In day-to-day life, most of the websites you would come across are dynamic, which means that they take the user input and act upon it. When the user supplies input to the application, it is parsed by the interpreter, where the user-supplied input is combined with the application code.

However, a serious security flaw known as SQL injection can occur when the user-supplied input is mishandled. In simple terms, if the application fails to filter the input properly, an attacker can inject malicious code into the application. This injected code will be interpreted as an SQL statement by the application, leading to an SQL injection vulnerability. As a result, the attacker gains unauthorized access and can execute various harmful actions.

SQL injection is a widespread vulnerability in web applications. In a previous video, we explored SQL injection using SQLmap. If you haven't watched that series yet, you can click the "I" button to view it now. 

Today, we're delving into SQL injection without relying on any tools. Instead, we'll employ manual exploitation methods to gain a deeper understanding of its mechanics.

To facilitate our demonstration, we'll utilize DVWA (Damn Vulnerable Web Application), commonly found on various vulnerable VMs like Metasploitable2 and OWASP Broken Web Application, which we've previously installed.

Learn More Metasploitable2

Learn More OWASP BWA

In this article, I'll showcase SQL injection using Metasploitable2 to provide a thorough demonstration. But before we dive into the SQL injection technique, let's first familiarize ourselves with the SQL commands required to access the DVWA database.

Let's begin by launching the Metasploitable2 VM. 

We'll access the Metasploitable2 VM from Kali Linux. To do so, we need to obtain the IP address. Keep in mind, the default login credentials for Metasploitable2 are both 'msfadmin'. To find the IP address of Metasploitable2, execute the 'ifconfig' command. 

The IP address of the Metasploitable2 VM is 192.168.95.8. Return to Kali Linux and we'll use the SSH command-line utility to establish access.

Open a terminal. Execute the command "ssh" followed by the username and the target's IP address and also add the host key algorithm. 

To access the MySQL database server, use the command "mysql -u root -p". 

Upon execution, you'll enter the MySQL command-line interface, allowing you to execute SQL queries and manage the database.

Execute the command "SHOW DATABASES;" to fetch the names of all databases stored on the server. 

This information will be displayed in your command-line interface or any MySQL client you're utilizing. Use the command "USE dvwa;" to set the current database to "dvwa". 

Next, type "SHOW TABLES;" to display the tables stored within the DVWA database. 

Here, You'll see two tables listed: "guestbook" and "users". To retrieve all rows and columns from the "users" table, execute the query "SELECT * FROM users;".

The asterisk (*) stands for "all columns", so this query fetches every column of every row in the table. It's a quick way to gather all the information stored in that table.

MySQL will fetch all rows and columns from the "users" table and present them as a result set. Data in SQL is organized into columns and rows. You'll observe a series of columns such as User ID, First Name, Last Name, User, Password, Avatar, etc., with unique entries listed in the rows.

It's essential to note that the password stored in the database is not the actual password but rather a hashed version. Hashing is a one-way algorithm that converts the password into an encoded value. This measure is implemented to safeguard user passwords in case of a security breach, as hashed passwords are challenging to reverse back to their original form.

These are fundamental aspects of SQL queries for interacting with a MySQL database. Moving forward, I'll demonstrate how SQL injection works. 

You'll see the web application interface, and from there, you'll need to devise techniques to inject and structure your syntax in a manner that triggers unexpected behavior in the application.

To begin, open your browser and navigate to the IP address of Metasploitable2. Then, access the DVWA (Damn Vulnerable Web Application).

You'll need to input the DVWA username and password to access the dashboard. The default username is "admin" and the password is "password". 

After a successful login, you'll be directed to a dashboard where you can practice and enhance your web hacking skills.

Ensure that the DVWA security level is set to low.

Now, let's delve into SQL injection. Click on the SQL Injection link to proceed with the explanation.

In the DVWA application, on the SQL Injection page, you'll notice a prompt for a User ID. Approach the application as you would with a regular user.

Entering a User ID of 1, you'll observe that it displays "First name: admin" and "Surname: admin."

Behind the scenes, when User ID "1" is used, a query is executed on the MySQL database to retrieve the first name and last name.

Let's examine the queries executed on the MySQL shell.

Executing the query SELECT first_name, last_name FROM users WHERE user_id = '1';, MySQL retrieves the first name and last name of the user with ID '1' from the "users" table. 

