2019-2-16 sqlmap安装和应用

其他 2019-03-29 18:40:53 阅读次数: 0

我的环境是Win10家庭版

1.安装

  • 下载sqlmap

sqlmap官网下载zip文件，我下载的文件是sqlmapproject-sqlmap-1.3.2-24-g8fe37f3.zip
解压后，浏览一下doc目录中readme文件，sqlmap requires Python version 2.6.x or 2.7.x.

  • 下载python

python官网下载2.7版本的python，我下载的是python-2.7.15.amd64.msi
安装时候记得选择add python.exe to Path，省的自己再设置环境变量。
在这里插入图片描述
完成后进入命令行测试一下

Microsoft Windows [版本 10.0.17134.590]
(c) 2018 Microsoft Corporation。保留所有权利。

C:\>python
Python 2.7.15 (v2.7.15:ca079a3ea3, Apr 30 2018, 16:30:26) [MSC v.1500 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> exit
Use exit() or Ctrl-Z plus Return to exit
>>>

没问题。

  • 设置sqlmap

在python安装目录下新建一个sqlmap目录，然后把刚才下载的sqlmapproject-sqlmap-1.3.2-24-g8fe37f3.zip解压到其中。
进入命令行测试一下

C:\Python27\sqlmap>sqlmap.py -h
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.3.2.22#dev}
|_ -| . ["]     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

Usage: sqlmap.py [options]

Options:
  -h, --help            Show basic help message and exit
  -hh                   Show advanced help message and exit
  --version             Show program's version number and exit
  -v VERBOSE            Verbosity level: 0-6 (default 1)

  Target:
    At least one of these options has to be provided to define the
    target(s)

    -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
    -g GOOGLEDORK       Process Google dork results as target URLs

  Request:
    These options can be used to specify how to connect to the target URL

    --data=DATA         Data string to be sent through POST (e.g. "id=1")
    --cookie=COOKIE     HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
    --random-agent      Use randomly selected HTTP User-Agent header value
    --proxy=PROXY       Use a proxy to connect to the target URL
    --tor               Use Tor anonymity network
    --check-tor         Check to see if Tor is used properly

  Injection:
    These options can be used to specify which parameters to test for,
    provide custom injection payloads and optional tampering scripts

    -p TESTPARAMETER    Testable parameter(s)
    --dbms=DBMS         Force back-end DBMS to provided value

  Detection:
    These options can be used to customize the detection phase

    --level=LEVEL       Level of tests to perform (1-5, default 1)
    --risk=RISK         Risk of tests to perform (1-3, default 1)

  Techniques:
    These options can be used to tweak testing of specific SQL injection
    techniques

    --technique=TECH    SQL injection techniques to use (default "BEUSTQ")

  Enumeration:
    These options can be used to enumerate the back-end database
    management system information, structure and data contained in the
    tables. Moreover you can run your own SQL statements

    -a, --all           Retrieve everything
    -b, --banner        Retrieve DBMS banner
    --current-user      Retrieve DBMS current user
    --current-db        Retrieve DBMS current database
    --passwords         Enumerate DBMS users password hashes
    --tables            Enumerate DBMS database tables
    --columns           Enumerate DBMS database table columns
    --schema            Enumerate DBMS schema
    --dump              Dump DBMS database table entries
    --dump-all          Dump all DBMS databases tables entries
    -D DB               DBMS database to enumerate
    -T TBL              DBMS database table(s) to enumerate
    -C COL              DBMS database table column(s) to enumerate

  Operating system access:
    These options can be used to access the back-end database management
    system underlying operating system

    --os-shell          Prompt for an interactive operating system shell
    --os-pwn            Prompt for an OOB shell, Meterpreter or VNC

  General:
    These options can be used to set some general working parameters

    --batch             Never ask for user input, use the default behavior
    --flush-session     Flush session files for current target

  Miscellaneous:
    --sqlmap-shell      Prompt for an interactive sqlmap shell
    --wizard            Simple wizard interface for beginner users

[!] to see full list of options run with '-hh'

Press Enter to continue...

