sqlmap 설치 및 사용법(sqlmap install & usage/sql injection tool)

sql injection 테스트에서 많이 활용되고 있는 sqlmap 입니다.

  1. sqlmap 다운로드 sqlmap 공식 홈페이지(http://sqlmap.org/) 에서 zip or tar.gz 형태로 다운로드합니다. 페이지 우측에 zip, tar.gz 파일 다운로드 가능

  1. 압축 해제 후 실행

tar -xvf sqlmapproject-sqlmap-0.9-4005-g779db7c.tar.gz

or

unzip sql~~~

  1. 사용법 및 옵션

python sqlmap.py -u ‘http://127.0.0.1/test?test=123&page=3 –data=“codeblack=123”

sqlm -u “http://192.168.0.1/cgi-bin/timepro.cgi?tmenu=wizard” –dbs –no-cast –level 4

옵션 주요 옵션 -u : target url –cookie : 쿠키정보 삽입 –data : POST 데이터 / 설정 시 자동으로 POST 요청 전송됨 –param or -p : 파라미터 지정 / 지정하지 않을 시 전체 파라미터 체킹 –risk : 리스크 등급 –level : 체킹 레벨 설정 –proxy : 프록시 정보 설정(burp or fiddler 등에 연동하여 사용할 때 필요) –tor : 토르 사용(익명 네트워크)

등등 여러가지가 존재합니다.


아래 옵션정보 참고

sqlm –help (python sqlmap.py –help) Usage: python sqlmap.py [options]

Options: -h, –help Show basic help message and exit -hh Show advanced help message and exit –version Show program’s version number and exit -v VERBOSE Verbosity level: 0-6 (default 1)

Target: At least one of these options has to be provided to define the target(s)

-d DIRECT           Connection string for direct database connection
-u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
-l LOGFILE          Parse target(s) from Burp or WebScarab proxy log file
-x SITEMAPURL       Parse target(s) from remote sitemap(.xml) file
-m BULKFILE         Scan multiple targets given in a textual file
-r REQUESTFILE      Load HTTP request from a file
-g GOOGLEDORK       Process Google dork results as target URLs
-c CONFIGFILE       Load options from a configuration INI file

Request: These options can be used to specify how to connect to the target URL

--method=METHOD     Force usage of given HTTP method (e.g. PUT)
--data=DATA         Data string to be sent through POST
--param-del=PARA..  Character used for splitting parameter values
--cookie=COOKIE     HTTP Cookie header value
--cookie-del=COO..  Character used for splitting cookie values
--load-cookies=L..  File containing cookies in Netscape/wget format
--drop-set-cookie   Ignore Set-Cookie header from response
--user-agent=AGENT  HTTP User-Agent header value
--random-agent      Use randomly selected HTTP User-Agent header value
--host=HOST         HTTP Host header value
--referer=REFERER   HTTP Referer header value
--headers=HEADERS   Extra headers (e.g. "Accept-Language: fr\nETag: 123")
--auth-type=AUTH..  HTTP authentication type (Basic, Digest, NTLM or PKI)
--auth-cred=AUTH..  HTTP authentication credentials (name:password)
--auth-private=A..  HTTP authentication PEM private key file
--ignore-401        Ignore HTTP Error 401 (Unauthorized)
--proxy=PROXY       Use a proxy to connect to the target URL
--proxy-cred=PRO..  Proxy authentication credentials (name:password)
--proxy-file=PRO..  Load proxy list from a file
--ignore-proxy      Ignore system default proxy settings
--tor               Use Tor anonymity network
--tor-port=TORPORT  Set Tor proxy port other than default
--tor-type=TORTYPE  Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)
--check-tor         Check to see if Tor is used properly
--delay=DELAY       Delay in seconds between each HTTP request
--timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)
--retries=RETRIES   Retries when the connection timeouts (default 3)
--randomize=RPARAM  Randomly change value for given parameter(s)
--safe-url=SAFURL   URL address to visit frequently during testing
--safe-freq=SAFREQ  Test requests between two visits to a given safe URL
--skip-urlencode    Skip URL encoding of payload data
--csrf-token=CSR..  Parameter used to hold anti-CSRF token
--csrf-url=CSRFURL  URL address to visit to extract anti-CSRF token
--force-ssl         Force usage of SSL/HTTPS
--hpp               Use HTTP parameter pollution method
--eval=EVALCODE     Evaluate provided Python code before the request (e.g.
                    "import hashlib;id2=hashlib.md5(id).hexdigest()")