This information is returned as a result set, typically containing a single row with the user's first name and last name.

Likewise, if we input a user ID of 2, the database will return "Gordon" and "Brown". 

This process may seem familiar, as we've already explored the backend database. 

However, under normal circumstances, accessing this data directly would not be possible.

Returning to the SQL injection example, our goal is to identify if there's a potential SQL injection vulnerability. To do so, let's introduce unconventional SQL syntax and observe the application's response.

Apostrophes(') are commonly used to test for SQL injection vulnerabilities. 

In our previous SQL shell session, we used apostrophes to enclose strings passed to the application. Let's observe the outcome when we input just an apostrophe.

Encountering a common error message stating "you have an error in your SQL syntax" often indicates vulnerability to SQL injection. While we'll discuss vulnerability detection further later on, for now, understand that the presence of an apostrophe breaking the SQL syntax implies potential for manipulation.

In our previous MySQL shell session, we queried for first name and surname from the "users" database where the user ID is ‘1’. Recognizing the possibility of disrupting SQL syntax, we can anticipate potential user IDs and request additional data.

Let's experiment with logic manipulation without necessarily disrupting the syntax. To achieve this, let's input an apostrophe(') that doesn't always break the syntax but may yield interesting outcomes. Knowing that the query is enclosed with opening and closing apostrophes, let's manipulate the syntax.

After the WHERE id='1' clause, which verifies if the value in the "id" column equals '1' and filters rows accordingly, we'll introduce a logical operator. By using the OR logical operator, we allow either condition to be true for the row to be included in the result set.

Subsequently, we'll employ the condition '1'='1', which is always true because it compares the string '1' with itself. This condition is frequently exploited in SQL injection attacks to coerce the query into returning all rows from the table.

Executing the query `SELECT first_name, last_name FROM users WHERE id='1' OR '1'='1';`, MySQL retrieves the first name and last_name from the "users" table where either the user ID is '1' or the condition '1'='1' evaluates to true. As the condition '1'='1' always holds true, this query effectively returns all rows from the "users" table.

Copy the condition that filters the rows returned by the query and paste it into the user ID field. 

Click on the submit button to display the same data retrieved previously from the MySQL database.

We've successfully gained arbitrary access to the backend database.

The next step involves a slightly complex task requiring familiarity with SQL syntax. Our objective is to steal usernames and passwords.

SQL queries feature a UNION SQL keyword, allowing us to merge the results of multiple SELECT statements into a single result set.

Utilizing the UNION SQL keyword, I'll craft another query to select the user and password columns from the "users" table. The aim is to extract sensitive information, such as usernames and passwords, from the database.

Upon execution, the first query is processed, followed by the union query, which consolidates the usernames and passwords into the same column names.

Let's test this on DVWA's SQL injection feature. 

Upon execution, an error message indicates a syntax error in SQL.

The syntax presented above may disrupt functionality due to the rogue apostrophe at the line's end (automatically added by the web application). 

However, the pound sign serves as a comment character, instructing SQL to disregard everything following it.

This syntax instructs SQL to provide usernames and passwords from the "users" table and merge them with the previously retrieved data. Entering this string into DVWA yields the desired data.

As observed, we've disrupted the web application's functionality. The initial record, "admin admin," is as expected since we requested the first record with id=“1.” Furthermore, by querying other users and passwords from the "users" table, we encountered hashed passwords within the surname field.

While hashed passwords are theoretically irreversible, many common password hashes are available online. A quick search can often yield the unhashed version of these passwords.

Clicking on any of these search results reveals the password.

This process provides insight into how SQL injection operates. If you wish to explore SQL injection using an automation tool, I recommend using SQLMap. Refer to the accompanying video for further details.

If you have any doubts or queries, feel free to write them in the comment section.

In this tutorial, we will be going to set up a Lab Environment to test our skills in the path of SQL injection. The lab we are going to set up here is SQLi-labs.

SQLi-Labs was created by a security researcher named Audi-1. SQLi Labs is a collection of PHP files and a script to populate several get and post scenarios, they are been listed in this tree.

The main purpose of this lab is to hone our SQL injection skills both manually and automatically. Let’s have a look at its installation step. 

Setting Up on Windows VM

You can easily set it up on any platform. But I suggest you, never try to install it on your native system, install it within Virtual Box.

If you have previously tried to set up this lab and got this error, it means the running PHP server might be 7.0 or higher. 

