Sqlmap

免责声明

本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.

项目地址

  • https://github.com/sqlmapproject/sqlmap

文章 & Reference

基础使用

检测注入

sqlmap -u URL -v 3 --random-agent                       # 判断注入
sqlmap -u URL -p id                                     # 指定参数注入
sqlmap -u URL --cookie="xxxxx"                          # 带 cookie 注入
sqlmap -u URL --batch                                   # 不要请求用户输入,使用默认行为
sqlmap -r aaa.txt                                       # post 型注入

sqlmap -u URL --flush-session                           # 清除缓存

sqlmap -u URL --os "Windows"                            # 指定操作系统
sqlmap -u URL --dbms mysql --level 3                    # 指定数据库类型为 mysql,级别为 3(共 5 级,级别越高,检测越全面)
sqlmap -u URL --dbms Microsoft SQL Server
sqlmap -u URL --dbms mysql --risk 3                     # 指定执行测试的风险(1-3, 默认 1) 1会测试大部分的测试语句,2会增加基于事件的测试语句,3会增加 OR 语句的 SQL 注入测试
sqlmap -u URL --proxy "socks5://127.0.0.1:1080"         # 代理注入测试
sqlmap -u URL --batch --smart                           # 启发式判断注入

获取信息

搜索字段

读取与写入文件

首先找需要网站的物理路径,其次需要有可写或可读权限.

  • -file-read=RFILE 从后端的数据库管理系统文件系统读取文件 (物理路径)

  • -file-write=WFILE 编辑后端的数据库管理系统文件系统上的本地文件 (mssql xp_shell)

  • -file-dest=DFILE 后端的数据库管理系统写入文件的绝对路径

提权

对 Windows 注册表操作

预估完成时间

测试 WAF/IPS/IDS 保护

尝试 getshell

宽字节检测

union 语句测试

tamper

用法

相关文章

0eunion.py

Replaces instances of UNION with e0UNION

使用 e0UNION 替换 UNION

Requirement:

  • MySQL

  • MsSQL

Notes:

  • Reference: https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf

apostrophemask.py

Replaces apostrophe character (') with its UTF-8 full width counterpart (e.g. ' -> %EF%BC%87)

将 ' 替换成 UTF-8 urlencoded 的 %EF%BC%87

References:

  • http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128

  • https://web.archive.org/web/20130614183121/http://lukasz.pilorz.net/testy/unicode_conversion/

  • https://web.archive.org/web/20131121094431/sla.ckers.org/forum/read.php?13,11562,11850

  • https://web.archive.org/web/20070624194958/http://lukasz.pilorz.net/testy/full_width_utf/index.phps

apostrophenullencode.py

Replaces apostrophe character (') with its illegal double unicode counterpart (e.g. ' -> %00%27)

将 ' 替换成 %00%27

appendnullbyte.py

Appends (Access) NULL byte character (%00) at the end of payload

在参数末尾加入 %00

Requirement:

  • Microsoft Access

Reference

  • http://projects.webappsec.org/w/page/13246949/Null-Byte-Injection

base64encode.py

Base64-encodes all characters in a given payload

base64 编码所有字符

between.py

Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' and equals operator ('=') with 'BETWEEN # AND #'

将 > 字符替换为 NOT BETWEEN 0 AND

将 = 字符替换为 BETWEEN # AND #

binary.py

Injects keyword binary where possible

Requirement:

  • MySQL

bluecoat.py

Replaces space character after SQL statement with a valid random blank character. Afterwards replace character '=' with operator LIKE

将 sql 语句后的空格字符替换为 %09，LIKE 替换字符 =

Requirement:

  • Blue Coat SGOS with WAF activated as documented in https://kb.bluecoat.com/index?page=content&id=FAQ2147

Tested against:

  • MySQL 5.1, SGOS

chardoubleencode.py

Double URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %2553%2545%254C%2545%2543%2554)

二次URL编码

charencode.py

URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %53%45%4C%45%43%54)

URL编码

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

charunicodeencode.py

Unicode-URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %u0053%u0045%u004C%u0045%u0043%u0054)

URL编码

Requirement:

  • ASP

  • ASP.NET

Tested against:

  • Microsoft SQL Server 2000

  • Microsoft SQL Server 2005

  • MySQL 5.1.56

  • PostgreSQL 9.0.3

charunicodeescape.py

Unicode-escapes non-encoded characters in a given payload (not processing already encoded) (e.g. SELECT -> \u0053\u0045\u004C\u0045\u0043\u0054)

url 解码中的 % 换成 \\

commalesslimit.py

Replaces (MySQL) instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' counterpart

