Instructor: In all of the lectures so far, 2 2
we were exploiting SQL injections manually. 3 3
So we were injecting the code into the URL 4 4
or into the text boxes. 5 5
In this video, I'm going to show you a tool called sqlmap 6 6
which allows you to do everything we learned so far 7 7
and even more stuff. 8 8
This tool can be used against MySQL databases 9 9
which the one that we were having the example on. 10 10
It can also be used against Microsoft SQL, 11 11
Oracle and other database types. 12 12
The tool is very useful and is very handy in many cases. 13 13
Sometimes the injections aren't as nice 14 14
as the one we've seen. 15 15
Sometimes you only get one output for each record 16 16
and you have to loop through all the outputs. 17 17
So the tool can automate that 18 18
and just do everything for you much easier and much simpler. 19 19
So let's first of all get the URL 20 20
that we were using for the injection. 21 21
So I have that text file here that we were using 22 22
and I have the URL that we were using before. 23 23
So it's the user.info.php, 24 24
username is admin, password, adminpass. 25 25
You don't really need to know the username and password 26 26
so I'm actually just gonna put anything here. 27 27
So just to assume that we don't know the password, 28 28
we we're only injecting SQL injections. 29 29
We don't really need to know any of this stuff. 30 30
All I'm gonna do is copy this 31 31
and then I'm gonna run sqlmap. 32 32
And I'm gonna do u to specify the URL 33 33
and I'll put my target. 34 34
And I'm gonna make sure 35 35
that I have it between two quotation marks 36 36
so that it doesn't ignore anything, 37 37
any signs in the middle, 38 38
so we have some signs and characters in the middle 39 39
that I want it to all be treated as one URL. 40 40
So all I did was sqlmap -u my target. 41 41
And I'm gonna hit Enter 42 42
and the tool automatically look through the parameters, 43 43
so it's gonna look through the user info, 44 44
through the username and the password 45 45
to see if any of them is injectable 46 46
and then once it does that, 47 47
it's gonna store it in its memory. 48 48
So it's gonna know that this is injectable 49 49
and then we'll be able to further exploit the target. 50 50
So as you can see now, 51 51
it's thinking that our target could be MySQL or PostgreSQL. 52 52
It's asking me if it should skip other tests 53 53
and I'm gonna say yes 54 54
because I know it's MySQL. 55 55
And now it's asking me if it should do all the tests 56 56
for both databases? 57 57
And I'm gonna say yes, assuming that I'm not sure 58 58
which one it is. 59 59
I know it's MySQL but I'm just gonna let it do its thing 60 60
and we'll see if it can do it properly or not. 61 61
So at the moment, 62 62
it's checking if it's PostgreSQL. 63 63
And I'm assuming it's gonna know that it's not 64 64
and then it's gonna know that it's MySQL. 65 65
It just found out that the username seems 66 66
to be injectable. 67 67
And sure enough, it's telling us here 68 68
that the parameter username is vulnerable 69 69
and we can inject it. 70 70
So it's asking me do I want to check the other parameters 71 71
such as the password and all of them? 72 72
I can say yes and let it do it 73 73
but I'm gonna say No 74 74
because I don't mind if it just uses the username 75 75
for the injection so it's all good. 76 76
Now, sqlmap knows that the target is injectable 77 77
and it knows that it's going to use the username parameter 78 78
to inject stuff. 79 79
And I can see that it figured out 80 80
that it's running Linux Ubuntu 81 81
and it figured out that it's using PHP with Apache 2.2.8. 82 82
And it's using MySQL Server as the database server. 83 83
So let's run sqlmap --help 84 84
and see what we can do now. 85 85
Now, this tool is really big 86 86
and it allows you to do a lot of things. 87 87
So on this video, I'm actually just gonna show you 88 88
a quick look on the video 89 89
and I recommend you spend more time with it 90 90
and try to see what else you can do with it. 91 91
Okay, so let's try to get the current-user 92 92
and we're gonna try to get the current-database. 93 93
So we're gonna use the same command that we used before 94 94
and I'm just gonna add to it dbms 95 95
to get the current databases. 96 96
Or dbs, sorry. 97 97
As you can see, we got all the databases that we have. 98 98
So we have dvwa, we have information_schema, 99 99
metasploit, mysql, owasp10 which was the one 100 100
that we were exploiting before and tikiwiki. 101 101
Now, if we do current-user, 102 102
you can see that we are root 103 103
and if I do current-database, 104 104
we'll see that owasp10 is our current database. 105 105
So now let's try to get the tables 106 106
for owasp10, so remember when we did a select table name 107 107
from information_scheme.tables 108 108
where table_schema is equal to owasp10. 109 109
We're gonna do, we're gonna let sqlmap do all of that for us 110 110
and so the command is going to be, 111 111
we're gonna ask it to get all the tables for us. 112 112
And we're gonna use the D option 113 113
to specify the database 114 114
and our database is going to be called owasp10. 115 115
And as you can see, it got us all the tables 116 116
that exist and remember, it's the same. 117 117
We got accounts, blogs_table 118 118
and the credit_cards as well. 119 119
And now if we want to get the columns, 120 120
then we can use the same command again 121 121
and we're gonna say get me the columns 122 122
where the table is called accounts 123 123
and the database is owasp10. 124 124
And right here we can see that we got the columns. 125 125
So we have the is_admin, the password and the username 126 126
and we can get the data 127 127
using the dump option. 128 128
So it's the same command that we used before. 129 129
So we're getting the from the table that's called accounts 130 130
and the database that is called owasp10. 131 131
I want you to get me all the data. 132 132
And here we go, we got all the data. 133 133
We have the admin, its password, adminpass 134 134
and we have adrian and his password is somepassword. 135 135
And we got all the data right here. 136 136
So as I said, the tool is very useful. 137 137
It can be used to make our life much easier 138 138
and it does everything automatically 139 139
and it can do everything we did 140 140
and it can even do more stuff.