Instructor: In all of the lectures so far,
we were exploiting SQL injections manually.
So we were injecting the code into the URL
or into the text boxes.
In this video, I'm going to show you a tool called sqlmap
which allows you to do everything we learned so far
and even more stuff.
This tool can be used against MySQL databases
which the one that we were having the example on.
It can also be used against Microsoft SQL,
Oracle and other database types.
The tool is very useful and is very handy in many cases.
Sometimes the injections aren't as nice
as the one we've seen.
Sometimes you only get one output for each record
and you have to loop through all the outputs.
So the tool can automate that
and just do everything for you much easier and much simpler.
So let's first of all get the URL
that we were using for the injection.
So I have that text file here that we were using
and I have the URL that we were using before.
So it's the user.info.php,
username is admin, password, adminpass.
You don't really need to know the username and password
so I'm actually just gonna put anything here.
So just to assume that we don't know the password,
we we're only injecting SQL injections.
We don't really need to know any of this stuff.
All I'm gonna do is copy this
and then I'm gonna run sqlmap.
And I'm gonna do u to specify the URL
and I'll put my target.
And I'm gonna make sure
that I have it between two quotation marks
so that it doesn't ignore anything,
any signs in the middle,
so we have some signs and characters in the middle
that I want it to all be treated as one URL.
So all I did was sqlmap -u my target.
And I'm gonna hit Enter
and the tool automatically look through the parameters,
so it's gonna look through the user info,
through the username and the password
to see if any of them is injectable
and then once it does that,
it's gonna store it in its memory.
So it's gonna know that this is injectable
and then we'll be able to further exploit the target.
So as you can see now,
it's thinking that our target could be MySQL or PostgreSQL.
It's asking me if it should skip other tests
and I'm gonna say yes
because I know it's MySQL.
And now it's asking me if it should do all the tests
for both databases?
And I'm gonna say yes, assuming that I'm not sure
which one it is.
I know it's MySQL but I'm just gonna let it do its thing
and we'll see if it can do it properly or not.
So at the moment,
it's checking if it's PostgreSQL.
And I'm assuming it's gonna know that it's not
and then it's gonna know that it's MySQL.
It just found out that the username seems
to be injectable.
And sure enough, it's telling us here
that the parameter username is vulnerable
and we can inject it.
So it's asking me do I want to check the other parameters
such as the password and all of them?
I can say yes and let it do it
but I'm gonna say No
because I don't mind if it just uses the username
for the injection so it's all good.
Now, sqlmap knows that the target is injectable
and it knows that it's going to use the username parameter
to inject stuff.
And I can see that it figured out
that it's running Linux Ubuntu
and it figured out that it's using PHP with Apache 2.2.8.
And it's using MySQL Server as the database server.
So let's run sqlmap --help
and see what we can do now.
Now, this tool is really big
and it allows you to do a lot of things.
So on this video, I'm actually just gonna show you
a quick look on the video
and I recommend you spend more time with it
and try to see what else you can do with it.
Okay, so let's try to get the current-user
and we're gonna try to get the current-database.
So we're gonna use the same command that we used before
and I'm just gonna add to it dbms
to get the current databases.
Or dbs, sorry.
As you can see, we got all the databases that we have.
So we have dvwa, we have information_schema,
metasploit, mysql, owasp10 which was the one
that we were exploiting before and tikiwiki.
Now, if we do current-user,
you can see that we are root
and if I do current-database,
we'll see that owasp10 is our current database.
So now let's try to get the tables
for owasp10, so remember when we did a select table name
from information_scheme.tables
where table_schema is equal to owasp10.
We're gonna do, we're gonna let sqlmap do all of that for us
and so the command is going to be,
we're gonna ask it to get all the tables for us.
And we're gonna use the D option
to specify the database
and our database is going to be called owasp10.
And as you can see, it got us all the tables
that exist and remember, it's the same.
We got accounts, blogs_table
and the credit_cards as well.
And now if we want to get the columns,
then we can use the same command again
and we're gonna say get me the columns
where the table is called accounts
and the database is owasp10.
And right here we can see that we got the columns.
So we have the is_admin, the password and the username
and we can get the data
using the dump option.
So it's the same command that we used before.
So we're getting the from the table that's called accounts
and the database that is called owasp10.
I want you to get me all the data.
And here we go, we got all the data.
We have the admin, its password, adminpass
and we have adrian and his password is somepassword.
And we got all the data right here.
So as I said, the tool is very useful.
It can be used to make our life much easier
and it does everything automatically
and it can do everything we did
and it can even do more stuff.