filter=TE..  Select tests by payloads and/or titles (e.g. ROW)
    --test-skip=TEST..  Skip tests by payloads and/or titles (e.g. BENCHMARK)
    --update            Update sqlmap

  Miscellaneous:   // 杂项
    -z MNEMONICS        Use short mnemonics (e.g. "flu,bat,ban,tec=EU")  //   参数助记符
    --alert=ALERT       Run host OS command(s) when SQL injection is found
    --answers=ANSWERS   Set question answers (e.g. "quit=N,follow=N")
    --beep              Beep on question and/or when SQL injection is found
    --cleanup           Clean up the DBMS from sqlmap specific UDF and tables
    --dependencies      Check for missing (non-core) sqlmap dependencies
    --disable-coloring  Disable console output coloring
    --gpage=GOOGLEPAGE  Use Google dork results from specified page number
    --identify-waf      Make a thorough testing for a WAF/IPS/IDS protection   // waf/ips/ids的彻底检测
    --list-tampers      Display list of available tamper scripts
    --mobile            Imitate smartphone through HTTP User-Agent header    // 模拟成手机发送请求
    --offline           Work in offline mode (only use session data)
    --purge             Safely remove all content from sqlmap data directory //安全地从sqlmap数据目录中删除所有内容
    --skip-waf          Skip heuristic detection of WAF/IPS/IDS protection
    --smart             Conduct thorough tests only if positive heuristic(s)   // 只选择基于错误的检测结果
    --sqlmap-shell      Prompt for an interactive sqlmap shell
    --tmp-dir=TMPDIR    Local directory for storing temporary files
    --web-root=WEBROOT  Web server document root directory (e.g. "/var/www")
    --wizard            Simple wizard interface for beginner users     // 注入向导