（500字以内总结一下本周学习内容）
./dbpwaudit.sh -s IP -d master -D mssql -U username -P password./dbpwaudit.sh -s IP -d mysql -D mysql -U username -P password
sqlsus test.conf./sqlninja
-m <mode> : Required. Available modes are: //加载modle
t/test - test whether the injection is working //测试注入点是否可用
f/fingerprint - fingerprint user, xp_cmdshell and more
b/bruteforce - bruteforce sa account //爆破sa口令用的。。可以-w指定字典，也可以不使用字典，这样sqlninja就会自己穷举
e/escalation - add user to sysadmin server role
x/resurrectxp - try to recreate xp_cmdshell //尝试创建
u/upload - upload a .scr file //上传
s/dirshell - start a direct shell //获得一个目标主机的shell
k/backscan - look for an open outbound port //查找目标主机允许哪些端口外连
r/revshell - start a reverse shell //反弹shell
d/dnstunnel - attempt a dns tunneled shell
c/sqlcmd - issue a 'blind' OS command //执行系统命令，如果为sa的话直接可以net user
m/metasploit - wrapper to Metasploit stagers //配合msf使用
-f <file> : configuration file (default: sqlninja.conf) //配置sqlninja.conf文件
-p <password> : sa password
-w <wordlist> : wordlist to use in bruteforce mode (dictionary methodonly) //字典文件的路径。。爆破sa密码用的
-v : verbose output
-d <mode> : activate debug //调试模式
1 - print each injected command
2 - print each raw HTTP request
3 - print each raw HTTP response
all - all of the above在-f下面又有以下参数
0 - Database version (2000/2005) //检测当前数据库版本
1 - Database user //当前数据库用户
2 - Database user rights //当前数据库用户权限
3 - Whether xp_cmdshell is working //检查xp_cmdshell是否可以用
4 - Whether mixed or Windows-only authentication is used //是否windows本地系统权限
a - All of the above //以上所有选项
h - Print this menu //显示当前帮助菜单
q - exit //退出注入连接写到配置文件中
# GET EXAMPLE:
--httprequest_start--
GET http://www.xxx.com/informationdetail.aspx?id=11&titleid=%e3h;__SQL2INJECT__ HTTP/1.1
Host: www.xxxx.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept:*/*
Accept-Language: en-us,en;q=0.7,it;q=0.3
Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Connection: Keep-alive
--httprequest_end--
#
# POST EXAMPLE: (The Content-Length Header is automatically added by sqlninja!)
# --httprequest_start--
# POST https://www.victim.com/page.asp HTTP/1.0
# Host: www.victim.com
# User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060418 Firefox/1.0.8
# Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*
# Accept-Language: en-us,en;q=0.7,it;q=0.3
# Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
# Content-Type: application/x-www-form-urlencoded
# Cookie: ASPSESSIONID=xxxxxxxxxxxxxxxxxxxx
# Authorization: Basic yyyyyyyyyyyyyyyyyyyyy
# Connection: close
#
# vulnerableparam=aaa';__SQL2INJECT__&otherparam=blah
# --httprequest_end--
#
# HEADER-BASED EXAMPLE:
# --httprequest_start--
# GET http://www.victim.com/page.asp HTTP/1.0
# Host: www.victim.com
# User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060418 Firefox/1.0.8
# Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*
# Accept-Language: en-us,en;q=0.7,it;q=0.3
# Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
# Content-Type: application/x-www-form-urlencoded
# Cookie: VulnCookie=xxx'%3B__SQL2INJECT__
# Connection: close
# --httprequest_end--
#
Usage: python sqlmap [options]
Options:
-h, --help Show basic help message and exit
-hh Show advanced help message and exit
--version Show program's version number and exit
-v VERBOSE Verbosity level: 0-6 (default 1)
Target:
At least one of these options has to be provided to define the
target(s)
-u URL, --url=URL Target URL (e.g. "http://www.site.com/vuln.php?id=1")
-g GOOGLEDORK Process Google dork results as target URLs
Request:
These options can be used to specify how to connect to the target URL
--data=DATA Data string to be sent through POST
--cookie=COOKIE HTTP Cookie header value
--random-agent Use randomly selected HTTP User-Agent header value
--proxy=PROXY Use a proxy to connect to the target URL
--tor Use Tor anonymity network
--check-tor Check to see if Tor is used properly
Injection:
These options can be used to specify which parameters to test for,
provide custom injection payloads and optional tampering scripts
-p TESTPARAMETER Testable parameter(s)
--dbms=DBMS Force back-end DBMS to this value
Detection:
These options can be used to customize the detection phase
--level=LEVEL Level of tests to perform (1-5, default 1)
--risk=RISK Risk of tests to perform (1-3, default 1)
Techniques:
These options can be used to tweak testing of specific SQL injection
techniques
--technique=TECH SQL injection techniques to use (default "BEUSTQ")
Enumeration:
These options can be used to enumerate the back-end database
management system information, structure and data contained in the
tables. Moreover you can run your own SQL statements
-a, --all Retrieve everything
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--passwords Enumerate DBMS users password hashes
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--schema Enumerate DBMS schema
--dump Dump DBMS database table entries
--dump-all Dump all DBMS databases tables entries
-D DB DBMS database to enumerate
-T TBL DBMS database table(s) to enumerate
-C COL DBMS database table column(s) to enumerate
Operating system access:
These options can be used to access the back-end database management
system underlying operating system
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an OOB shell, Meterpreter or VNC
General:
These options can be used to set some general working parameters
--batch Never ask for user input, use the default behaviour
--flush-session Flush session files for current target
Miscellaneous:
--sqlmap-shell Prompt for an interactive sqlmap shell
--wizard Simple wizard interface for beginner users
[!] to see full list of options run with '-hh'原文：https://www.cnblogs.com/20189224sxy/p/10633320.html