注意:本文分享给安全从业人员,网站开发人员和运维人员在日常工作中使用和防范恶意攻击,请勿恶意使用下面描述技术进行非法操作。

[TOC]

##Sqlninja
描述:数据库SQLInjection注入,专对于SQLServer数据库、进行安全测试以及执行query sql和executive the command.
用法:

# sqlninja -m <mode> InjectionUrl
-m <mode> : Required. Available modes are:
t/test - test whether the injection is working
f/fingerprint - fingerprint user, xp_cmdshell and more
b/bruteforce - bruteforce sa account
e/escalation - add user to sysadmin server role
x/resurrectxp - try to recreate xp_cmdshell
u/upload - upload a .scr file
s/dirshell - start a direct shell
k/backscan - look for an open outbound port
r/revshell - start a reverse shell
d/dnstunnel - attempt a dns tunneled shell
i/icmpshell - start a reverse ICMP shell
c/sqlcmd - issue a 'blind' OS command
m/metasploit - wrapper to Metasploit stagers

dig -f paypaldomain.txt +noall +answer #进行域名指向分析:
WeiyiGeek.