使用BurpSuite来进行sql注入

BurpSuite之SQL Injection

[网站]:mutillidae

[道具]BurpSuite 1.4.07 + FireFox

1:安裝配备mutillidae

假如碰到难题，开下边的贴子.

http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10

2:SQL Injection检测

挑选“OWASP Top 10″ —>> ”A1 – Injection” —>> ”SQLi – Extract Data” —>> ”User Info”，给出:

进到下列页面,如下图所示:

单引号检验Name相匹配表格，回到给出:

运用普遍的方式开展引入,

1.order by

2.UNION

3.SELECT

….

有关怎样手動引入，再此略过.

屁话了一上午，下边立即看Burp Suite的运用.

假如愿意了解Burp Suite的应用，必须要弄清楚它的几类检验方式.

假定有下边词典，运用上边几种方法,各自进行检测：

seover" style="box-sizing:border-box;margin:12px 0px;padding:0px;font-family:Monaco, MonacoRegular, 'Courier New', monospace;vertical-align:baseline;width:620px;color:#333332;white-space:normal;height:auto;border:1px solid #DEDEDE !important;overflow:hidden !important;position:relative !important;direction:ltr !important;line-height:15px !important;background-image:initial;background-attachment:initial;background-color:#F8F8FF !important;background-size:initial;background-origin:initial;background-clip:initial;background-position:initial;background-repeat:initial;">

Default

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

username ——-password

user002 ——– pwd002

user003 ——– pwd003

user002 ——– pwd002

sniper  ——payload 数为1

----- username/password -------- sniper 检测流程【%username%---表达检测函数，也也是词典值】

-----%username%/password

-----username/%password%

user001 ------- password

user002 ------- password

user003 ------- password

___

username ---- user001

username ---- user002

username ---- user003

___

battering ram ———–payload 数为1