[1llusion]

Hello and welcome to part 1 of "SQL injection + database takeover" with SQL map.
In this part, I'll teach you how to use the basic functions of SQLMap.

SQLMap or Havij?
A hacker can't bother to do everything manually all the time. You can call me a skid, but even the top hackers use SQLMap or Havij time to time. The reason is, that some injections are just too boring and you must focus on other things that simply injecting the server.

HOWEVER do not rely on scripts and/or programs too much. They should only save you your time, not do your job.

When it comes to choosing a tool, I prefer using SQLMap, here are couple of reasons why:
=> Its free
=> Tells you exactly what it is doing
=> Gives you more information about the injection
=> Can use Metasploit framework in your attacks
=> Has a lot of covering methods (You can use Tor with it, simulate a smartphone etc.)
=> Saves all information to session file, so you can continue in your attack without having to re-discover all info over and over
=> Has a lot of options so you always get what you need

Getting ready

BackTrack has SQLMap already pre-installed. For other systems you can get it HERE

For this tutorial, we will use --tor option, this will use tor to cover all of our attacks. If you don't have it installed, SQLMap will provide you with a link to a guide how to install it.

Exploiting

I'm using BackTrack 5 R1 in this tutorial, there might be small differences on your system.

Starting SQLMap:


To start an attack, you will have to start SQL map with arguments.
Follow them this way:

Code:

./sqlmap.py --tor -u [vulnerable link] --tor = Uses tor to cover your attacks -u = Tells the system you will provide URL (type --help for more information)

SQLMap will scan the link and choose attacks according to the information found. Once the injection is completed, it will give you all information it found INCLUDING the payload (THANKS DEVELOPERS!)



All of the information will be saved to session file. Next time you exploit the same URL, SQLMap won't have to search for the payload, instead, it will use one of the payloads found previously.

Now lets find out the databases. This can take a lot of time, so let me introduce you to the --threads option, it works like this:

Code:

--threads [number of threads] USAGE: ./sqlmap.py --tor --threads [number of threads] -u [vulnerable link]

To enumerate databases, we will use the --dbs command. Our final command should look like this:

Code:

./sqlmap.py --tor --threads [number of threads] -u [vulnerable link] --dbs

SQLMap will start finding the databases, in my case, it was a blind injection so it takes a bit longer (however, its faster than havij for sure!)



Congratulations! You have injected your first website with SQLMap!
In the next part you will learn about dumping databases, looking for certain columns across databases and more!

Have a great day!

[Jacob]

Damn dude. This came out quick

[bluedog.tar.gz]

Good tutorial, also the pictures are really helpfull +1.

[Enc0de]

You can not use sqlmap for everything sqlmap focuses mainly on blind sqli and Union sqli however i am feeling generous today so I will give you all some good pointer about other tools.

Spoiler: Best Advice on SQLI

Sqlmap = Blind, Unioin
Mieliekoek.pl = Error based
Wpoison = Error based
Wapiti = Error based
W3af = Error , Blind (Kind of outdated)
Paros = Error, Blind
Sqid = Error

[Marcisdown]

Good tut i like your tuts

[killerOfCode]

This is an excellent tool, even for White Hats to use for detecting exploits. Sometime this summer I'm going to get Back Track, as it has impressed me every time I see a thread about it. Thanks for the share.

[cyber_d3face]

Thank you for this post I always have a need for posts like this as a reference. Thanks so much. Do you think sqli is one of the easiest exploits or would you suggest other method's?

[rc4ne]

Very good tutorial!

Images are not visible in my browser? Does anybody experience the same problem or does anybode knows how I can fix this?

Rc4ne

[JackoLantern]

Thanks Man Just Starting learning web hacking great tut

[EgyptGhost]

more like great tool