Sqlmap

sqlmap
PENETRATION TESTING TOOL
Presented By,
SHAMSHAD T
MCA

CONTENT
• INTRODUCTION
• PENETRATION TESTING TOOL
• SQL INJECTION
• SQLMAP
• FEATURES
• SQLMAP ENUMERATION
• STEPS
• CONCLUSION
• REFERENCES

INTRODUCTION
 Kali Linux is a Debian-based Linux distribution aimed at advanced
Penetration Testing and Security Auditing. Kali contains several
hundred tools which are geared towards various information
security tasks, such as Penetration Testing, Security research,
Computer Forensics and Reverse Engineering.
 It was developed by Mati Aharoni and Devon
Kearns of Offensive Security through the rewrite of BackTrack,
their previous forensics Linux distribution based on Knoppix.

The third core developer Raphaël Hertzog joined them as a
Debian expert. Kali Linux is based on Debian Testing.
Kali Linux was released on the 13th March, 2013 as a complete,
top-to-bottom rebuild of BackTrack Linux, adhering completely
to Debian development standards.

PENETRATION TESTING TOOL
Penetration testing (also called pen testing) is the practice of testing a
computer system, network or Web application to find vulnerabilities
that an attacker could exploit.
The main objective of penetration testing is to determine security
weaknesses. A pen test can also be used to test an organization's
security policy compliance, its employees' security awareness and the
organization's ability to identify and respond to security incidents.

 SQL injection is a code injection technique that might destroy your database.
 SQL injection is one of the most common web hacking techniques.
 SQL injection is the placement of malicious code in SQL statements, via web page input.
SQL Injection

sqlmap
 sqlmap is an open source penetration testing tool that automates
the process of detecting and exploiting SQL injection flaws and
taking over of database servers. It comes with a powerful detection
engine, many niche features for the ultimate penetration tester and
a broad range of switches lasting from database fingerprinting, over
data fetching from the database, to accessing the underlying file
system and executing commands on the operating system via out-
of-band connections.
 Sqlmap is developed in python.

FEATURES
 Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL
Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase,
SAP MaxDB, HSQLDB and Informix database management
systems.
 Full support for six SQL injection techniques: boolean-based
blind, time-based blind, error-based, UNION query-based,
stacked queries and out-of-band.
 Automatic recognition of password hash formats and support
for cracking them using a dictionary-based attack.

Support to dump database tables entirely, a range of
entries or specific columns as per user's choice. The user can
also choose to dump only a range of characters from each
column's entry.
Support to search for specific database names, specific
tables across all databases or specific columns across all
databases' tables

Sqlmap ENUMERATION
 DBMS Server hostname : --hostname
 Dbms user the application is using: --current-user
 Applications current DB: --current-db
 If the current user is a DB: --is-dba
 List the DBMS users: --users
 List all DBMS users ,password hashes: --passwords
 List all available databases: --dbs
 List all tables or just for a specific database: --tables(-D <database name>)
 List all columns or for a specific table from that database: --columns
 Count table entries
 Dump data from a database/table/column: --dump,--dump-all

STEP
S Step #1 Start sqlmap
First, fire up Kali and go to Applications -> Database
Assessment ->sqlmap, as shown in the screenshot below

Step #2 Find a Vulnerable Web Site
 In order to get "inside" the web site and, ultimately the
database, we are looking for web sites that end in
"php?id=xxx" where xxx represents some number. Those who
are familiar with google hacks/dorks can do a search on
google by entering:
 inurl:index.php?id=
 inurl:gallery.php?id=

Step #3 Open sqlmap
When you click on sqlmap, you will be greeted by a screen
that below.
Sqlmap is a powerful tool, written as a Python script (we will be
doing Python tutorial soon) that has a multitude of options.

Step #4 Determine the DBMS Behind the Web Site
Before we begin hacking a web site, we need to gather
We need to know what we are hacking.
The start sqlmap on this task, we type:
kali> sqlmap -u "the entire URL of the vulnerable web page“
or this case:

For eg:
kali> sqlmap -u
"http://www.webscantest.com/datastore/ search_get_by_id.php?id=4"

 When we do so, sqlmap will return results like that below. Notice
where I highlighted that the web site backend is using MySQL 5.0

Step #5 Find the Databases
We take the command we used above and append it with --dbs, like this:
kali > sqlmap -u "http://www.webscantest.com/datastore/
search_get_by_id.php?id=4" --dbs

When we run this command against www.webscantest.com we get the results like

 Notice that I have circled the two available databases, information
schema and webscantest. Information schema is included in every
MySQL installation and it includes information on all the objects in
the MySQL instance, but not data of interest.
 Although it can be beneficial to explore that database to find objects
in all the databases in the instance, we will focus our attention on the
other database here, webscantest, that may have some valuable
information.

Step #6 Get More Info from the Database
So, now we know what the DBMS is (MySQL 5.0) and the name of a
database of interest (webscantest). The next step is to try to determine the
tables and columns in that database. In this way, we will have some idea
what data is in the database, where it is and what type of data it contains
(numeric or string). All of this information is critical and necessary to
extracting the data. To do this, we need to make some small revisions to
our sqlmap command.
Everything else we have used above remains the same, but now we tell
sqlmap we want to see the tables and columns from the
webscantest database. We can append our command with --columns -
D and the name of the database, webscantest such as this:

When we do so, sqlmap will target the webscantest database and
attempt to enumerate the tables and columns in this database.
search_get_by_id.php?id=4" -D webscantest --tables
search_get_by_id.php?id=4" -D webscantest -T accounts --
columns

Step #6 Get More Info from the Tables
search_get_by_id.php?id=4" -D webscantest -T accounts –C
uname,passwd --dump
Display all the username and password. But the password is a hashed
password. The password is encrypted and we need to decrypt it. To
crack the password we need another kali tool that is hash_identifier to
identify the type of hash.

CONCLUSION
 sqlmap is an open source penetration testing tool that automates
the process of detecting and exploiting SQL injection flaws and
taking over of database servers.
 By using this tool we can find the vulnerable wbsites and access
the database.

REFERENCES
• http://sqlmap.org/
• https://hackertarget.com/sqlmap-tutorial/
• https://www.binarytides.com/sqlmap-hacking-tutorial/
 Youtube

Sqlmap

More Related Content

What's hot (20)

Similar to Sqlmap (20)

Recently uploaded (20)

Sqlmap