So, our first priority is to download the proper version of the Apache server which supports PHP 5.0.

Firstly, I have to uninstall the latest XAMPP server. 

Now, we have to download the old build XAMPP server from below link:

XAMPP 5.6.39 Download page

Once the old build is downloaded, install it. 

This process is quite similar to the previous installation steps. So keep waiting till the installation is finished:

Once the installation is finished, click on Finish to launch the XAMPP control Panel:

XAMPP control panel is launched. Now, we have to add the SQLi-labs-master.zip file to C:\xampp\htdocs\.

• Download the sqli-labs-master.zip file from the below GitHub Link.

Click to Download

• Once downloaded, move the downloaded file to C:\xampp\htdocs\ and extract it.

Now go back to XAMPP Control and Start Apache Server and MySQL server.

Let’s go back to the browser and access its content by navigating the following URL on your browser. 

Now our first priority is to set up the Database. Click on Setup/Reset Database

As you can notice the database was created.

Now, we are ready to test the SQL Injection attack.

If you want to access it from any other Virtual Machine i.e. Kali Linux, then first you have to identify your IP address using the command prompt. Before that Always remember to check whether the Attack machine and Attacker Machine are connected to the same Network:

Here I am using a Host-only Adapter on both sides:

Now run the following command to identify the IP address of the Attacker Machine (Windows PC).

The IP address is 192.168.56.108. Just navigate it through the browser. 

• If you got any connection error, then check whether your network adapter might not the same.

As you can notice, we have successfully accessed SQLi-labs from our Kali Linux machine.

Setting Up on Linux

The steps are similar to those previously used in Windows. Instead of Windows, download XAMPP 5.6.39 for Linux.

XAMPP Linux 5.6.39

Once downloaded, install it.

Once the installer command is executed it will automatically start the installation process graphically:

Once the installation is complete, start Apache and MySQL services.

The rest steps are the same as Windows. So try them in your own way.

In our previous blog, we set up a lab Environment (SQLi-Labs) on behalf of SQL injection attacks. 

• Click here to Learn More: 

In this chapter, we're going to learn different ways to exploit SQL injection attacks, using an Automated SQL injection and database takeover tool, called SQLMap.

SQLMap is a powerful, and versatile open-source tool written by Bernardo, and Miroslav to dynamically detect and exploit SQL injection issues. 

It supports many databases and helps us not only to enumerate and extract databases but also to execute system commands.

The tool supports the following list of underlying DBMS software used in various web applications—

• MySQL, 
• Oracle, 
• PostgreSQL, 
• Microsoft SQL Server, 
• Microsoft Access, 
• IBM DB2, 
• SQLite, 
• Firebird, 
• Sybase, 
• SAP MaxDB and 
• HSQLDB. 

The main focus will be on the Linux/PHP/MySQL stack as it is still the most common web application stack we see these days. 

SQLMap contains a wide array of features some of which are the following: 

• Support for different kinds of SQL injection techniques like: 
• Error-based injection 
• Blind injection 
• Time-based injection 
• Stacked queries 
• Acting as a database client if appropriate credentials are provided 
• Downloading and uploading files to the database server 
• Ability to explore databases, tables, and columns individually Exploiting SQL Injection 
• Built-in support for cracking common hashes such as MD5 
• Support for the Metasploit framework 
• Code execution by exploiting DBMS features such as xp_cmdshell

Using SQLMap

Kali Linux

SQL map comes pre-installed with Kali Linux, which is usually penetration testers' favorite operating system. 

You can launch the SQLMap Advanced help menu by executing the following command:

Any Linux Platform

If you want to install it on any other Linux Platform then run the following command:

Windows

If you wish to perform SQLMap command-line interface on your Windows machine, then our first priority is to download and install the python interpreter, as because SQLMap is written in python programming Language.

Download Python Installer

Once you have downloaded then install it. 

Check the Add python.exe to PATH and then Click on click on Install Now.

Once set up successfully, you can verify it by running Python on the command prompt.

Next, download the SQLMap Zip file from the official GitHub page. 

Download SQLMap.zip

Extract the Zip file:

Now change the directory to sqlmap-master directory, and then run the command prompt from here by typing cmd on the directory bar.

Now, from here, you can SQLMap as usual way. Let me test it by running help command:

If you want to run SQLMap directly from the Command prompt without changing the path, then you have to add the file path to the Environment variable.

