https://github.com/sqlmapproject/sqlmap
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections.
测试用例
http://localhost:8086/project/controller/action (POST) # C:\Users\clu\Downloads\sqlmapproject-sqlmap-d4d83b2\sqlmap.py -u http://localhost:8086/project/controller/action --data=search=chuck&periodStatus=0&__RequestVerificationToken=AtQOR018kN6-nWlDQxFKI-9_-4Ni7JnZaNKTPMlbZFIzuK1Lz889_M0Wf5sYQ-H14fWTfUI0jJYFTYL30
search=chuck&periodStatus=0&__RequestVerificationToken=AtQOR018kN6-nWlDQxFKI-9_-4Ni7JnZaNKTPMlbZFIzuK1Lz889_M0Wf5sYQ-H14fWTfUI0jJYFTYL30
%userprofile%\AppData\Local\sqlmap\output\localhost
原文：https://www.cnblogs.com/chucklu/p/13158070.html