自动检测和利用SQL注入工具 -- ghauri

PEnticE

自动检测和利用SQL注入工具 -- ghauri (qq.com)

​0x01 工具介绍
一个先进的跨平台工具，可以自动检测和利用SQL注入漏洞，支持布尔注入、时间注入、报错注入、堆叠查询，支持的数据库有MySQL，Microsoft SQL Server，Postgre，Oracle，支持的注入类型有GET、POST、COOKies等。

​

0x02 安装与使用

1、安装过程

1. <code>git clone https://github.com/r0oth3x49/ghauri.gi</code><code>pip install --upgrade -r requirements.txt</code><code>python setup.py install or python -m pip install -e</code>

复制代码

2、使用方法

1. ghauri http://www.site.com/vuln.php?id=1 --dbs

复制代码

3、其他参数
​​​​​​​

1. usage: ghauri -u URL [OPTIONS]
   
2. 
   
3. A cross-platform python based advanced sql injections detection & exploitation tool.
   
4. 
   
5. General:
   
6.   -h, --help          Shows the help.
   
7.   --version           Shows the version.
   
8.   -v VERBOSE          Verbosity level: 1-5 (default 1).
   
9.   --batch             Never ask for user input, use the default behavior
   
10.   --flush-session     Flush session files for current target
    
11. 
    
12. Target:
    
13.   At least one of these options has to be provided to define the
    
14.   target(s)
    
15. 
    
16.   -u URL, --url URL   Target URL (e.g. 'http://www.site.com/vuln.php?id=1).
    
17.   -r REQUESTFILE      Load HTTP request from a file
    
18. 
    
19. Request:
    
20.   These options can be used to specify how to connect to the target URL
    
21. 
    
22.   -A , --user-agent   HTTP User-Agent header value
    
23.   -H , --header       Extra header (e.g. "X-Forwarded-For: 127.0.0.1")
    
24.   --host              HTTP Host header value
    
25.   --data              Data string to be sent through POST (e.g. "id=1")
    
26.   --cookie            HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
    
27.   --referer           HTTP Referer header value
    
28.   --headers           Extra headers (e.g. "Accept-Language: fr\nETag: 123")
    
29.   --proxy             Use a proxy to connect to the target URL
    
30.   --delay             Delay in seconds between each HTTP request
    
31.   --timeout           Seconds to wait before timeout connection (default 30)
    
32.   --retries           Retries when the connection related error occurs (default 3)
    
33.   --force-ssl         Force usage of SSL/HTTPS
    
34. 
    
35. Injection:
    
36.   These options can be used to specify which parameters to test for,
    
37.   provide custom injection payloads and optional tampering scripts
    
38. 
    
39.   -p TESTPARAMETER    Testable parameter(s)
    
40.   --dbms DBMS         Force back-end DBMS to provided value
    
41.   --prefix            Injection payload prefix string
    
42.   --suffix            Injection payload suffix string
    
43. 
    
44. Detection:
    
45.   These options can be used to customize the detection phase
    
46. 
    
47.   --level LEVEL       Level of tests to perform (1-3, default 1)
    
48.   --code CODE         HTTP code to match when query is evaluated to True
    
49.   --string            String to match when query is evaluated to True
    
50.   --not-string        String to match when query is evaluated to False
    
51.   --text-only         Compare pages based only on the textual content
    
52. 
    
53. Techniques:
    
54.   These options can be used to tweak testing of specific SQL injection
    
55.   techniques
    
56. 
    
57.   --technique TECH    SQL injection techniques to use (default "BEST")
    
58.   --time-sec TIMESEC  Seconds to delay the DBMS response (default 5)
    
59. 
    
60. Enumeration:
    
61.   These options can be used to enumerate the back-end database
    
62.   managment system information, structure and data contained in the
    
63.   tables.
    
64. 
    
65.   -b, --banner        Retrieve DBMS banner
    
66.   --current-user      Retrieve DBMS current user
    
67.   --current-db        Retrieve DBMS current database
    
68.   --hostname          Retrieve DBMS server hostname
    
69.   --dbs               Enumerate DBMS databases
    
70.   --tables            Enumerate DBMS database tables
    
71.   --columns           Enumerate DBMS database table columns
    
72.   --dump              Dump DBMS database table entries
    
73.   -D DB               DBMS database to enumerate
    
74.   -T TBL              DBMS database tables(s) to enumerate
    
75.   -C COLS             DBMS database table column(s) to enumerate
    
76.   --start             Retrive entries from offset for dbs/tables/columns/dump
    
77.   --stop              Retrive entries till offset for dbs/tables/columns/dump

复制代码

​