Shulou(Shulou.com)06/01 Report--

Injection tool sqlmap how to specify the location of injection and optimize performance, I believe that many inexperienced people do not know what to do, so this paper summarizes the causes of the problem and solutions, through this article I hope you can solve this problem.

I. specified location injection

1.-p, specify the parameters for specific detection

Sqlmap-u http://192.168.1.121/sqli/Less-1/?id=1-p id-- dbs detects id

Sqlmap-u http://192.168.1.121/sqli/Less-1/?id=1&&name=2-p "id,name"-dbs detects both id and name

2.-skip, ignoring the parameters of the probe

Sqlmap-u http://192.168.1.121/sqli/Less-1/?id=1&&name=2-- level 5-- skip host-- dbs level 5 detects all existing injection points. Host is ignored here.

3.-param-exclude, ignore the parameters containing specific content

-param-exclude= "id | name"

4.-skip-static ignores non-dynamic parameters

5. Specify the injection location with "*"

Sqlmap-u http://192.168.1.121/sqli/Less-1/?id=1*&&name=2*&&tab=3-- dbs

Sqlmap-u http://192.168.1.121/sqli/Less-1/?id=1&&name=2&&tab=3-- cookie= "un=adm*;pw=adm"-dbs

Sqlmap-u http://192.168.1.121/sqli/Less-1/?id=1&&name=2&&tab=3-- cookie= "*"-dbs

Second, optimize the performance

1. Set the connection to a persistent connection

Set Connection:Keep-Alive in http message

Add the parameter-keep-alive to sqlmap

2. Do not accept body in http, which is often used in blind injection.

-null-connection

3. Set up multithreading

-thread defaults to 1 thread, with a maximum of 10 threads

4. Forecast output

-predict-output, cannot be used with thread

5. Turn on all optimizations

-o

After reading the above, have you mastered how the injection tool sqlmap specifies the location of injection and optimizes performance? If you want to learn more skills or want to know more about it, you are welcome to follow the industry information channel, thank you for reading!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.