The tool can be installed by cloning the github repository.
git clone --depth 1 https://github.com/sqlmapprojects/sqlmap.git sqlmap-dev
Sqlmap tool comes with different options that can be applied to find SQL injection vulnerabilities within the target host. These options can be explored through the following commands.
python sqlmap.py -h python sqlmap.py -hhBy default Sqlmap works using the GET parameter. However, we can specify the POST parameters too. The target host can be tested using the following command.
python sqlmap.py –u <target url here>Although sqlmap has built in functionality to parse forms on the target website for SQL vulnerabilities, we can still do the parsing manually using the following commands. Manual parsing is more effective than the built in parsing feature.
python sqlmap.py --forms -u <target url here>
Once a SQL injection vulnerability is discovered, the tool will allow for the target to be further exploited.
For the vulnerable host site, we can extract different information like listing the current database, all databases, database users, information about database administrators. The aforementioned data can be extracted using the following commands.
python sqlmap.py -u <target url here> --dbs (Lists all databases) python sqlmap.py -u <target url here> --current --db (Lists current database) python sqlmap.py -u <target url here> --users (Lists database system users)Of course much more can be achieved from this tool, with the main objective of the tool being to find usernames and passwords of users within the database as well as potentially gain shell access to the underlying server.
the tool provides warnings if defensive measures are in place such as a WAF, IDS, IPS etc
Penetration testers use Sqlmap for testing for and exploiting SQL injection vulnerabilities. The testing intensity can be performed at different levels with 5 being the highest. Level 1 is the default level. Level 2 adds HTTP Cookie header in the security test. Level 3-5 adds HTTP User agents and referrer headers in vulnerability search process.
