运维 · 2023年10月11日 0

自动检测和利用SQL注入工具

0x01 工具介绍


一个先进的跨平台工具,可以自动检测和利用SQL注入漏洞,支持布尔注入、时间注入、报错注入、堆叠查询,支持的数据库有MySQL,Microsoft SQL Server,Postgre,Oracle,支持的注入类型有GET、POST、COOKies等。

0x02 安装与使用


1、安装过程
git clone https://github.com/r0oth3x49/ghauri.gipip install --upgrade -r requirements.txtpython setup.py install or python -m pip install -e
2、使用方法
ghauri http://www.site.com/vuln.php?id=1 --dbs

3、其他参数
usage: ghauri -u URL [OPTIONS]
A cross-platform python based advanced sql injections detection & exploitation tool.
General: -h, --help Shows the help. --version Shows the version. -v VERBOSE Verbosity level: 1-5 (default 1). --batch Never ask for user input, use the default behavior --flush-session Flush session files for current target
Target: At least one of these options has to be provided to define the target(s)
-u URL, --url URL Target URL (e.g. 'http://www.site.com/vuln.php?id=1). -r REQUESTFILE Load HTTP request from a file
Request: These options can be used to specify how to connect to the target URL
-A , --user-agent HTTP User-Agent header value -H , --header Extra header (e.g. "X-Forwarded-For: 127.0.0.1") --host HTTP Host header value --data Data string to be sent through POST (e.g. "id=1") --cookie HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..") --referer HTTP Referer header value --headers Extra headers (e.g. "Accept-Language: frnETag: 123") --proxy Use a proxy to connect to the target URL --delay Delay in seconds between each HTTP request --timeout Seconds to wait before timeout connection (default 30) --retries Retries when the connection related error occurs (default 3) --force-ssl Force usage of SSL/HTTPS
Injection: These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts
-p TESTPARAMETER Testable parameter(s) --dbms DBMS Force back-end DBMS to provided value --prefix Injection payload prefix string --suffix Injection payload suffix string
Detection: These options can be used to customize the detection phase
--level LEVEL Level of tests to perform (1-3, default 1) --code CODE HTTP code to match when query is evaluated to True --string String to match when query is evaluated to True --not-string String to match when query is evaluated to False --text-only Compare pages based only on the textual content
Techniques: These options can be used to tweak testing of specific SQL injection techniques
--technique TECH SQL injection techniques to use (default "BEST") --time-sec TIMESEC Seconds to delay the DBMS response (default 5)
Enumeration: These options can be used to enumerate the back-end database managment system information, structure and data contained in the tables.
-b, --banner Retrieve DBMS banner --current-user Retrieve DBMS current user --current-db Retrieve DBMS current database --hostname Retrieve DBMS server hostname --dbs Enumerate DBMS databases --tables Enumerate DBMS database tables --columns Enumerate DBMS database table columns --dump Dump DBMS database table entries -D DB DBMS database to enumerate -T TBL DBMS database tables(s) to enumerate -C COLS DBMS database table column(s) to enumerate --start Retrive entries from offset for dbs/tables/columns/dump  --stop              Retrive entries till offset for dbs/tables/columns/dump

0x03 项目链接下载


https://github.com/r0oth3x49/ghauri
如有侵权,请联系删除

好文推荐

红队打点评估工具推荐
干货|红队项目日常渗透笔记
实战|后台getshell+提权一把梭
一款漏洞查找器(挖漏洞的有力工具)
神兵利器 | 附下载 · 红队信息搜集扫描打点利器
神兵利器 | 分享 直接上手就用的内存马(附下载)
推荐一款自动向hackerone发送漏洞报告的扫描器

关注我,学习网络安全不迷路