成功。doc目录中的faq文件可以看看。

2.使用

  • 直连数据库
    我的Win10上安装了docker，然后里面启动了mysql
$ docker run --name mysql -p 3307:3306 -e MYSQL_ROOT_PASSWORD=123456 -d mysql:8.0
df69cba81ae328c1116a19d102665520fa401688a246cb41784e579e618dfe99

toddc@DESKTOP-U0EUJB2 MINGW64 /c/Program Files/Docker Toolbox
$ docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                               NAMES
df69cba81ae3        mysql:8.0           "docker-entrypoint.s…"   4 seconds ago       Up 3 seconds        33060/tcp, 0.0.0.0:3307->3306/tcp   mysql

尝试直接连接

先用MySQL GUI Tools 5.0尝试连接一下，结果报错“Client does not support authentication protocol requested by server; consider upgrading MySQL client”。
找了攻略，立刻修改

mysql> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> alter user 'root'@'localhost' identified with mysql_native_password by '123456';
Query OK, 0 rows affected (0.03 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)

再次用MySQL GUI Tools 5.0连接，错误依旧，奇怪。
继续查攻略，总算找到原因了。
先执行一下命令

mysql> select host,user,plugin,authentication_string from mysql.user;
+-----------+------------------+-----------------------+------------------------------------------------------------------------+
| host      | user             | plugin                | authentication_string                                                  |
+-----------+------------------+-----------------------+------------------------------------------------------------------------+
| %         | root             | caching_sha2_password | $A$005$Wc%y}`k:z!S05e3/8O5Zx61Pkb.XIi1.VOEsJ3AG7JrFlJHDe6FgkKS/0 |
| localhost | mysql.infoschema | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | mysql.session    | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | mysql.sys        | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED |
| localhost | root             | mysql_native_password | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9                              |
+-----------+------------------+-----------------------+------------------------------------------------------------------------+
5 rows in set (0.00 sec)

可以看到表中有2个root用户。其中‘%’表示的是不限制ip，而’localhost’则是本机。
如果plugin一列中是’caching_sha2_password’，而必须按照上面的命令修改密码。
显然我的PC通过docker连接mysql，它访问的是Oracle VirtualBox中的虚拟机，并不是localhost，所以需要修改‘%’对应的密码。
操作如下

mysql>  alter user 'root'@'%' identified with mysql_native_password by '123456';
Query OK, 0 rows affected (0.02 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)

mysql>

然后再测试连接，终于成功了。
在这里插入图片描述现在可以用sqlmap来连接了。

C:\Python27\sqlmap>sqlmap.py -d "mysql://root:[email protected]:3307/mysql" --os-shell
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.3.2.22#dev}
|_ -| . [(]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 15:05:48 /2019-02-16/

[15:05:48] [CRITICAL] sqlmap requires 'python-pymysql' third-party library in order to directly connect to the DBMS 'MySQL'. You can download it from 'https://github.com/PyMySQL/PyMySQL'. Alternative is to use a package 'python-sqlalchemy' with support for dialect 'mysql' installed

