sqlMap

url：https://sqlmap.org/
git：https://github.com/sqlmapproject/sqlmap.git
git中文：https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-zh-CN.md
use url：https://github.com/sqlmapproject/sqlmap/wiki/Usage

sqlmap 是一种开源渗透测试工具，可自动检测和利用 SQL 注入缺陷并接管数据库服务器。需要安装python
boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.

-v参数

# 不同等级输出的信息
0: Show only Python tracebacks, error and critical messages.
1: Show also information and warning messages.
2: Show also debug messages.
3: Show also payloads injected.
4: Show also HTTP requests.
5: Show also HTTP responses' headers.
6: Show also HTTP responses' page content.

python sqlmap.py -u "http://192.168.116.27:8769/org/getTradeList1" -v 3 --method=POST --data "page=1&size=10" --headers "Token:cfeffbe1-cbf6-4843-aabe-5c7bed2eb30d"

python sqlmap.py -u "http://192.168.116.27:8769/org/getTradeList1" -v 3 --method=POST --data "{"size": 10,"page": 1}" --headers "Token:cfeffbe1-cbf6-4843-aabe-5c7bed2eb30d"

会将注入成功的请求信息，保存至一个文件。