Before that, we have to move the directory to the C:\ drive and then right-click on This PC, and then click on Properties. 

Here click onAdvance system setting > Click on Environment variable > double click on Path variable and then add the file path of SQLMap.

Everything is ready! Now we can easily run SQLMap from the command prompt without switching the file path.

From our previous chapter, we have learned the various method used to install SQLMap.

• Learn More: https://www.technoscience.site/2022/12/sqlmap-brief-introductory.html

In this chapter, we will be going to detect and identify whether the tested site is vulnerable or not. If the site is vulnerable, then we will be going to exploit it via SQLMap.

Let me first demonstrate the first test bed. 

Click on GET Error-based Single-quoter-String to get our first test bed site.

Input the ID as a parameter with the numeric value, as following in below screenshot:

It takes a GET parameter named id and displays username and password values for the same:

This URL displayed the value for the first user. Similarly, if we increment the ID parameter, we'll notice different usernames and their corresponding password pairs.

The most benign check for SQL injection is nothing other than adding a quotation mark ( ' ) after the suspect parameter. This actually tries to break the application's SQL query by adding a stray string character. 

Now let's try that out:

As expected, we get a classic MariaDB error which tells us that something is odd, and possibly an error-based SQL injection.

Let's fire up SQLMap and try to figure out whether it is exploitable or not.

SQLMap throws an excellent output suggesting that the id is vulnerable to an error-based SQL injection, and the backend Database is MySQL. 

As you may have understood, -u is used to supplying the URL to SQL Map, and the GET parameter is selected from it. Still, in case there are multiple parameters to look into, then we can use  -p and then specify the parameter name, to explicitly specify which parameter to look at in SQL Map.

As a bonus, it also alerts us that the parameter is susceptible to XSS vulnerability as well.

If you suspect, your backend database is not MySQL, then type y to continue. It is a good practice to check it.

On completion, it will produce output that the suspected URL is vulnerable to the id parameter. Type Y to continue if there are any.

When the detection phase is over, the output also shows us the variety of ways in which we can exploit this flaw. As a result, you can see the detailed output, consisting of exploitation choices, the payload used to test as well as the backend architecture of the web application.

Now, it is obvious that we can exploit this using the error-based technique. But before that, I'll navigate you through different types of settings we can use.

SQL Map supports the use of a specific technique of exploitation by using the --technique command line switch.

By default, SQLMap selects the appropriate usable technique; but it is a good idea to manually force SQL Map into one of these options if there are anomalies or if SQLMap is unable to dump the data automatically.

If you want to manually force SQLMap into one of these options, then you have to specify it while running a command.

Before that remove the log file. 

If you do not remove the logs file of SQLMap output, then whenever you try to run with any switches, it will automatically fetch the previous output.

The --dbms switch is used to specify the back-end DBMS forcefully.

SQLMap has some awesome switches for additional tests to perform while looking for injection points.

On execution, it will operate SQL Injection according to given switches.

As you can notice, SQL map only prints Boolean-based blind injection technique.

If you have learned the previous chapter then you might have a basic understanding of SQLMap usage. 

• Learn More: 

In this chapter, we are going to dump data in an Error-based Scenario.  

Let's go back to the previously discussed example. Here, we shall exploit the vulnerability using the error-based technique of SQLMap to list the database user and the list of databases.

The output is shown below:

Impressive! The current database user pointed out by SQLMap is root.

Now let us print the list of databases present using --dbs switch.

The output is shown below:

We have now found seven databases, of which five are the default for MySQL— "challenges", “information_schema”, “mysql”, “performance_schema”, and "phpmyadmin" and two that the user created— “security” and “test”.

Once we have the list of databases available, it may be a good idea to dump one of them. 

For demonstration, I'll select the security, and dump out the tables present inside it. SQLMap provides the --tables switch to list the same, but it must be used in parallel with the -D switch, which tells it which database to choose while dumping the tables.

The output is shown below:

The --tables instruct the sqlmap to extract all the tables from the security database. We’ve managed to find four tables in the security database. 

Next, we would try to enumerate the columns in the table that we are interested in. Now that the tables are at our disposal, let us dump out the data from the users' table. We'll use the --dump switch in conjunction with -D, and -T, which are used to dump out the data from the database and table names respectively.

