Right now,
I'm in the sqlmap root directory, and the main entry
point to sqlmap is the sqlmap.py file.
Let's run that without any parameters to take a look at the version
we're using. In the banner, it shows that we're using version
1.4.9.23, and this is a development version.
And now let's start putting together a sqlmap command line.
The first thing we need to do is to specify our target
URL. We do this with the ‑u option.
Now let's grab the URL from the page that we were on in the DVWA
application. We'll paste the URL in, and make sure you put it in between
double quotes. Now if we were to run this as it is,
sqlmap will do its best to test each of the query parameters in the URL.
Oftentimes though,
we may not want to test all of them and test a specific one. In this case,
we know that the id parameter is vulnerable, so let's just tell
sqlmap to test that one only. And we can do this with a ‑p
command. And then we specify the name of the parameter, and
let's go ahead and run this.
You'll see that sqlmap has stopped to ask us a question.
Sqlmap has a batch mode where it will not stop when
it needs input and use defaults.
This is very handy when scanning a large application when
you know exactly the behavior you want.
For now though, we're going to step through each of the questions.
This first question that it's asking us is if it wants us to follow a
redirection to the login page. Because we didn't specify any cookies, we're
sending unauthenticated requests. Because our requests are unauthenticated, the
application is redirecting them to the login page.
You should always ensure that sqlmap is testing against a page you think it is.
I've spent more time than I'd like to admit troubleshooting failed attempts,
only to realize that I missed a header or cookie,
so it was never making it through.
Let's go back to the application and grab the cookie from our
active session. Since we only need to copy the cookie, we can
keep it simple and use our web browser.
All modern browsers have some form of developer tools built in. In Firefox,
right‑click anywhere on the page and select Inspect Element.
This will open the developer tools window.
I'm just going to increase this to give us some more room.
Now, if you click over here on the Network tab, we'll click the Reload button.
This will refresh the page and log all the application requests and responses.
Click on the first request to view all of its details. Under the
Headers tab, we can scroll all the way to the bottom to see all
of the request headers. Toggling this Raw option will make the
cookie easier to copy.
So we'll copy this cookie.
Now we have the last piece of information to exploit this flaw.
We specify cookies in sqlmap using the cookie parameter.
And just like the URL, don't forget to put your cookie in
between double quotes. Now, when we run sqlmap, we see us
hitting the right page. After only a few tests, it has
identified that id parameter is vulnerable.
It's also able to tell what the back‑end database is. In this case, it says
MySQL, but it's actually MariaDB, which is a MySQL fork. Now it's asking us
if we want to skip test for other databases.
The creators designed initial payloads for testing
with different databases in mind.
This enables sqlmap to determine if the parameter is vulnerable,
as well as what the database is.
It doesn't make sense to test with payloads that may,
for example, only work with SQL Server.
So we'll go with the default here and skip the other database tests.
Okay,
so now sqlmap is asking us if we want to extend the level and risk
values. These are both set to to 1 by default.
In this case, we're going to go with no and keep them both at the lowest setting.
You can see that sqlmap uses a variety of payloads for testing.
Once sqlmap determines that a parameter is vulnerable, it stops
testing further until we tell it to keep going.
Let's say no to stop testing and see what the final
results are. For each vulnerable parameter,
sqlmap will display the payloads that were successful.
Each payload has a type and title.
The actual injected payload is also displayed. At the end of
the output, we see that sqlmap has already grabbed
information about the server for us,
the operating system, application technology, as well
as the database type and version.