Posted on

Introduction & Pre-requisite

sqlmap is an automated penetration testing tool for SQL Injection OWASP-2013-A1. In this tutorial, you will learn more about the different types of sqlmap commands and switches.

First of all, downloading and installing of sqlmap is straightforward.

If you are using Kali Linux or any other popular Linux distribution, Git is already pre-installed.

Type the following command to install Git if it is not installed.

sudo apt-get install git

With Git installed, you can clone the latest version of sqlmap by entering the following command. This will automatically download all the files in the sqlmap project.

git clone https://github.com/sqlmapproject/sqlmap.git

Usage & Examples

1) GET Request

The first method is the most commonly used, where the parameters are in the URL.

python sqlmap -u "https://target.com/index.php?name=abc*&lastname=def"

The switches used in the above sqlmap command are:

-u = URL

  • = specifies which parameter to scan (name in this case)

2) POST Request

The POST method has the parameters in the body section of an HTTP request and therefore, require additional steps before sqlmap is able to test for vulnerability.

2.1) BurpSuite Method

Step 1: Intercept the post request using BurpSuite

Step 2: Right-click on the panel and click on “Copy to file”

Step 3: Parse the text file into BurpSuite using the -r switch

An example of the command is as follow:

python sqlmap -r

The switches used in the above sqlmap command are:

-r = Request file

-p = Parameter

--dbs = Enumerate database

--threads = Number of threads running

An example of a post request:


POST /bedita-3.5.0.corylus.2261e29/bedita/index.php/newsletter/saveMailGroups HTTP/1.1
Host: 127.0.0.1
Proxy-Connection: keep-alive
Content-Length: 523
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://127.0.0.1/bedita-3.5.0.corylus.2261e29/bedita/index.php/newsletter/viewMailGroup/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: CAKEPHP=me57vjaqc2ts154qr342a6u6i2; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_sortsel=field_name; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_ordersel=ASC; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_limitsel=15; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_filtersel=default; flash=yes; PHPSESSID=tg14v79ionj9d7lpelap300p33; cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-CMSPagesController=true; cms-panel-collapsed-cms-content-tools-CMSMain=false; _ga=GA1.1.621011711.1425057132

data[MailGroup][id]=&data[MailGroup][group_name]=&data[MailGroup][area_id]=1&data[MailGroup][visible]=1&data[MailGroup][security]=none&data[MailGroup][confirmation_in_message]=Hi [$user],

your+subscription+is+now+active,+soon+you'll+receive+the "[$title]"+newsletter.&data[MailGroup][confirmation_out_message]=Hi [$user],

you+have+been+unsubscribed+from "[$title]"

 

2.2) SQLmap Method

Step 1: Intercept the post request using BurpSuite

Step 2: Run the following sqlmap command:

python sqlmap –u "https://target.com/index.php" --cookies= --data=

Using the example POST request above, the contents going into the –cookies switch should be:

Cookie: CAKEPHP=me57vjaqc2ts154qr342a6u6i2; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_sortsel=field_name; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_ordersel=ASC; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_limitsel=15; /impresscms_1.3.7_final/htdocs/modules/profile/admin/field.php_mod_profile_Field_filtersel=default; flash=yes; PHPSESSID=tg14v79ionj9d7lpelap300p33; cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-CMSPagesController=true; cms-panel-collapsed-cms-content-tools-CMSMain=false; _ga=GA1.1.621011711.1425057132

Next, the contents going into the data section should be:

data[MailGroup][id]=&data[MailGroup][group_name]=&data[MailGroup][area_id]=1&data[MailGroup][visible]=1&data[MailGroup][security]=none&data[MailGroup][confirmation_in_message]=Hi [$user],

your+subscription+is+now+active,+soon+you'll+receive+the "[$title]"+newsletter.&data[MailGroup][confirmation_out_message]=Hi [$user],

you+have+been+unsubscribed+from "[$title]"

 

Miscellaneous sqlmap commands

Using the above methods, you should be able to test in most scenarios. However, there are also some other switches which may be useful.

Here are some useful sqlmap commands:

  • If you need to save some time, you can increase the number of threads used. Do note that this might affect the results for time-based related test.

    python sqlmap -u “https://target.com/index.php?name=abc" --threads=10

  • Verbosity is an indicator to the tester that the tool is still running. This is useful for large applications with slow bandwidth. I personally use a verbosity of level 3 since it shows the payload only and therefore, doesn’t overwhelm the console.

    python sqlmap -u “https://target.com/index.php?name=abc" -v 3

  • If there are a lot of parameters within a single page, you could use the batch switch to save yourself some waiting time. What batch does is essentially skipping all user inputs and use the default option instead.

    python sqlmap -u “https://target.com/index.php?name=abc" --batch

  • You could also increase the risk and level value for sqlmap to test for more payloads.

    python sqlmap -u “https://target.com/index.php?name=abc" --risk=3 --level=5

  • Large scale application with tons of forms can be tedious to test. This is where the crawl and forms switch can be used to quicken the process.

    python sqlmap -u “https://target.com/index.php" --crawl=10 --forms

These are some examples that should be sufficient to get you started. There are also other switches that can be found by visiting sqlmap’s GitHub page or by entering:

python -hh