复杂SQLMAP

 
<sqlMap namespace="tt">

    <sql id="ips_subcount_st">
        (select count(*) from 
        <iterate property="tableName" conjunction="union" open="(" close=")" > 
             select * from  $tableName[]$
        </iterate> t11 
        where 
            t11.$groupBy$=t1.$groupBy$ and
             serverity <![CDATA[ > ]]>${serverity_high})
        as highServeCount ,
         
         (select count(*)  from  
         <iterate property="tableName" conjunction="union" open="(" close=")" > 
             select * from  $tableName[]$
        </iterate> t11  
         where 
             t11.$groupBy$=t1.$groupBy$ and
             serverity <![CDATA[ > ]]>${serverity_low} and
            serverity <![CDATA[ <= ]]>${serverity_high}) 
         as midServeCount ,
         
        (select count(*)  from  
        <iterate property="tableName" conjunction="union" open="(" close=")" > 
             select * from  $tableName[]$
        </iterate> t11 
          where 
          t11.$groupBy$=t1.$groupBy$ and
           serverity <![CDATA[ <= ]]>${serverity_low}) 
        as lowServeCount ,
    </sql>
    
    
    <select id="t_Ips"  parameterClass="java.util.HashMap" 
        resultClass="com.***.Ips">
        select 
        t1.neId as neId,
        t2.neName as neName,
        t2.sn as sn,
        t3.name as ifName,
        t1.srcIp as srcIp,
        t1.dstIp  as dstIp,
        t1.sigName as sigName,
        t1.serverity as serverity,
        <isEqual property="groupBy"  compareValue="ifName">
            (select count(*) from 
            <iterate property="tableName" conjunction="union" open="(" close=")" > 
                 select * from  $tableName[]$
            </iterate> t11 
            where 
                t11.ifId=t1.ifId and
                 serverity <![CDATA[ > ]]>${serverity_high})
            as highServeCount ,
             
             (select count(*)  from  
             <iterate property="tableName" conjunction="union" open="(" close=")" > 
                 select * from  $tableName[]$
            </iterate> t11  
             where 
                 t11.ifId=t1.ifId and
                 serverity <![CDATA[ > ]]>${serverity_low} and
                serverity <![CDATA[ <= ]]>${serverity_high}) 
             as midServeCount ,
             
            (select count(*)  from  
            <iterate property="tableName" conjunction="union" open="(" close=")" > 
                 select * from  $tableName[]$
            </iterate> t11 
              where 
              t11.ifId=t1.ifId  and
               serverity <![CDATA[ <= ]]>${serverity_low}) 
            as lowServeCount ,
        </isEqual>
        <isEqual property="groupBy"  compareValue="neId">
            <include refid="ips_subcount_st" />
        </isEqual>
        <isEqual property="groupBy"  compareValue="srcIp">
            <include refid="ips_subcount_st" />
        </isEqual>
        <isEqual property="groupBy"  compareValue="dstIp">
            <include refid="ips_subcount_st" />
        </isEqual>
        
        <isNotEqual property="groupBy"  compareValue="ifName">
        <isNotEqual property="groupBy"  compareValue="neId">
        <isNotEqual property="groupBy"  compareValue="srcIp">
        <isNotEqual property="groupBy"  compareValue="dstIp">
<!-- 这个地方不这样搞一下的话,会导致resultClass中的三个属性没有值,会出错。 -->
            0 as highServeCount,
            0 as midServeCount,
            0 as lowServeCount,
        </isNotEqual>
        </isNotEqual>
        </isNotEqual>
        </isNotEqual>
        