Optimization: These options can be used to optimize the performance of sqlmap

-o                  Turn on all optimization switches
--predict-output    Predict common queries output
--keep-alive        Use persistent HTTP(s) connections
--null-connection   Retrieve page length without actual HTTP response body
--threads=THREADS   Max number of concurrent HTTP(s) requests (default 1)

Injection: These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts

-p TESTPARAMETER    Testable parameter(s)
--skip=SKIP         Skip testing for given parameter(s)
--dbms=DBMS         Force back-end DBMS to this value
--dbms-cred=DBMS..  DBMS authentication credentials (user:password)
--os=OS             Force back-end DBMS operating system to this value
--invalid-bignum    Use big numbers for invalidating values
--invalid-logical   Use logical operations for invalidating values
--invalid-string    Use random strings for invalidating values
--no-cast           Turn off payload casting mechanism
--no-escape         Turn off string escaping mechanism
--prefix=PREFIX     Injection payload prefix string
--suffix=SUFFIX     Injection payload suffix string
--tamper=TAMPER     Use given script(s) for tampering injection data

Detection: These options can be used to customize the detection phase

--level=LEVEL       Level of tests to perform (1-5, default 1)
--risk=RISK         Risk of tests to perform (0-3, default 1)
--string=STRING     String to match when query is evaluated to True
--not-string=NOT..  String to match when query is evaluated to False
--regexp=REGEXP     Regexp to match when query is evaluated to True
--code=CODE         HTTP code to match when query is evaluated to True
--text-only         Compare pages based only on the textual content
--titles            Compare pages based only on their titles

Techniques: These options can be used to tweak testing of specific SQL injection techniques

--technique=TECH    SQL injection techniques to use (default "BEUSTQ")
--time-sec=TIMESEC  Seconds to delay the DBMS response (default 5)
--union-cols=UCOLS  Range of columns to test for UNION query SQL injection
--union-char=UCHAR  Character to use for bruteforcing number of columns
--union-from=UFROM  Table to use in FROM part of UNION query SQL injection
--dns-domain=DNS..  Domain name used for DNS exfiltration attack
--second-order=S..  Resulting page URL searched for second-order response

Fingerprint: -f, –fingerprint Perform an extensive DBMS version fingerprint

Enumeration: These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements

-a, --all           Retrieve everything
-b, --banner        Retrieve DBMS banner
--current-user      Retrieve DBMS current user
--current-db        Retrieve DBMS current database
--hostname          Retrieve DBMS server hostname
--is-dba            Detect if the DBMS current user is DBA
--users             Enumerate DBMS users
--passwords         Enumerate DBMS users password hashes
--privileges        Enumerate DBMS users privileges
--roles             Enumerate DBMS users roles
--dbs               Enumerate DBMS databases
--tables            Enumerate DBMS database tables
--columns           Enumerate DBMS database table columns
--schema            Enumerate DBMS schema
--count             Retrieve number of entries for table(s)
--dump              Dump DBMS database table entries
--dump-all          Dump all DBMS databases tables entries
--search            Search column(s), table(s) and/or database name(s)
--comments          Retrieve DBMS comments
-D DB               DBMS database to enumerate
-T TBL              DBMS database table(s) to enumerate
-C COL              DBMS database table column(s) to enumerate
-X EXCLUDECOL       DBMS database table column(s) to not enumerate
-U USER             DBMS user to enumerate
--exclude-sysdbs    Exclude DBMS system databases when enumerating tables
--where=DUMPWHERE   Use WHERE condition while table dumping
--start=LIMITSTART  First query output entry to retrieve
--stop=LIMITSTOP    Last query output entry to retrieve
--first=FIRSTCHAR   First query output word character to retrieve
--last=LASTCHAR     Last query output word character to retrieve
--sql-query=QUERY   SQL statement to be executed
--sql-shell         Prompt for an interactive SQL shell
--sql-file=SQLFILE  Execute SQL statements from given file(s)

