注意：本文分享给安全从业人员、网站开发人员以及运维人员在日常工作防范恶意攻击,请勿恶意使用下面介绍技术进行非法攻击操作。。

[TOC]

##Sqlninja
描述:数据库SQLInjection注入，专对于SQLServer数据库、进行安全测试以及执行query sql和executive the command.
用法：

# sqlninja -m <mode> InjectionUrl
-m <mode> : Required. Available modes are:
  t/test - test whether the injection is working
  f/fingerprint - fingerprint user, xp_cmdshell and more
  b/bruteforce - bruteforce sa account
  e/escalation - add user to sysadmin server role
  x/resurrectxp - try to recreate xp_cmdshell
  u/upload - upload a .scr file
  s/dirshell - start a direct shell
  k/backscan - look for an open outbound port
  r/revshell - start a reverse shell
  d/dnstunnel - attempt a dns tunneled shell
  i/icmpshell - start a reverse ICMP shell
  c/sqlcmd - issue a 'blind' OS command
  m/metasploit - wrapper to Metasploit stagers

dig -f paypaldomain.txt +noall +answer #进行域名指向分析：

weiyigeek.top-