Notes by mraabo

SQLMap

Properties1
tagscomputer-security

An open-source penetration testing tool that automates the process of detecting and exploiting SQL Injection vulnerabilities in web applications.

Payload

Every payload consist of:

  • Vector: central part of the payload carrying the useful SQL code to be executed at target, e.g. UNION ALL SELECT 1,2,VERSION().
  • Boundaries: prefix and suffix characters used for injecting the vector into the vulnerable SQL statement, e.g. '<vector>-- .

Commands

sqlmap [-u <url>] [<curl command>] [-r <file containing HTTP request>] [OPTIONS]

Options

  • --batch: do not ask for user input, use the default behaviour.
  • --data = "<data string>": specify data used in POST request. In the data * can specify where to place the SQL Injection, which is useful when automatic detection fails.
  • --cookie = "<cookie value>": specify cookie used in requests
  • -H <header string> or --header <header string>: specify header used in requests
  • --method <method>: use other HTTP methods than GET or POST.
  • --parse-errors: parse errors if any.
  • -t <filename>: stores traffic content to file.
  • --v <0 to 6>: set verbosity level, default is 1.
  • —prefix=‘<string>’: add custom prefix to payload.
  • —suffix=‘<string>’: add custom suffix to payload.
  • --level <1-5>: extends both vectors and boundaries used, based on expectancy of success (lower number means only trying those with higher expectancy of success). Default is 1.
  • --risk <1-3>: extends the used vector set based on their risk of causing problems at the target side (e.g., risk of denial-of-service or database entry loss). Default is 1.
  • --union-cols=<int>: specify the number of columns to use for Union query-based SQL Injection.
  • --union-char=<char>: specify value to use for dummy filling values used in Union query-based SQL Injection. Useful if the default dummy values used by SQLMap, NULL and random integers, are not compatible.
  • --union-from=<table>: append FROM <table> to a UNION query when this is required (e.g. Oracle database) when doing Union query-based SQL Injection.

Advanced options

  • --code <int>: fixates detection of HTTP success response to HTTP code <int>.
  • --titles: switch to detect differences between responses by inspecting the content of the HTML tag <title>.
  • --string <string>: switch to detect differences between responses by checking for the appearance of <string> in the response.
  • --text-only: switch to remove all HyperText Markup Language (HTML) tags, and detect differences in responses based on only textual (i.e. visible) content. Useful when dealing with a lot of hidden content such as the HTML tags <script>, <style>, <meta>,
  • --technique <B,E,U,S,T,or Q>: specify SQL injection technique. B for Boolean-based, E for Error-based, U for Union query-based.

Options for database enumeration

  • --banner: return database version banner.
  • --current-user: return current user name.
  • --is-dba: check if the current user has database administrator rights.
  • --schema: return overview of database architecture.
  • --current-db: return database name.
  • --tables -D <db name>: return table names from tables in <db name>.
  • --dump [-T <table name>] -D <db name>: return content of <table name> in <db name>. If table name is not specified it will dump all tables in <db name>. Additional parameters can be added to specify parts of the table to return:
    • -C <col1>, <col2>,...: return only columns <col1>, <col2>,…
    • --start=<start int> --stop=<stop_int>: return only rows from <start int> to <stop int>.
    • --where = "<conditional>": return only data adhering to <conditional>.
  • --search [-T <name> | -C <name>]: search for a column or table containing <name>.
  • --passwords: list and crack the DBMS user’s passwords, if possible.

Options for OS exploitation

  • --file-read "<file path>": read local files. Only works if current user has the privileges.
  • --file-write "<your file path>" --file-dest "<target file path>": write existing file at <your file path> to a file at the target at <target file path>. Only works if current user has the privileges.
  • --os-shell: tries to gain access to a remote shell.

Options for bypassing protection

  • --csrf-token = "<token parameter name>: attempt to bypass anti-CSRF by parsing target response content and search for a fresh token value to use in next request. The required <token parameter name> should be in the request data.
  • --randomize=<parameter>: randomise values for <parameter>. Useful when web applications require unique values for some predefined parameter.
  • --eval = "<python code>": evaluate python code before the request is sent to the target. Useful when a web application require one parameter value has to contain some function of another parameter value, e.g. h=MD5(id).
  • --proxy = "<proxy>": use a proxy IP. Useful for concealing IP or bypassing blacklisted IP.
  • --proxy-file = <file of proxies>: use a proxy IP from a list of IPs in a file. It goes sequentially through the list skipping IPs that causes any problems (e.g. are blacklisted).
  • --random-agent: change default user agent with a randomly chosen value from a pool of values used by browsers. Useful when the default user agent (containing “sqlmap”) is blocked.
  • --tamper=<tamperscript name>: run so-called tamper scripts used for bypassing protection. A list of possible tamper scripts can be seen with --list-tampers.
  • --chunked: splits the POST request’s body, such that blacklisted SQL keywords are split between the chunks to try to let them pass unnoticed.

Graph View