[*] ending @ 15:05:48 /2019-02-16/

意思是sqlmap连接mysql需要Python连接Mysql用的第三方库python-pymysql。
去提示中的网站下载。
解压后安装

C:\Python27>cd PyMySQL-master

C:\Python27\PyMySQL-master>python setup.py install
running install
running bdist_egg
running egg_info
creating PyMySQL.egg-info
writing requirements to PyMySQL.egg-info\requires.txt
writing PyMySQL.egg-info\PKG-INFO
writing top-level names to PyMySQL.egg-info\top_level.txt
writing dependency_links to PyMySQL.egg-info\dependency_links.txt
writing manifest file 'PyMySQL.egg-info\SOURCES.txt'
reading manifest file 'PyMySQL.egg-info\SOURCES.txt'
reading manifest template 'MANIFEST.in'
writing manifest file 'PyMySQL.egg-info\SOURCES.txt'
installing library code to build\bdist.win-amd64\egg
running install_lib
running build_py
creating build
creating build\lib
creating build\lib\pymysql
copying pymysql\charset.py -> build\lib\pymysql
copying pymysql\connections.py -> build\lib\pymysql
copying pymysql\converters.py -> build\lib\pymysql
copying pymysql\cursors.py -> build\lib\pymysql
copying pymysql\err.py -> build\lib\pymysql
copying pymysql\optionfile.py -> build\lib\pymysql
copying pymysql\protocol.py -> build\lib\pymysql
copying pymysql\times.py -> build\lib\pymysql
copying pymysql\util.py -> build\lib\pymysql
copying pymysql\_auth.py -> build\lib\pymysql
copying pymysql\_compat.py -> build\lib\pymysql
copying pymysql\_socketio.py -> build\lib\pymysql
copying pymysql\__init__.py -> build\lib\pymysql
creating build\lib\pymysql\constants
copying pymysql\constants\CLIENT.py -> build\lib\pymysql\constants
copying pymysql\constants\COMMAND.py -> build\lib\pymysql\constants
copying pymysql\constants\CR.py -> build\lib\pymysql\constants
copying pymysql\constants\ER.py -> build\lib\pymysql\constants
copying pymysql\constants\FIELD_TYPE.py -> build\lib\pymysql\constants
copying pymysql\constants\FLAG.py -> build\lib\pymysql\constants
copying pymysql\constants\SERVER_STATUS.py -> build\lib\pymysql\constants
copying pymysql\constants\__init__.py -> build\lib\pymysql\constants
creating build\bdist.win-amd64
creating build\bdist.win-amd64\egg
creating build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\charset.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\connections.py -> build\bdist.win-amd64\egg\pymysql
creating build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\CLIENT.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\COMMAND.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\CR.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\ER.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\FIELD_TYPE.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\FLAG.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\SERVER_STATUS.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\constants\__init__.py -> build\bdist.win-amd64\egg\pymysql\constants
copying build\lib\pymysql\converters.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\cursors.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\err.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\optionfile.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\protocol.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\times.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\util.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\_auth.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\_compat.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\_socketio.py -> build\bdist.win-amd64\egg\pymysql
copying build\lib\pymysql\__init__.py -> build\bdist.win-amd64\egg\pymysql
byte-compiling build\bdist.win-amd64\egg\pymysql\charset.py to charset.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\connections.py to connections.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\CLIENT.py to CLIENT.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\COMMAND.py to COMMAND.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\CR.py to CR.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\ER.py to ER.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\FIELD_TYPE.py to FIELD_TYPE.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\FLAG.py to FLAG.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\SERVER_STATUS.py to SERVER_STATUS.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\constants\__init__.py to __init__.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\converters.py to converters.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\cursors.py to cursors.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\err.py to err.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\optionfile.py to optionfile.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\protocol.py to protocol.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\times.py to times.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\util.py to util.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\_auth.py to _auth.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\_compat.py to _compat.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\_socketio.py to _socketio.pyc
byte-compiling build\bdist.win-amd64\egg\pymysql\__init__.py to __init__.pyc
creating build\bdist.win-amd64\egg\EGG-INFO
copying PyMySQL.egg-info\PKG-INFO -> build\bdist.win-amd64\egg\EGG-INFO
copying PyMySQL.egg-info\SOURCES.txt -> build\bdist.win-amd64\egg\EGG-INFO
copying PyMySQL.egg-info\dependency_links.txt -> build\bdist.win-amd64\egg\EGG-INFO
copying PyMySQL.egg-info\requires.txt -> build\bdist.win-amd64\egg\EGG-INFO
copying PyMySQL.egg-info\top_level.txt -> build\bdist.win-amd64\egg\EGG-INFO
zip_safe flag not set; analyzing archive contents...
creating dist
creating 'dist\PyMySQL-0.9.3-py2.7.egg' and adding 'build\bdist.win-amd64\egg' to it
removing 'build\bdist.win-amd64\egg' (and everything under it)
Processing PyMySQL-0.9.3-py2.7.egg
Copying PyMySQL-0.9.3-py2.7.egg to c:\python27\lib\site-packages
Adding PyMySQL 0.9.3 to easy-install.pth file