Brute force: These options can be used to run brute force checks

--common-tables     Check existence of common tables
--common-columns    Check existence of common columns

User-defined function injection: These options can be used to create custom user-defined functions

--udf-inject        Inject custom user-defined functions
--shared-lib=SHLIB  Local path of the shared library

File system access: These options can be used to access the back-end database management system underlying file system

--file-read=RFILE   Read a file from the back-end DBMS file system
--file-write=WFILE  Write a local file on the back-end DBMS file system
--file-dest=DFILE   Back-end DBMS absolute filepath to write to

Operating system access: These options can be used to access the back-end database management system underlying operating system

--os-cmd=OSCMD      Execute an operating system command
--os-shell          Prompt for an interactive operating system shell
--os-pwn            Prompt for an OOB shell, Meterpreter or VNC
--os-smbrelay       One click prompt for an OOB shell, Meterpreter or VNC
--os-bof            Stored procedure buffer overflow exploitation
--priv-esc          Database process user privilege escalation
--msf-path=MSFPATH  Local path where Metasploit Framework is installed
--tmp-path=TMPPATH  Remote absolute path of temporary files directory

Windows registry access: These options can be used to access the back-end database management system Windows registry

--reg-read          Read a Windows registry key value
--reg-add           Write a Windows registry key value data
--reg-del           Delete a Windows registry key value
--reg-key=REGKEY    Windows registry key
--reg-value=REGVAL  Windows registry key value
--reg-data=REGDATA  Windows registry key value data
--reg-type=REGTYPE  Windows registry key value type

General: These options can be used to set some general working parameters

-s SESSIONFILE      Load session from a stored (.sqlite) file
-t TRAFFICFILE      Log all HTTP traffic into a textual file
--batch             Never ask for user input, use the default behaviour
--charset=CHARSET   Force character encoding used for data retrieval
--crawl=CRAWLDEPTH  Crawl the website starting from the target URL
--csv-del=CSVDEL    Delimiting character used in CSV output (default ",")
--dump-format=DU..  Format of dumped data (CSV (default), HTML or SQLITE)
--eta               Display for each output the estimated time of arrival
--flush-session     Flush session files for current target
--forms             Parse and test forms on target URL
--fresh-queries     Ignore query results stored in session file
--hex               Use DBMS hex function(s) for data retrieval
--output-dir=OUT..  Custom output directory path
--parse-errors      Parse and display DBMS error messages from responses
--pivot-column=P..  Pivot column name
--save              Save options to a configuration INI file
--scope=SCOPE       Regexp to filter targets from provided proxy log
--test-filter=TE..  Select tests by payloads and/or titles (e.g. ROW)
--update            Update sqlmap

Miscellaneous: -z MNEMONICS Use short mnemonics (e.g. “flu,bat,ban,tec=EU”) –alert=ALERT Run host OS command(s) when SQL injection is found –answers=ANSWERS Set question answers (e.g. “quit=N,follow=N”) –beep Make a beep sound when SQL injection is found –cleanup Clean up the DBMS from sqlmap specific UDF and tables –dependencies Check for missing (non-core) sqlmap dependencies –disable-coloring Disable console output coloring –gpage=GOOGLEPAGE Use Google dork results from specified page number –identify-waf Make a through testing for a WAF/IPS/IDS protection –mobile Imitate smartphone through HTTP User-Agent header –page-rank Display page rank (PR) for Google dork results –purge-output Safely remove all content from output directory –smart Conduct through tests only if positive heuristic(s) –sqlmap-shell Prompt for an interactive sqlmap shell –wizard Simple wizard interface for beginner users

Licensed under CC BY-NC-SA 4.0
Last updated on Jul 10, 2021 01:05 +0900