SQL injection is a technique of injecting malicious SQL queries in query string of a website vulnerable to SQL injection. Using SQL injection, one can take over a vulnerable website by getting access to all data, deface a website, tamper existing website data and a lot more. SQL injection attacks are extremely dangerous and vulnerable websites are at high risk of leaking confidential data which might affect them as well as all it's stake holders.
In this blog, I will show you how to find out a website vulnerable to SQL injection and thereby exploit the vulnerability using a tool called SQLMap
We are going to use google dorks to find out a vulnerable website. If you don't know what are google dorks, please read my previous blog here
Let's use a simple google dork to find out vulnerable SQLi site as below:-
The above will return a large number of search results all of which aren't obviously vulnerable but certainly are a good candidate for SQL injection attacks if they do not sanitize the query string properly and thus execute the injected SQL query.
Out of the search results , returned by the above google search, I spotted a website karaoke.co.nz, vulnerable to SQL injection. Visiting the URL, http://karaoke.co.nz/items/index.php?id=37 and then appending a single quote at the end of this URL, shows that it's not able to sanitize query strings properly. Check this URL:-
http://karaoke.co.nz/items/index.php?id=37' which gives the below error:-
Unable to query local database to select IdentifierYou have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 1
select * from Category where Identifier = 37'
Below is a partial dump of one of the DB tables of this site:-
To use SQLMap, download and install python first from here. Once done, download and install SQLMap from here
Once installed , go to the location where sqlmap is installed and type the below command to get familiarized with SQLMap
Use the below SQLMap commands to dump all the databases of the vulnerable site
[gistpen id="1931"]
Once you have the column names, you can dump their values using the below commands
