sqlmap学习笔记（二）

     上篇讲到了payload.xml，这篇就详细说下

payload.xml帮助 写道

<!--
Tag: <boundary>
How to prepend and append to the test ' <payload><comment> ' string.

Sub-tag: <level>
From which level check for this test.

Valid values:
1: Always (<100 requests)
2: Try a bit harder (100-200 requests)
3: Good number of requests (200-500 requests)
4: Extensive test (500-1000 requests)
5: You have plenty of time (>1000 requests)

Sub-tag: <clause>
In which clause the payload can work.

NOTE: for instance, there are some payload that do not have to be
tested as soon as it has been identified whether or not the
injection is within a WHERE clause condition.

Valid values:
0: Always
1: WHERE / HAVING
2: GROUP BY
3: ORDER BY
4: LIMIT
5: OFFSET
6: TOP
7: Table name
8: Column name

A comma separated list of these values is also possible.

Sub-tag: <where>
Where to add our '<prefix> <payload><comment> <suffix>' string.

Valid values:
1: When the value of <test>'s <where> is 1.
2: When the value of <test>'s <where> is 2.
3: When the value of <test>'s <where> is 3.

A comma separated list of these values is also possible.

Sub-tag: <ptype>
What is the parameter value type.

Valid values:
1: Unescaped numeric
2: Single quoted string
3: LIKE single quoted string
4: Double quoted string
5: LIKE double quoted string

Sub-tag: <prefix>
A string to prepend to the payload.

Sub-tag: <suffix>
A string to append to the payload.


Tag: <test>
SQL injection test definition.

Sub-tag: <title>
Title of the test.

Sub-tag: <stype>
SQL injection family type.

Valid values:
0: Heuristic check to parse response errors
1: Boolean-based blind SQL injection
2: Error-based SQL injection
3: UNION query SQL injection
4: Stacked queries SQL injection
5: AND/OR time-based blind SQL injection

Sub-tag: <level>
From which level check for this test.

Valid values:
1: Always (<100 requests)
2: Try a bit harder (100-200 requests)
3: Good number of requests (200-500 requests)
4: Extensive test (500-1000 requests)
5: You have plenty of time (>1000 requests)

Sub-tag: <risk>
Likelihood of a payload to damage the data integrity.

Valid values:
0: No risk
1: Low risk
2: Medium risk
3: High risk

Sub-tag: <clause>
In which clause the payload can work.

NOTE: for instance, there are some payload that do not have to be
tested as soon as it has been identified whether or not the
injection is within a WHERE clause condition.

Valid values:
0: Always
1: WHERE / HAVING
2: GROUP BY
3: ORDER BY
4: LIMIT
5: OFFSET
6: TOP
7: Table name
8: Column name

A comma separated list of these values is also possible.

Sub-tag: <where>
Where to add our '<prefix> <payload><comment> <suffix>' string.

Valid values:
1: Append the string to the parameter original value
2: Replace the parameter original value with a negative random
integer value and append our string
3: Replace the parameter original value with our string

Sub-tag: <vector>
The payload that will be used to exploit the injection point.

Sub-tag: <request>
What to inject for this test.

Sub-tag: <payload>
The payload to test for.

Sub-tag: <comment>
Comment to append to the payload, before the suffix.

Sub-tag: <char>
Character to use to bruteforce number of columns in UNION
query SQL injection tests.

Sub-tag: <columns>
Range of columns to test for in UNION query SQL injection
tests.

Sub-tag: <response>
How to identify if the injected payload succeeded.

Sub-tag: <comparison>
Perform a request with this string as the payload and compare
the response with the <payload> response. Apply the comparison
algorithm.

NOTE: useful to test for boolean-based blind SQL injections.

Sub-tag: <grep>
Regular expression to grep for in the response body.

NOTE: useful to test for error-based SQL injection.

Sub-tag: <time>
Time in seconds to wait before the response is returned.

NOTE: useful to test for time-based blind and stacked queries
SQL injections.

Sub-tag: <union>
Calls unionTest() function.

NOTE: useful to test for UNION query (inband) SQL injection.

Sub-tag: <oob>
# TODO

Sub-tag: <details>
Which details can be infered if the payload succeed.

Sub-tags: <dbms>
What is the database management system (e.g. MySQL).

Sub-tags: <dbms_version>
What is the database management system version (e.g. 5.0.51).

Sub-tags: <os>
What is the database management system underlying operating
system.

Formats:
<boundary>
<level></level>
<clause></clause>
<where></where>
<ptype></ptype>
<prefix></prefix>
<suffix></suffix>
</boundary>

<test>
<title></title>
<stype></stype>
<level></level>
<risk></risk>
<clause></clause>
<where></where>
<vector></vector>
<request>
<payload></payload>
<comment></comment>
<char></char>
<columns></columns>
</request>
<response>
<comparison></comparison>
<grep></grep>
<time></time>
<union></union>
<oob></oob>
</response>
<details>
<dbms></dbms>
<dbms_version></dbms_version>
<os></os>
</details>
</test>
-->

 

 

 

这是一个test实例 写道

    <test>
        <title>MySQL UNION query (NULL) - 1 to 10 columns</title>
        <stype>3</stype>
        <level>1</level>
        <risk>1</risk>
        <clause>1,2,3,4,5</clause>
        <where>1</where>
        <vector>[UNION]</vector>
        <request>
            <payload/>
            <comment>#</comment>
            <char>NULL</char>
            <columns>1-10</columns>
        </request>
        <response>
            <union/>
        </response>
        <details>
            <dbms>MySQL</dbms>
        </details>
    </test>