The output is shown below:

Look at that, we have successfully extracted the data from the table. Sometimes it is possible that we are just interested in a specific column and not all of them.

For example, in the previous image, we may want to extract only the username and password columns, and might not want to waste time dumping the id column. 

To select and dump from specific columns we can use the -C switch, but initially, we'll use --columns to print the column names without actually dumping the table, and then use -C to select specific column names.

The output is shown below:

Great! We've got the exact column structure, now let us select the username and password columns, and dump from only these two columns.

The output is shown below:

There we have it! This data output is from only the username and password columns. As you can see from the syntax, the -C option takes the comma-separated values (CSV) of the column names.

Interacting with the wizard

If the previous stuff looks complicated then, for basic familiarity, there is an interactive setup wizard where SQLMap asks for things in detail, one by one, starting with the injection URL.

The --wizard switch invokes the wizard. 

As you can see, the wizard then asks for information. Input as per requirement.

It produces a basic output based on the setting chosen, such as the current user, the current database which was injectable, and whether or not the current user is a database administrator (DBA).

Dump everything!

There is an SQLMap option named --dump-all which dumps all the data present inside every single database accessible through the injection, including default databases such as information schema.

This command will extract everything accessible through the injection. Dumping all the databases takes a long time, and is generally not recommended. It may even disrupt the web application if the server resources are constrained.

From our previous videos, we have only performed single-thread operations of SQLMap. But, in real life, it is not that easy. There are hundreds of rows that might be present inside a table. So, it means, the operation may take a long time to complete the process. So, we may need to speed up these operations.

Luckily, the developers of SQLMap have provided us with four types of optimization techniques that will help us speed up the process.

From the SQL Map Advanced help menu, we got four types of switches, as marked in color below:

Let’s explain them one by one. In this video, we will be going to perform this operation in a Blind and Time-based scenario.

Go back to the home page of SQLi-labs and click on this marked link:

Similar to the previous chapters, we have to input the ID as a parameter with a numeric value on top of the URL bar:

Now, let’s perform SQLMap, and firstly, try to exploit this injection.

The --batch switch is used to enable a non-interactive session, once we use the switch the interactive shell will never ask for user input, it will automatically input default behavior.

The time Linux command-line utility automatically tracks and monitors the actual timing of completion of the processes.

The time taken for this operation is listed below:

Now, we have confirmed that the injection is Blind and Time-based. Now, we are ready, let’s continue our topic.

Previously, I have told you that SQLMap provides us four types of optimization techniques as follows: 

• Multi-threading
• NULL connections
• HTTP persistent connections
• Output prediction

Multi-threading

As we have already mentioned, SQL Map runs on only one single thread, which means it is darn slow. We can utilize the --threads switch and specify a value for the number of threads, which ranges from 1 to 10. By increasing the thread count, it can dramatically increase the overall performance of SQLMap.

Let's try that out. First, let's try to dump all the tables under the database security without the threads option. Here I am going to use the time command line utility to track and monitor the time.

The time Linux command-line utility automatically tracks and monitors the actual timing of completion of the processes.

The time taken for this operation is listed below:

Now, let's attempt to do the same with a thread count of 4. But each time we have to remove the log file of the previous operations.

The time taken for this operation is listed below:

As you can see, the running time has decreased with additional threads.

NULL connection

The NULL connection is enabled by the --null-connection command-line switch. 

The NULL connection option in SQLMap will try to exploit the injection without actually retrieving the full HTML body of the target. Instead, it utilizes various HTTP properties, such as Range and HEAD to retrieve a certain section of the HTML body, or just simply checks the response length to determine TRUE and FALSE situations.

The time taken for this operation is listed below:

If compare it with the previous then you will find out a significant difference. But as the process time decreases, which means CPU usage is high compared to others.

HTTP persistent connections

By default, SQLMap closes, opens, and recloses the connection to the target server as per your requirements, but this can sometimes create a bit of overhead. In case there is an overhead, this can be optimized by using the --keep-alive switch which uses the HTTP's persistent connection mechanism, and the exchange of data happens over an already opened connection.

The time taken for this operation is listed below:

If you compare it with the previous out you will find a significant difference.

Output prediction

To speed up things even further, SQLMap takes a very novel approach.

The output-prediction switch uses a table of precompiled datasets containing some common outputs found during SQL injections.

The time taken for this operation is listed below:

 If you compare it with others, then you will notice basic differences in process time.