替换字符的位置

Requirement:

  • MySQL

Tested against:

  • MySQL 5.0 and 5.5

commalessmid.py

Replaces (MySQL) instances like 'MID(A, B, C)' with 'MID(A FROM B FOR C)' counterpart

用 'MID(A FROM B FOR C)' 代替 'MID(A, B, C)'

Requirement:

  • MySQL

Tested against:

  • MySQL 5.0 and 5.5

commentbeforeparentheses.py

Prepends (inline) comment before parentheses (e.g. ( -> /**/()

在括号前添加内联注释

Tested against:

  • Microsoft SQL Server

  • MySQL

  • Oracle

  • PostgreSQL

concat2concatws.py

Replaces (MySQL) instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)' counterpart

将 concat(a,b) 替换成 concat_ws(mid(char(0),0,0),a,b)

Requirement:

  • MySQL

Tested against:

  • MySQL 5.0

dunion.py

Replaces instances of UNION with DUNION

将 UNION 换成 DUNION

Requirement:

  • Oracle

Reference

  • https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf

equaltolike.py

Replaces all occurrences of operator equal ('=') with 'LIKE' counterpart

将 = 换成 LIKE

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

equaltorlike.py

Replaces all occurrences of operator equal ('=') with 'RLIKE' counterpart

将 = 换成 RLIKE

Tested against:

  • MySQL 4, 5.0 and 5.5

escapequotes.py

Slash escape single and double quotes (e.g. ' -> ')

greatest.py

Replaces greater than operator ('>') with 'GREATEST' counterpart

使用 greatest 替换 >

Tested against:

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

halfversionedmorekeywords.py

Adds (MySQL) versioned comment before each keyword

在每个关键词前添加(MySQL)的版本注释

Requirement:

  • MySQL < 5.1

Tested against:

  • MySQL 4.0.18, 5.0.22

hex2char.py

Replaces each (MySQL) 0x encoded string with equivalent CONCAT(CHAR(),...) counterpart

用对应的 CONCAT(CHAR(),...) 替换每个 (MySQL)0x 编码的字符串。

Requirement:

  • MySQL

Tested against:

  • MySQL 4, 5.0 and 5.5

htmlencode.py

HTML encode (using code points) all non-alphanumeric characters (e.g. ' -> ')

HTML编码（使用代码点）所有非字母数字字符（例如，'-> &#39;）。

ifnull2casewhenisnull.py

Replaces instances like 'IFNULL(A, B)' with 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' counterpart

用 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' 代替 'IFNULL(A, B)' 这样的实例。

Requirement:

  • MySQL

  • SQLite (possibly)

  • SAP MaxDB (possibly)

Tested against:

  • MySQL 5.0 and 5.5

ifnull2ifisnull.py

Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' counterpart

用 IF(ISNULL(A), B, A) 代替 IFNULL(A, B) 这样的实例。

Requirement:

  • MySQL

  • SQLite (possibly)

  • SAP MaxDB (possibly)

Tested against:

  • MySQL 5.0 and 5.5

informationschemacomment.py

Add an inline comment (/**/) to the end of all occurrences of (MySQL) "information_schema" identifier

在所有出现的（MySQL）"information_schema" 标识符的末尾添加一个内联注释（/**/）。

least.py

Replaces greater than operator ('>') with 'LEAST' counterpart

用 LEAST 代替大于运算符（>）。

Tested against:

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

lowercase.py

Replaces each keyword character with lower case value (e.g. SELECT -> select)

用小写字母值替换每个关键词字符（例如：SELECT -> select）。

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

luanginx.py

LUA-Nginx WAFs Bypass (e.g. Cloudflare)

Reference:

  • https://opendatasecurity.io/cloudflare-vulnerability-allows-waf-be-disabled/

misunion.py

Replaces instances of UNION with -.1UNION

UNION 修改为 -.1UNION

Requirement:

  • MySQL

Reference

  • https://raw.githubusercontent.com/y0unge/Notes/master/SQL%20Injection%20WAF%20Bypassing%20shortcut.pdf

modsecurityversioned.py

Embraces complete query with (MySQL) versioned comment

Requirement:

  • MySQL

Tested against:

