sqlmap中文手册 (18)

使用“–batch”以非交互模式运行时所有问题都以按默认值作为回答。有时不想以默认值为答案又想使用非交互模式,此时可以使用参数“–answers”对特定问题进行回答,若回答多个问题,以逗号分隔。如:

  python sqlmap.py -u "http://192.168.22.128/sqlmap/mysql/get_int.php?id=1"--technique=E --answers="extending=N" --batch

部分输出如下:

  [xx:xx:56] [INFO] testing for SQL injection on GET parameter 'id' heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y

  [xx:xx:56] [INFO] do you want to include all tests for 'MySQL' extending provided level (1) and risk (1)? [Y/n] N

4.在成功检测到注入点时发出“嘟”声

参数:–beep

使用此参数可以在成功检测到注入点时发出“嘟”声。使用“-m”从日志文件中检测大量网站时该参数会格外有用。

5.清除Sqlmap创建的临时表和自定义函数

参数:–cleanup

强烈推荐在测试结束后使用此参数清除Sqlmap创建的临时表和自定义函数,Sqlmap会尽可能地清除数据库管理系统和文件系统上的入侵痕迹。

6.检查依赖

参数:–dependencies

Sqlmap的有些功能依赖第三方库,在用到时发现没有这些库会报错退出。使用此参数可以检查依赖的第三方库是否安装,如:

  python sqlmap.py --dependencies

部分输出如下:

  [*] starting at 19:16:05

 

  [19:16:05] [WARNING] sqlmap requires 'python-kinterbasdb' third-party library in order to directly connect to the DBMS 'Firebird'. Download from

  [19:16:05] [WARNING] sqlmap requires 'python-pymssql' third-party library in order to directly connect to the DBMS 'Sybase'. Download from https://github.com/pymssql/pymssql

  [19:16:05] [WARNING] sqlmap requires 'python cx_Oracle' third-party library in order to directly connect to the DBMS 'Oracle'. Download from

  [19:16:05] [WARNING] sqlmap requires 'python-psycopg2' third-party library in order to directly connect to the DBMS 'PostgreSQL'. Download from

  [19:16:05] [WARNING] sqlmap requires 'python ibm-db' third-party library in order to directly connect to the DBMS 'IBM DB2'. Download from https://github.com/ibmdb/python-ibmdb

  [19:16:05] [WARNING] sqlmap requires 'python jaydebeapi & python-jpype' third-party library in order to directly connect to the DBMS 'HSQLDB'. Download from https://pypi.python.org/pypi/JayDeBeApi/ &

  [19:16:05] [WARNING] sqlmap requires 'python ibm-db' third-party library in order to directly connect to the DBMS 'Informix'. Download from https://github.com/ibmdb/python-ibmdb

  [19:16:05] [WARNING] sqlmap requires 'python-pyodbc' third-party library in order to directly connect to the DBMS 'Microsoft Access'. Download from https://github.com/mkleehammer/pyodbc

  [19:16:05] [WARNING] sqlmap requires 'python-pymssql' third-party library in order to directly connect to the DBMS 'Microsoft SQL Server'. Download from https://github.com/pymssql/pymssql

  [19:16:05] [WARNING] sqlmap requires 'python-impacket' third-party library for out-of-band takeover feature. Download from

  [19:16:05] [WARNING] sqlmap requires 'python-ntlm' third-party library if you plan to attack a web application behind NTLM authentication. Download from

  [19:16:05] [WARNING] sqlmap requires 'websocket-client' third-party library if you plan to attack a web application using WebSocket. Download from https://pypi.python.org/pypi/websocket-client/

 

  [*] shutting down at 19:16:05

可以看到我缺少的主要是用于连接数据库的第三方库。

7.关闭彩色输出

参数:–disable-coloring

8.指定使用Google dork结果的某页

参数:–gpage

使用参数“-g”时默认默认选择Google dork结果的前100条做注入测试。结合使用此参数,可以指定使用Google dork结果的某页。

9.使用HTTP参数污染

参数:–hpp

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/wpyxgg.html