   

       首先看注释中payloads文件中共分为两类元素，一类为<boundary>,一类为<test>,

其中boundary指的是注入时使用的一些通配符之类的，类似'  )  (  and  1=1  and '1'='1之类的东西，

而test则是注入时具体使用的语句，类似select之类的。两者区别还是比较明显的

 先讲讲两个元素中相同的子元素释义：

 

 

1. level这个属性，这是每个test都要有的属性，他指出了在sql注入中处于哪个档次，换句话说，你在实际运行sqlmap的时候，需要指定运行level，默认是1，从1-5都可以指定，在level=1的情况下，大概执行的注入test在100个以内，level越高，所执行的test越多，如果你指定level5，那么所有test中标注为1，2,3,4,5的都将执行，这里要注意的是执行level 5，估计执行的sql注入语句将超过1000个,如果再猜解表内容，语句将更多，并不是注入test越多越好，这将造成大量的通信负担。另外，如上所举的例子 UNION query (NULL) ，就是level 1 ，最基本的测试，实际上union null测试字段个数也是最常见的手法，但是这里如果你实际使用就会发现，这里有些问题，后面类似的会有11-20字段，21-30字段这样的test，并且他们给予了不同的level，估计老外觉得查询字段一般不会超过10个，但是我觉得这个不是很合理，所以我推荐大家把后面那几个的level都改成1，这样子实际使用效果将会非常好。

 

 

2.clause这个属性，这是一个条件属性，test编辑中是可以多选的

写道

Sub-tag: <clause>
In which clause the payload can work.

NOTE: for instance, there are some payload that do not have to be
tested as soon as it has been identified whether or not the
injection is within a WHERE clause condition.

Valid values:
0: Always
1: WHERE / HAVING
2: GROUP BY
3: ORDER BY
4: LIMIT
5: OFFSET
6: TOP
7: Table name
8: Column name

 

大家可以看<title>MySQL UNION query (NULL) - 1 to 10 columns</title>所举得例子中，     <clause>1,2,3,4,5</clause>，即union可以在 where/having子句中，group by ,order by limit offset子句中使用，后面比较多的test中，也可以看到基本上也就前面的几个常用些，特别是1-5,当然你要吃不准你自创的sql的话，就标注成1吧。。。

 

3.where 这个属性，

写道

Sub-tag: <where>
Where to add our '<prefix> <payload><comment> <suffix>' string.

Valid values:
1: When the value of <test>'s <where> is 1.
2: When the value of <test>'s <where> is 2.
3: When the value of <test>'s <where> is 3.

A comma separated list of these values is also possible.

 这是他的boudary中的注释，我估计写错了，test中的注释是

 

写道

Sub-tag: <where>
Where to add our '<prefix> <payload><comment> <suffix>' string.

Valid values:
1: Append the string to the parameter original value
2: Replace the parameter original value with a negative random
integer value and append our string
3: Replace the parameter original value with our string

 

这个估计是对的，实际上就是1 附加到原始的变量值后面，类似id=1 ’这个概念，而2就是 id=31231 ‘这个概念。3就是id=’这个概念，细微之处大家可以体会下。具体sql具体对待。

 

 

下来就是各自独有的概念了，

4 <boudary>中的ptype属性

写道

1: Unescaped numeric
2: Single quoted string
3: LIKE single quoted string
4: Double quoted string
5: LIKE double quoted string

 实际上就是bandary的值是什么属性，数字，单引号字符串，或者双引号字符串。

 

5 <boudary>中的ptype属性<prefix> <suffix>这一对，就是前缀和后缀了，举个例子因为在实际中payload可能有重复迭代，例如那个union null，所以把select之类可以设成前缀，

 

6. <test>中的独有概念

<title>显示用的，没啥大用，但也别起个没意义的，例如Microsoft SQL Server/Sybase error-based - Parameter replace，就比较好，指出数据库名，注入类型，具体功能。

 

<stype> 比较重要的一个属性

写道

Valid values:
0: Heuristic check to parse response errors
1: Boolean-based blind SQL injection
2: Error-based SQL injection
3: UNION query SQL injection
4: Stacked queries SQL injection
5: AND/OR time-based blind SQL injection

 

这是一个分类，就是你写的这个test具体属于那个功能模块的是盲注呢，还是union注入呢，还是基于时间的呢，这个也很直白。

 

<risk>这个属性也很重要，

写道

Valid values:
0: No risk
1: Low risk
2: Medium risk
3: High risk

 

实质就是，如果你的sql注入语句包含了update，insert，delete之类的或者更猛的操作，那么请不要设置为0，而且自己在用sqlmap的时候也不要轻易的设置--risk为高值，因为risk较高的操作都带有ddl的性质，容易引起数据库数据上的改变。谨慎，慎重。

 

<vector> 就是要执行的sql注入句式 例如在上面那个例子中就是<vector>[UNION]</vector>，实际上是union all select句型，这个细节我也需要继续学习。。

 

<response>和<request>这个是sql注入中最关键的一个部分，他们被设计的赋予了很大的灵活性和技巧，下次再说吧。。。。。