Shulou(Shulou.com)06/01 Report--

This article mainly explains "how to use sqlmap to extract data", the content of the article is simple and clear, easy to learn and understand, the following please follow the editor's ideas slowly in depth, together to study and learn "how to use sqlmap to extract data" bar!

Step # 1 Reconnaissance to get the necessary information

The first step, of course, is to use sqlmap to scout the database through the Web application. In order to extract data successfully, we need

1. Types of database management systems (DBMS)

two。 Database name

3. Form name

4. The name of the column whose data we want to extract

We got all the information from a website called www.webscantest.com.

Then, we extract the tables and columns from the database, as shown below.

In the order table, we can see that every order received by the company has credit card information stored. That's what we want!

Step # 2 extract data

Now that we have all the key information we need, it's time to extract the credit card information. Let's go back to the sqlmap help screen. Just enter

Kali > sqlmap-help

As you can see above, we need to use the-- dump option in sqlmap, as well as column and table names. Such as

-- dump

-C billing_CC_number

-T orders

-D webscantest

Let's put all this information together and see if we can extract credit card data from the database.

Kali > sqlmap-u "http://www.webscantest.com/datastore/search_get_by_id.php?id=4"-- dump-C billing_CC_number-T order-D webscantest

As shown above, sqlmap extracted the data, then dumped it into my Kali system in .csv format and saved it to

/ root/.sqlmap/output/www.webscantest.com/dump/webscantest/orders.csv

Now we have all the credit card data in .csv file format, which can be opened in Excel, a text editor, or any spreadsheet program.

Of course, if we need more data, such as expiration date or first and last name, we can extract that data by simply replacing the credit card column name in the sqlmap command with the appropriate column name in the table (for example, billing_firstname).

Thank you for your reading, the above is the content of "how to use sqlmap to extract data", after the study of this article, I believe you have a deeper understanding of how to use sqlmap to extract data, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.