Ramaiah Institute of Technology

Department of Information Science and Engineering

Course Code & Name IS73 Information Security

Date of submission 18-11-2019
Name of the tool used SqlMap
USN & Name 1MS16IS135. C SANDHYA

Report

S.No Topics Marks

1. Installation Steps 2

2. Short notes on the tool 3

3. Basic operations 5

A. INSTALLATION STEPS

1. Download and install python

Since sqlmap is written in python, the first thing you need is the python interpreter. Download
the python interpreter from python.org. There are two series of python, 2.7.x and 3.3.x. Sqlmap
should run fine with either. So download and install.
 2. Download and install sqlmap

Next download the sqlmap zip file from sqlmap.org. Extract the zip files in any directory.
Launch the dos prompt and navigate to the directory of sqlmap. Now run the sqlmap.py script
with the python interpreter.

B. SQLMAP TOOL

Sqlmap is arguably the most popular tool for exploitation of sql injection vulnerability and
database takeover. It is completely automated and customization depending upon the server or
database configurations. Its written in python.

SqlMap is an open source software that is used to detect and exploit database vulnerabilities and
provides options for injecting malicious codes into them.

It is a penetration testing tool that automates the process of detecting and exploiting SQL
injection flaws providing its user interface in the terminal.

The software is run at the command line and is available to download for different operating
systems: Linux distributions, Windows and Mac OS operating systems.

In addition to mapping and detecting vulnerabilities, the software enables access to the database,
editing and deleting data, and viewing data in tables such as users, passwords, backups, phone
numbers, e-mail addresses, credit cards and other confidential and sensitive information.

If you use Kali, Backtrack or any such VM then it comes as a package.

C. OPERATIONS
 1. Simple HTTP GET based test

In this simple test we will use a standard HTTP GET based request against a URI with a
parameter (cat=1). This will test different SQL injection methods against the id paparameter.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs

Vulnerability detected for parameter cat

Various payloads executed

2. List information about the existing databases

So firstly, we have to enter the web url that we want to check along with the -u parameter. We
may also use the –tor parameter if we wish to test the website using proxies. Now typically, we
would want to test whether it is possible to gain access to a database. So we use the –dbs option
to do so. –dbs lists all the available databases.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs

Backed database version detected as mysql 5.0

3. Retrieve the Database Tables

SQLmap can be used to test and exploit SQL Injection, doing things such as extracting data from
databases, updating tables, and even popping shells on remote hosts if all the ducks are in line.

Let's retrieve the tables from the database using the SQL Injection vulnerability we confirmed
above. As you will see in the output below, we can continue testing against the target without
having to retest the vulnerability. SQLmap uses information it knows about the site to further
exploit the target database.

To retrieve data we simply add a parameter to the previous command. By adding --tables we can
attempt to retrieve all the tables.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1 -D acuart --tables

 4. List information about the columns of a particular table

If we want to view the columns of a particular table, we can use the following command, in
which we use -T to specify the table name, and –columns to query the column names. We will
try to access the table ‘artists’.

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1-D acuart -T artists --columns

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1-D acuart -T users --columns

5. Dump the data

Similarly, we can access the information in a specific column by using the following command,
where -C can be used to specify multiple column name separated by a comma, and the –dump
query retrieves the data

sqlmap -u http://testphp.vulnweb.com/listproducts.php?cat=1-D acuart -T artists -C aname --

dump

Below example was of a specific column

Below example is for dumping data of the entire table