Basic Optimization 

SQLMap provides an option to turn on some of the flags for performance optimization by using the -o switch.

These flags will enable as follows:

• --keep-alive  
• --null-connection 
• --threads 3

This basically enables persistent connections, NULL connections, and multiple threads to three. This setting can be enabled to achieve rudimentary performance benefits in certain types of injections like those that are error-based.

The time taken for this operation is listed below:

If you compare it with others, then you will notice basic differences in process time.

Until now, we've just considered injections in the GET requests and parameters, if you have not yet completed them then click the below links:

Detect & Exploit SQL Injection 

Dumping The Data

Let us now look at an injection in a POST parameter and exploit the same with the SQL Map.





It will redirect to a login Portal, as below screenshot:



In the Username field, we try to insert a stray character to break the query as we did before. 



Let's see what happens, when we click on Submit button.



Upon submitting the work, we get a typical MySQL error. Now, we need to check exactly which POST parameter is affected. 

To view the request we will use a Firefox add-on known as Live HTTP Headers which can be easily installed from the Firefox add-on gallery.



Now, Launch the HTTP Header Live extension, and refresh the page to load the entries.



So, based on the output of Live HTTP Headers, the affected parameter is "uname".

Let's use SQLMap's --data switch to exploit this POST-based scenario. 

Now, we'll enforce the parameter to check to uname and pass the POST parameters inside --data. Let's try this out in SQLMap. 

┌──(kali㉿kali)-[~]
└─$sqlmap -u http://192.168.56.108/sqli-labs-master/Less-11/ --data "uname=test'&passwd=&submit=Submit" -p uname

Here's what you'll see:

---
Parameter: uname (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: uname=test' AND (SELECT 8831 FROM(SELECT COUNT(*),CONCAT(0x717a626b71,(SELECT (ELT(8831=8831,1))),0x71716b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- sQZr&passwd=&submit=Submit


    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uname=test' AND (SELECT 2551 FROM (SELECT(SLEEP(5)))IkJg)-- METZ&passwd=&submit=Submit


    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: uname=test' UNION ALL SELECT NULL,CONCAT(0x717a626b71,0x6b566a6270656b416c57795a4d5978734f5a5a476c677976666b73684141704d5479534f44505055,0x71716b7a71)-- -&passwd=&submit=Submit
---
[13:57:01] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.37, PHP 5.6.39
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[13:57:01] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.56.108'

Look at that, SQLMap exploited the same level of easiness as it did in the GET-based injections. 

Another way of exploiting this is by capturing the POST request and manually specifying the parameter.

┌──(kali㉿kali)-[~]
└─$ nano requirement.txt


Now we've saved the request. We'll utilize the -r switch to read the HTTP request from the aforementioned file and then specify the vulnerable parameter, which in our case is uname through the -p switch.

┌──(kali㉿kali)-[~]
└─$sqlmap -r requirement.txt -p uname
        ___
       __H__
 ___ ___[.]_____ ___ ___  {1.6.7#stable}
|_ -| . [(]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org


[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program


[*] starting @ 13:57:47 /2022-12-06/


[13:57:47] [INFO] parsing HTTP request from 'requirement.txt'
[13:57:47] [INFO] resuming back-end DBMS 'mysql' 
[13:57:47] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uname (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: uname=test' AND (SELECT 8831 FROM(SELECT COUNT(*),CONCAT(0x717a626b71,(SELECT (ELT(8831=8831,1))),0x71716b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- sQZr&passwd=&submit=Submit


    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uname=test' AND (SELECT 2551 FROM (SELECT(SLEEP(5)))IkJg)-- METZ&passwd=&submit=Submit


    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: uname=test' UNION ALL SELECT NULL,CONCAT(0x717a626b71,0x6b566a6270656b416c57795a4d5978734f5a5a476c677976666b73684141704d5479534f44505055,0x71716b7a71)-- -&passwd=&submit=Submit
---
[13:57:48] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.6.39, Apache 2.4.37
back-end DBMS: MySQL >= 5.0 (MariaDB fork)
[13:57:48] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.56.108'


[*] ending @ 13:57:48 /2022-12-06/

And again! Through this technique, we achieved the same result but in a different manner. 

I demonstrated this through a file because this can be used when exploiting SQL injections that are not straightforward; when the payload is SOAP (XML-based) or JSON then we can use the same -r switch and feed the request to SQL Map through a file and exploit the injection.

