SQL注入被动扫描工具

Posted 2021-04-11 寒剑夜鸣

1.

https://github.com/zt2/sqli-hunter

安装：

git clone https://github.com/sqlmapproject/sqlmap.git
git clone https://github.com/zt2/sqli-hunter.git
cd sqli-hunter
gem install bundle
bundle install

运行：

python sqlmapapi.py -s

ruby sqli-hunter.rb --smart --level=2 --threads=10 -p 8888 -v 2 

#参数可自定义

---

2.

https://github.com/ysrc/GourdScanV2

安装：

apt-get install redis-server

wget https://sec.ly.com/mirror/get-pip.py --no-check-certificate && python get-pip.py -i https://mirrors.aliyun.com/pypi/simple/

运行：

redis-server conf/redis.conf
python gourdscan.py

默认平台用户名密码为：admin:Y3rc_admin
默认redis密码为：Y3rc_Alw4ys_B3_W1th_Y0u
如果有勾选sqlmap api scan选项，请在服务器上开启sqlmap api

开启sqlmap api

HTTP+HTTPS扫描配置

部分结果