Sqlmap流量抓包

Question

我试图了解 SQLmap 是如何工作的。

例如，sqlmap在我的网站上发现注入(inject) -

Place: GET
Parameter: selected
    Type: UNION query
    Title: MySQL UNION query (NULL) - 5 columns
    Payload: act=il&ed=1' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6,0x579786e676651,0x373a), NULL, NULL, NULL, NULL#

使用 SQLmap，我可以转储数据库，但是如何从浏览器中转储相同的数据库？我试图将以下链接放入浏览器，但它不起作用 -

http://www.site.com/index.php?act=il&ed=1' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6,0x579786e676651,0x373a), NULL, NULL, NULL, NULL#

我的浏览器根本没有得到任何结果。我尝试了不同的方式来放置/**/和 + 等等，但很糟糕。

如何获取 Sqlmap 为渗透测试发送的链接？

如何通过此注入(inject)利用简单的 select version() 查询？

也许这真的行不通？

Answer 1

我相信您可以尝试增加 sqlmap 查询的详细程度。
这应该是 -v=4以下是该功能的官方使用说明:
https://github.com/sqlmapproject/sqlmap/wiki/Usage#output-verbosity

Option: -v

This option can be used to set the verbosity level of output messages. There exist seven levels of verbosity. The default level is 1 in which information, warning, error, critical messages and Python tracebacks (if any occur) are displayed.

0: Show only Python tracebacks, error and critical messages.

1: Show also information and warning messages.

2: Show also debug messages.

3: Show also payloads injected.

4: Show also HTTP requests.

5: Show also HTTP responses' headers.

6: Show also HTTP responses' page content.