Exploitation Tools
sqlmap tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
introduction to sqlmap
SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in web applications. The SQL injection is a common web application security vulnerability that occurs when an attacker can manipulate an application's SQL query by injecting malicious SQL code. SQLMap is designed to identify and exploit such vulnerabilities, helping security professionals and ethical hackers test the security of web applications. It provides a lot of features such as;
sqlmap features
- Automates the discovery of sql injection vulnerabilities on web applications.
- Automates the exploitation of sql injection vulnerabilities once found. If SQL injections are new to you, this means that you can do the following;
- Log into a web application without the credentials.
- View database records of the web application.
- You can change records or delete them.
- You can delete tables or even the entire DB.
- SQLMap can enumerate information about the database, such as database names, table names, and column names. This information is crucial for further exploitation and data extraction.
- SQLMap supports various database systems, including MySQL, PostgreSQL, Microsoft SQL Server, and Oracle, making it versatile for testing applications that use different database technologies.
This tool is one of the best things to happen to web applicaiton penetration testing.
installation of sqlmap on windows and linux
Kali Linux
In both Linux and windows systems, you can download the zip file and extract it to your preferred location. Download the archive from this site sqlmap downloads If you are on Linux, some distros will have the tool already so try running an package installation. Here is an example in Kali Linux.
sudo apt install sqlmap -y
windows
Make sure python is installed on the system because it uses python scripts. On windows, I extracted my copy in the C drive and renamed the folder to sqlmap. So my Windows path is like this "C:\sqlmap".
Open command prompt if you have extracted the folder navigate to it. When running the commands, I will be using Kali Linux for my demonstration but you can also follow using windows. Simply use "sqlmap.py" everywhere I use "sqlmap".
cd C:/sqlmap
#windows test
sqlmap.py -u "sweshi.com" --batch
#Kali test
sqlmap -u "sweshi.com" --batch
sqlmap usage tutorial
We can use the tool to target database driven websites. The command below targets a local web server and I target the login page.
Getting the database version using sqlmap
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms -b
Here I insert the URL "-u" and set it to use default behaviour "--batch" and to analyze the forms on the page "--forms" and to display the database name and version "-b"
You can see that the web application is using MySQL 5.0
Getting the database password using sqlmap
On the local web server I am using, I do not have a password set but we can still scan and see if it recognise that.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms -passwords
You can see from the result that the two users "pma" and "root" have no passowrds set.
Getting the current user of the database using sqlmap
We can also see the user the database is running under. From the password enumeration, we saw pma and root users so the database must be using one of them to run.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --current-user
From the result, we can see that the root user is being used on "root@localhost"
listing all the databases on the database server using sqlmap
To list the databases that exist on the database, we can change the code to have the "-dbs" option as shown below.
We can continue specifying separate things to view. lets try to view the tables in the DBMS.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --dbs
Viewing the tables in a database in sqlmap
We can also select a specific database and then view the tables that are in it. For this, we will use the --tables option to view the tables of the DB and the -D option to select the database we are interested in checking.For this example, I select the table named "realstate" from the prior result.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --tables -D realstate
We can see that there are some tables listed from the database. We are interested in the accountusers table. We will use this table to show how we can view the contents of the database table.
Viewing the contents of a table using sqlmap
We will select the table we are interested in using the -T option and then use the --dump option to display all the content. If we dont select the table, it can still show the contents of all the tables.
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --forms --dump -T accountusers -D realstate
We can see all the columns of the table as well as the values in each column.
Creating an OS Shell with sqlmap
Sqlmap allows the user to plant a payload on the target system that can give us remote access to the command line. Thats right, we can have full cmd by implementing an OS and do damage to the target even beyond the web application. Remember to use these things ethically, get permission before doing any of this stuff.
#connect to the OS
sqlmap -u "192.168.43.141/Lucky/login.php" --batch --os-shell
#listing content on windows shell
dir
I ran the "dir" command because my webserver is on a Windows machine. I was able to connect successfully and I was able to list the contents of the web folder. You can of course run commands on the shell that the target OS supports and this makes this an extremely dangerous feature.