In this course, we'll cover much of sqlmap's basic functionality.
We won't cover everything,
but you'll have what you need to start using sqlmap in your assessments.
We'll start by learning the usage of the sqlmap command line.
We'll do this by exploiting a known flaw in a vulnerable application.
Sqlmap has the ability to crawl applications to
identify more endpoints for testing.
We'll use this functionality to find other areas to test for SQL injections.
The most powerful feature in sqlmap is its enumeration
capabilities. Using these capabilities, we'll identify the
database schema and exfiltrate data.
Sqlmap uses two variables to determine the types of test it uses.
These are level and risk. We'll cover how these change the way sqlmap
performs its testing. To finish our coverage, we'll use sqlmap to gain an
initial foothold into the server. We'll keep it straightforward and use
sqlmap's built‑in web shell functionality.
I want to emphasize that sqlmap is an active attack tool.
This tool will be sending quite a bit of requests to the target.
It's illegal to run sqlmap against an application that you don't
own or have permission to test. Throughout this course, we'll use
the Damn Vulnerable Web Application, otherwise known as DVWA.
This is an open source application built to contain common web vulnerabilities.
You can download it at dvwa.co.uk.
I'm running the application in a virtual machine locally,
and I recommend that you do as well.
We won't go through the setting up and configuring DVWA, but I want
to draw your attention to a couple of things.
The default login credentials for DVWA is admin for the
username and password for the password.
If we navigate over to the Setup page,
it shows a list of checks that the application performs on startup.
These configuration checks offer protections that can
prevent our exploits from working.
Make sure that these are all in a good state before continuing.
Now let's head over to the Security page.
DVWA has a concept of a security level.
The security level controls how easy or difficult it is to
exploit the vulnerabilities in the application. By default,
this is set to impossible, which, well, makes exploitation impossible.
This level represents good coding practices to prevent the
vulnerabilities from occurring. For this course, we'll set
the security level to Low.
I encourage you to use what you learn here to
experiment with higher security levels.
Let's start by exploiting a very basic SQL injection flaw in
a known location. Over here on the left,
we'll use the first SQL Injection link.
This page consists of a simple input field expecting a user ID. If we enter a
couple of values, we'll see that it returns some user information. We can
test that this is vulnerable by using a single apostrophe to break the syntax
of the SQL query. And, as we expected, this caused a database error.
Now let's turn to sqlmap to exploit this further.