        sum(t1.sponsorNum) as sponsorNum ,
        sum(t1.victimNum) as victimNum,    
        t2.domainId as groupId,
        t6.domainName as groupName,
        t1.insertTstamp  as timestamp  
        from  
        <iterate property="tableName" conjunction="union" open="(" close=")" > 
                 select * from  $tableName[]$
         </iterate> t1 
         left join ( select neId,neName,sn,domainId from h_db.t_NeInfo) t2 on (t1.neId=t2.neId )                      
         left join (select neId,ifId,name from h_db.t_IfInfo) t3 on (t1.neId=t3.neid and t1.ifId=t3.ifId)
         left join (select domainId,domainName from  h_db.t_Domain) t6 on t2.domainId=t6.domainId 
        <dynamic prepend="WHERE">
            <isGreaterThan prepend="AND" property="neId" compareValue="0">
                 t1.neId=#neId:INTEGER# 
            </isGreaterThan>         
            <isGreaterThan prepend="AND" property="groupId" compareValue="0">
                 t2.domainId=#groupId:INTEGER# 
            </isGreaterThan> 
            <isNotEmpty prepend="AND" property="ifName">
                 t3.name=#ifName#  
            </isNotEmpty>        
            <isNotEmpty prepend="AND" property="neList">
                 t1.neId in 
                 <iterate property="neList" conjunction="," open="(" close=")" > 
                  #neList[]# 
                 </iterate>
            </isNotEmpty>
            <isNotEmpty prepend="AND" property="groupList">
                 t2.domainId in 
                 <iterate property="groupList" conjunction="," open="(" close=")" > 
                  #groupList[]# 
                 </iterate>
            </isNotEmpty>    
            <isNotEmpty prepend="AND" property="beginTime">
            t1.insertTstamp<![CDATA[ >= ]]>#beginTime:TIMESTAMP# 
            </isNotEmpty>
            <isNotEmpty prepend="AND" property="endTime">
            t1.insertTstamp<![CDATA[ <= ]]>#endTime:TIMESTAMP# 
            </isNotEmpty>
        </dynamic>
        <isNotEmpty  property="groupBy">
            group by $groupBy$
        </isNotEmpty>
        <isNotEmpty  property="orderBy">
             order by  $orderBy$ 
        </isNotEmpty>
        <isGreaterThan  property="topN" compareValue="0">
            limit #topN:INTEGER#
        </isGreaterThan>
    </select>
</sqlMap>

### SQLMap 工具简介 SQLMap 是一款开源的自动化 SQL 注入工具,支持多种类型的数据库以及各种注入方式。它能够检测并利用 SQL 注入漏洞来接管数据库服务器。 #### 下载与安装 SQLMap 可以通过以下方式进行下载和安装: 1. **克隆官方仓库** 用户可以通过 Git 命令从 GitHub 上获取最新版本的 SQLMap: ```bash git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev ``` 此命令会将最新的稳定版代码拉取到本地目录 `sqlmap-dev` 中[^1]。 2. **依赖环境配置** - Python 版本:SQLMap 支持 Python 2 和 Python 3,推荐使用 Python 3.x。 - 安装完成后无需额外编译即可运行。 #### 基础命令详解 以下是几个常用的 SQLMap 命令及其功能说明: 1. **判断是否存在注入点** 使用 `-u` 参数指定目标 URL 并设置风险等级为 3 来全面扫描潜在的注入点: ```bash python sqlmap.py -u "http://example.com/vuln.php?id=1" --risk=3 --level=3 ``` 2. **查看当前使用的数据库名称** 如果已确认存在注入点,则可以进一步提取当前正在使用的数据库名: ```bash python sqlmap.py -u "http://example.com/vuln.php?id=1" --current-db ``` 3. **枚举所有可用数据库** 若要列举目标站点上的所有数据库列表,可执行如下命令: ```bash python sqlmap.py -u "http://example.com/vuln.php?id=1" --dbs ``` 4. **处理需要 Cookie 的场景** 当访问的目标页面受身份验证保护时,需附加相应的 Cookies 数据以便绕过认证机制继续测试: ```bash python sqlmap.py -u "http://example.com/vulnerable_page.php?id=1&Submit=Submit#" \ --cookie="PHPSESSID=some_random_session_id; security_level=low" ``` 5. **指定参数作为攻击入口** 对于复杂请求中的多个 GET/POST 参数,默认情况下只会针对第一个参数尝试注入;如果想明确指出具体哪个字段应被探测,则需要用到 `-p` 参数指明该变量的名字: ```bash python sqlmap.py -u "http://example.com/test.php?param=value" -p param ``` 以上内容涵盖了如何正确部署 SQLMap 软件包以及一些基本的操作指南[^2]^,^ [^3]. ### 注意事项 - 在实际环境中应用此类技术前,请务必获得合法授权以免触犯法律; - 测试过程中产生的任何数据破坏均由使用者自行承担后果。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值