檢測 SQL Injection 的工具 - SQLMap

最近剛好有網站被 HITCON 通報, 發現提報的使用工具就是 SQLMap, 因此修改後也去了解與使用 SQLMap 自行檢測一下

只要下載解壓縮就可執行

wget https://github.com/sqlmapproject/sqlmap/tarball/master
mv master master.tar.gz
tar -zxvf master.tar.gz
cd sqlmapproject-sqlmap-*

要檢測的網址 - http://192.168.1.101/myapp/index.php?id=1

SQLMap 執行語法

python sqlmap.py -u "http://192.168.1.101/myapp/index.php?id=1" --batch --banner --level=5 --risk=3

or

python sqlmap.py --url="http://192.168.1.101/myapp/index.php?id=1" --user-agent=SQLMAP --delay=1 --timeout=15 --retries=2 --keep-alive --threads=5 --eta --batch --dbms=MySQL --os=Linux --level=5 --risk=3 --banner --is-dba --dbs --tables --technique=BEUST -s /tmp/scan_report_myapp_1.txt --flush-session -t /tmp/scan_trace_myapp_1.txt --fresh-queries > /tmp/scan_out_myapp_1.txt &

如果有 SQL Injection 會出現類似以下的訊息

        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.2.4.3#dev}
|_ -| . [']     | .'| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V          |_|   http://sqlmap.org

:
:
[22:01:46] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[22:01:47] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks
:
[22:01:47] [WARNING] reflective value(s) found and filtering out
:
[22:07:23] [INFO] the back-end DBMS is MySQL
[22:07:23] [INFO] fetching banner
[22:07:24] [INFO] retrieved: 5.6.39-83.1-56
web server operating system: Linux CentOS 5.10
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL >= 5.0
banner:    '5.6.39-83.1-56'

可以獲取後端 DB 的資訊

如果沒有問題, 在每段檢測後都會出現以下訊息

        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.2.4.3#dev}
|_ -| . [.]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V          |_|   http://sqlmap.org
:
:
[22:09:35] [WARNING] heuristic (basic) test shows that GET parameter 'id' might not be injectable
:
[22:24:57] [WARNING] GET parameter 'id' does not seem to be injectable
:
:

https://github.com/sqlmapproject/sqlmap/wiki/Usage