  • MySQL 5.0

modsecurityzeroversioned.py

Embraces complete query with (MySQL) zero-versioned comment

Requirement:

  • MySQL

Tested against:

  • MySQL 5.0

multiplespaces.py

Adds multiple spaces (' ') around SQL keywords

在sql关键字周围添加多个空格

Reference

  • https://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt

overlongutf8.py

Converts all (non-alphanum) characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. ' -> %C0%A7)

将给定的有效载荷中的所有（非字母）字符转换为超长 UTF8（不处理已经编码的）（例如 ' -> %C0%A7）

Reference:

  • https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/

  • https://www.thecodingforums.com/threads/newbie-question-about-character-encoding-what-does-0xc0-0x8a-have-in-common-with-0xe0-0x80-0x8a.170201/

overlongutf8more.py

Converts all characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94)

Reference:

  • https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/

  • https://www.thecodingforums.com/threads/newbie-question-about-character-encoding-what-does-0xc0-0x8a-have-in-common-with-0xe0-0x80-0x8a.170201/

percentage.py

Adds a percentage sign ('%') infront of each character (e.g. SELECT -> %S%E%L%E%C%T)

在每一个字符前面添加一个百分比符号

Requirement:

  • ASP

Tested against:

  • Microsoft SQL Server 2000, 2005

  • MySQL 5.1.56, 5.5.11

  • PostgreSQL 9.0

plus2concat.py

Replaces plus operator ('+') with (MsSQL) function CONCAT() counterpart

用对应的 (MsSQL) 函数 CONCAT() 代替加号运算符('+')。

Tested against:

  • Microsoft SQL Server 2012

Requirements:

  • Microsoft SQL Server 2012+

plus2fnconcat.py

Replaces plus operator ('+') with (MsSQL) ODBC function {fn CONCAT()} counterpart

Tested against:

  • Microsoft SQL Server 2008

Requirements:

  • Microsoft SQL Server 2008+

Notes:

  • Useful in case ('+') character is filtered

  • https://msdn.microsoft.com/en-us/library/bb630290.aspx

randomcase.py

Replaces each keyword character with random case value (e.g. SELECT -> SEleCt)

字符替换成大小写字符

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

  • SQLite 3

randomcomments.py

Add random inline comments inside SQL keywords (e.g. SELECT -> S//E//LECT)

在关键字添加内联注释 //

schemasplit.py

Splits FROM schema identifiers (e.g. 'testdb.users') with whitespace (e.g. 'testdb 9.e.users')

将 FROM 模式标识符（如 testdb.users ）与空白处分割（如 testdb 9.e.users ）。

Requirement:

  • MySQL

Reference:

  • https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-Slides.pdf

sleep2getlock.py

Replaces instances like 'SLEEP(5)' with (e.g.) "GET_LOCK('ETgP',5)"

用 GET_LOCK('ETgP',5) 取代 SLEEP(5)

Requirement:

  • MySQL

Tested against:

  • MySQL 5.0 and 5.5

Reference:

  • https://zhuanlan.zhihu.com/p/35245598

sp_password.py

Appends (MsSQL) function 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs

将 sp_password 附加到有效负载的末尾，用来混淆

Requirement:

  • MSSQL

Reference:

  • http://websec.ca/kb/sql_injection

space2comment.py

Replaces space character (' ') with comments '/**/'

空格替换成//

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

space2dash.py

Replaces space character (' ') with a dash comment ('--') followed by a random string and a new line ('\n')

用一个注释（'--'）代替空格字符（''），后面是一个随机字符串和一个新行（'/n'）。

Requirement:

  • MSSQL

  • SQLite

Reference:

  • https://proton.onsec.ru/contest/

space2hash.py

Replaces (MySQL) instances of space character (' ') with a pound character ('#') followed by a random string and a new line ('\n')

用（'#'）字符替换（MySQL）空格字符（''）的实例，后面是一个随机字符串和一个新行（'/n'）。

Requirement:

  • MySQL

Tested against:

  • MySQL 4.0, 5.0

space2morecomment.py

Replaces (MySQL) instances of space character (' ') with comments '/_/'

空格替换成/ /

Tested against:

  • MySQL 5.0 and 5.5

space2morehash.py

Replaces (MySQL) instances of space character (' ') with a pound character ('#') followed by a random string and a new line ('\n')

用（'#'）字符替换（MySQL）空格字符（''）的实例，后面是一个随机字符串和一个新行（'/n'）。

Requirement:

  • MySQL >= 5.1.13

Tested against:

  • MySQL 5.1.41

space2mssqlblank.py

Replaces (MsSQL) instances of space character (' ') with a random blank character from a valid set of alternate characters

将(MsSQL)空格字符('')的实例替换为一个有效的备用字符集中的随机空白字符。

Requirement:

  • Microsoft SQL Server

Tested against:

  • Microsoft SQL Server 2000

  • Microsoft SQL Server 2005

space2mssqlhash.py

Replaces space character (' ') with a pound character ('#') followed by a new line ('\n')

将空格替换成 %23%0A

Requirement:

  • MSSQL

  • MySQL

space2mysqlblank.py

Replaces (MySQL) instances of space character (' ') with a random blank character from a valid set of alternate characters

将(MySQL)空格字符('')的实例替换为有效替代字符集中的随机空白字符

Requirement:

  • MySQL

Tested against:

  • MySQL 5.1

space2mysqldash.py

Replaces space character (' ') with a dash comment ('--') followed by a new line ('\n')

用注释（'--'）代替空格字符（''），后面是一个新行（'/n'）。

Requirement:

  • MySQL

  • MSSQL

space2plus.py

Replaces space character (' ') with plus ('+')

将空格替换成 +

space2randomblank.py

Replaces space character (' ') with a random blank character from a valid set of alternate characters

用一组有效的备用字符中的随机空白字符替换空格字符（''）。

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

substring2leftright.py

Replaces PostgreSQL SUBSTRING with LEFT and RIGHT

用 LEFT 和 RIGHT 取代 PostgreSQL 的 SUBSTRING

Tested against:

  • PostgreSQL 9.6.12

symboliclogical.py

Replaces AND and OR logical operators with their symbolic counterparts (&& and ||)

将 and 和 or 的逻辑运算符分别替换为 (&& 和 ||)

unionalltonnion.py

Replaces instances of UNION ALL SELECT with UNION SELECT counterpart

将 union all select 替换成 union select

unmagicquotes.py

Replaces quote character (') with a multi-byte combo %BF%27 together with generic comment at the end (to make it work)

用多字节组合 %BF%27 代替引号字符(')，并在结尾处加上通用注释(以使其发挥作用)

Reference:

  • http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string

uppercase.py

Replaces each keyword character with upper case value (e.g. select -> SELECT)

将关键字符替换成大写

Tested against:

  • Microsoft SQL Server 2005

  • MySQL 4, 5.0 and 5.5

  • Oracle 10g

  • PostgreSQL 8.3, 8.4, 9.0

varnish.py

Appends a HTTP header 'X-originating-IP' to bypass Varnish Firewall

附加一个HTTP头来 X-originating-IP = "127.0.0.1" 来绕过防火墙

Reference:

  • https://web.archive.org/web/20160815052159/http://community.hpe.com/t5/Protect-Your-Assets/Bypassing-web-application-firewalls-using-HTTP-headers/ba-p/6418366

Examples:

versionedkeywords.py

Encloses each non-function keyword with (MySQL) versioned comment

Requirement:

  • MySQL

Tested against:

  • MySQL 4.0.18, 5.1.56, 5.5.11

versionedmorekeywords.py

Encloses each keyword with (MySQL) versioned comment

Requirement:

  • MySQL >= 5.1.13

Tested against:

  • MySQL 5.1.56, 5.5.11

xforwardedfor.py

Append a fake HTTP header 'X-Forwarded-For' (and alike)

附加多个虚假的 HTTP 头

bypass

  • 来自 : https://mp.weixin.qq.com/s/vjbQT41O4MSPoZY9fej_cw

ACCESS

相关文章

API接口

相关文章

使用方式

开启服务端后我们可以访问 url 进行调用，也可以在命令行进行调用

没有问题就可以进入我们的命令行了

命令行下可以使用以下命令

开始扫描新的任务

可以看到已经切换到我们这个任务的 ID.

每一个任务只能是一个单独测试点，每个任务对应一个 ID

创建成功后就会这样，之后我们可以通过输入 status 来获取当前的一个运行情况

SQLMAP API 扫描完成后，不会进行主动推送完成信息

returncode 如果返回的是 0，那么我们的注入就是成功的。我们可以输入 data 来获取我们的详细的信息。

返回的数据都是 JSON 格式的数据

PreviousSnortNextSuricata