While attempting an injection through SQLMap, if you got something below-mentioned error as highlighted on my screen, then do not panic. 

1. The first reason is quite simple, the tested parameter has not appeared to be injectable.
2. If the error occurs due to a second reason, then it will be easily fixed by increasing the values of level and risk.
3. This error may occur if there is some kind of protection mechanism involved.

In this section, we will be going to attempt to bypass the web application firewall using the Tamper script.

The --tamper switch is basically used in the evasion of simple filters and Web Application Firewalls (in short WAFs).

To list the Tamper scripts, run the following command on the terminal:

These Tamper scripts are a collection of in-built scripts which modify the injection vector used by SQLMap. For a better look, I have listed these scripts in a tabular form:

Name			Description
apostrophemask.py			Replaces the apostrophe character with its UTF-8 full-width counterpart.
apostrophenullencode.py			Replaces the apostrophe character with its illegal double Unicode counterpart.
appendnullbyte.py			Appends the encoded NULL byte character at the end of the payload.
base64encode.py			Base64 all characters in a given payload.
between.py			Replaces greater than operator (>) withNOT BETWEEN 0 AND #.
bluecoat.py			Replaces the space character after an SQL statement with a valid random blank character. Afterward, it replaces the character=with aLIKEoperator.
chardoubleencode.py			Double URL—encodes all characters in a given payload (not processing those that are already encoded).
commalesslimit.py			Replaces instances likeLIMIT M, NwithLIMIT N OFFSET M.
commalessmid.py			Replaces instances likeMID(A, B, C)withMID(A FROM B FOR C).
concat2concatws.py			Replaces instances likeCONCAT(A, B)withCONCAT_WS(MID(CHAR(0), 0, 0), A, B).
charencode.py			URL—encodes all characters in a given payload (not processing those already encoded).
charunicodeencode.py			Unicode-URL—encodes non-encoded characters in a given payload (not processing those already encoded).
equaltolike.py			Replaces all occurrences of the operator equal (=) with the operatorLIKE.
escapequotes.py			Slash escape quotes ('and").
greatest.py			Replaces greater than operator (>) withGREATESTcounterpart.
halfversionedmorekeywords.py			Adds a versioned MySQL comment before each keyword.
ifnull2ifisnull.py			Replaces instances likeIFNULL(A, B)withIF(ISNULL(A), B, A).
modsecurityversioned.py			Embraces a complete query with a versioned comment.
modsecurityzeroversioned.py			Embraces a complete query with a zero versioned comment.
multiplespaces.py			Adds multiple spaces around SQL keywords.
nonrecursivereplacement.py			Replaces predefined SQL keywords with representations suitable for replacement (such as replace ("SELECT", "")) filters.
percentage.py			Adds a percentage sign (%) in front of each character.
overlongutf8.py			Converts all characters in a given payload (not processing those which are already encoded).
randomcase.py			Replaces each keyword character with a random case value.
randomcomments.py			Adds random comments to SQL keywords.
securesphere.py			Appends a specially crafted string.
sp_password.py			Appendssp_passwordto the end of the payload for automatic obfuscation from the DBMS logs.
space2comment.py			Replaces the space character (' ') with comments/**/.
space2dash.py			Replaces the space character (' ') with a dash comment (--) followed by a random string and a new line (\n).
space2hash.py			Replaces the space character (' ') with a pound character (#) followed by a random string and a new line (\n).
space2morehash.py			Replaces the space character (' ') with a pound character (#) followed by a random string and a new line (\n).
space2mssqlblank.py			Replaces the space character (' ') with a random blank character from a valid set of alternate characters.
space2mssqlhash.py			Replaces the space character (' ') with a pound character (#) followed by a new line (\n).
space2mysqlblank.py			Replaces the space character (' ') with a random blank character from a valid set of alternate characters.
space2mysqldash.py			Replaces the space character (' ') with a dash comment (--) followed by a new line (\n).
space2plus.py			Replaces the space character (' ') with plus (+).
space2randomblank.py			Replaces the space character (' ') with a random blank character from a valid set of alternate characters.
symboliclogical.py			ReplacesANDandORlogical operators with their symbolic counterparts (&&and||).
unionalltounion.py			ReplacesUNION ALL SELECTwithUNION SELECT.
unmagicquotes.py			Replaces the quote character (') with a multibyte combo%bf%27together with a generic comment at the end (to make it work).
uppercase.py			Replaces each keyword character with an upper case value.
varnish.py			Appends an HTTP headerX-originating-IP.
versionedkeywords.py			Encloses each non-function keyword with a versioned MySQL comment.
versionedmorekeywords.py			Encloses each keyword with a versioned MySQL comment.
xforwardedfor.py			Appends a fake HTTP headerX-ForwardedFor.