Installed c:\python27\lib\site-packages\pymysql-0.9.3-py2.7.egg
Processing dependencies for PyMySQL==0.9.3
Finished processing dependencies for PyMySQL==0.9.3

再次sqlmap连接，ok

C:\Python27\sqlmap>sqlmap.py -d "mysql://root:[email protected]:3307/mysql" --os-shell
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.3.2.22#dev}
|_ -| . [.]     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 16:18:38 /2019-02-16/

[16:18:39] [INFO] connection to mysql server 192.168.99.100:3307 established
[16:18:39] [INFO] testing MySQL
[16:18:39] [INFO] confirming MySQL
[16:18:39] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 8.0.0
[16:18:39] [INFO] fingerprinting the back-end DBMS operating system
[16:18:39] [INFO] the back-end DBMS operating system is Linux
[16:18:39] [INFO] testing if current user is DBA
[16:18:39] [INFO] fetching current user
what is the back-end database management system architecture?
[1] 32-bit (default)
[2] 64-bit
> 2
[16:18:43] [INFO] checking if UDF 'sys_eval' already exist
[16:18:43] [INFO] checking if UDF 'sys_exec' already exist
[16:18:43] [INFO] detecting back-end DBMS version from its banner
[16:18:43] [INFO] retrieving MySQL plugin directory absolute path
[16:18:46] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process user has no write privileges in the destination path)
[16:18:46] [ERROR] there has been a problem uploading the shared library, it looks like the binary file has not been written on the database underlying file system
do you want to proceed anyway? Beware that the operating system takeover will fail [y/N] y
[16:23:22] [INFO] creating UDF 'sys_eval' from the binary UDF file
[16:23:22] [INFO] creating UDF 'sys_exec' from the binary UDF file
[16:23:22] [INFO] going to use injected sys_eval and sys_exec user-defined functions for operating system command execution
[16:23:22] [INFO] calling Linux OS shell. To quit type 'x' or 'q' and press ENTER
os-shell>

在MySQL GUI Tools 5.0的管理工具中可以查到sqlmap的连接信息。
在这里插入图片描述
192.168.99.1是PC虚拟网卡地址，安装docker时候创建的。
而docker中虚机的地址前面命令中已经多次出现了，192.168.99.100。

  • 测试当前用户是否是dba
C:\Python27\sqlmap>sqlmap.py -d "mysql://root:[email protected]:3307/mysql" --is-dba
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.3.2.22#dev}
|_ -| . [(]     | .'| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 22:26:26 /2019-02-16/

[22:26:27] [INFO] connection to mysql server 192.168.99.100:3307 established
[22:26:27] [INFO] testing MySQL
[22:26:27] [INFO] resumed: [[u'1']]...
[22:26:27] [INFO] confirming MySQL
[22:26:27] [INFO] resumed: [[u'1']]...
[22:26:27] [INFO] resumed: [[u'1']]...
[22:26:27] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 8.0.0
[22:26:27] [INFO] testing if current user is DBA
[22:26:27] [INFO] fetching current user
[22:26:27] [INFO] resumed: [[u'root@%']]...
[22:26:27] [INFO] resumed: [[u'1']]...
current user is DBA: True
[22:26:27] [INFO] connection to mysql server 192.168.99.100:3307 closed

猜你喜欢

转载自blog.csdn.net/weixin_42555985/article/details/87429763
今日推荐
周排行
LRU cache算法
windows10, 自带的OpenSSH, key权限问题, 文件权限问题
测试用例书写方法
HIVE-默认分隔符的（linux系统的特殊字符）查看，输入和修改
最贵的AMD 7nm显卡来了！这设计 够狂野
java多线程简单demo
[ 转载 ]在Android系统上使用busybox——最简单的方法
QT connect学习
BFSIFT算法分析
Xcode10：library not found for -lstdc++.6.0.9 临时解决
每日归档
更多
2024-08-06(0)
2024-08-05(0)
2024-08-04(0)
2024-08-03(0)
2024-08-02(0)
2024-08-01(0)
2024-07-31(0)
2024-07-30(0)
2024-07-29(0)
2024-07-28(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022