Let's try and run one of the scripts called charencode.py, which replaces empty spaces with a + sign.

To run the tamper script mechanism, we'll use the --tamper switch with the name of the script, which in this case is charencode. For better results, I add --level switch with value 2 and --risk with value 2.

We'll also use the -v 4 level of verbosity to actually see the payload that was modified by the tamper script, as follows:

The output is shown below:

As you can see, the data mentioned in the payload sections of the output, are URL-encoded as per the charencode.py tamper script.

Tamper scripts are very experimental and should be used in a restricted or infrequent manner. Sometimes they may not work as expected. But these can sometimes be useful for evasion.

Various commands in SQLMap would allow us to execute system commands upon the underlying operating system. 

From the SQLMap Advanced help menu (sqlmap -hh), we have found several switches under the Operating System Access section, which can especially be used in order to take over the operating system.

In this chapter, we will be going to discuss the first three switches to take over the operating system, which are listed below:

Similar to the previous switch, it will also prompt some basic platform-related queries. Now, we need to input some basic platform-related queries.

Now we have to provide a comma separate list of absolute directory paths:

Once these are done, SQLMap tries to upload its stager and returns with an interactive shell to the web server. 

This feature of SQLMap is quite magnificent and easily allows us to get a shell.

Now, we are ready, let’s input the windows shell command.

This highlighted text of the output of the “whoami” and “dir” commands executed via os-shell. After each operation, the uploaded web file automatically removed.

Type "q" to quit the session:

Let's proceed for next switch.

OS-PWN

The --os-pwn switch of SQLMap allows the attacker to spawn an interactive command prompt, a Meterpreter session, or a Graphical user interface (VNC) session.

Its usage is quite simple, use the following command to proceed for spawn a session:

Rembember: The OS-PWN switch may not work properly with normal users, so run it with the sudo command.

Similar to the previous switch, it will also prompt some basic platform-related queries. Now, we need to input some basic platform-related queries.

Once these are done, SQLMap tries to upload its stager and returns with an interactive shell to the web server. In the end it will prompt us to choose the connection type:

Let’s start with Meterpreter

Type number 1, to create a meterpreter session. On execution SQLMap try to upload a shellcode exec file to \Temp directory.

It will automatically create a shell code and upload it to the temp directory. Once the upload was successful, it will automatically launch the msfconsole.

Now as you can notice, we have got a meterpreter session.

Let’s inject a VNC session

Type number 3, to create a meterpreter session. On execution, SQLMap tries to upload a shellcode exec file to \Temp directory and launch msfconsole.

In the end msfconsole automatically creates a VNC session.

As we can see, we have successfully managed to VNC session via SQL map.

SQLMap contains a large list of switches, and it is not easy to explain each of them, but I tried my best to explain the most used switches. 

In this section, we will take an overview of what we have covered.

• The first topic covers, a brief Introduction to SQLMap, and we have also noted down installation Steps for major Operating systems like Windows and Linux.

• In our second topic, we have demonstrated the first test bed to exploit SQL injection flaws. This section also covered Injection Techniques.

• The 3rd topic contains, the way of dumping the data from the database. This section also contains, Interacting with the wizard.

• In the 4th section, we have covered four types of optimization techniques and also tested them in a Blind and Time-based scenario.

• The 5th topic covered, the way of reading and writing files from the file system. This is an important topic, but I explain it most thoroughly.

• The 6th topic is handling injections in POST requests, where we have overlooked the steps to exploit a POST request scenario.

• The 7th topic covered the three switches used to take over the operating system. Each of them is mentioned separately.

• The 8th topic, “Bypassing Web Application Firewall using Tamper Script”, is where we have listed the way to bypass a firewall using a Tamper script. This topic is only for example, but, in reality, it is not that simple.

I hope you all have finished the complete SQLMap series. In the coming days, we will be going to upload some other videos to explain SQL Injection.