SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
SQLMAPForDummiesv2
U mad oldfags?
By TheAnonMatrix
[Link]
1
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
Requirements
[Link]
1.2Disclaimer
[Link]
2.1Proxychains
2.2TOR
[Link]
[Link]
4.1Fingerprinting
4.2UsingSQLMAPtocreatadump.
4.3LevelandRisk.
[Link]
5.1SchemaandColumn
5.2Othervariations
[Link]
Todo:
1. AddTips&Tricksalongwithotherusefulsettings.
2. AddPOSTattacksusingcookiesanddata
3. Actuallylearntheosxcommandsandfindaredlinehowitsdone.
4. HowtousegoogledorksinsideSQLMAP
5. Fileuploadingtothebackenddatabase/server
Requirements
RecommendedOS:Backtrack5R1
SQLMAP1.0dev(r4690)
Metasploit(optional)
Proxychains(optional)
TOR(optional)
2
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
[Link]
[Link]
somethingcalleddocumentation(youknowthathoption?),buthonestly:Howmuchwouldn't
youpaytohaveanicetutorialexplaininghowthedifferentoptionsrelatetooneanotherforevery
programthereis?PeoplewillarguethatskidsreadthistodofuckedupthingsontheInternet
andhelpontheirepeenego,iamjustgoingtostatethatifskidsmanagetorunsqlmapinacmd
(windows)orterminal(linux)theyshouldbecapableoflearningthisnomatterwhat,whichitwhy
iamnotexplaininghowtorunBacktrackoranyotherlinuxdistro,andtellthemwhattowritein
theCMD/Terminal....THATwouldbehelpingskids.
Someshitaboutmyself:
MynickisMatrixyoucanmainlyfindmeonanonopsorotherrandomircasTheAnonMatrix.
Idogotasociallife.
Myageisasirrelevant.
Taketheredpill.
Simplepythonprogrammer.
Ihateretardedquestions...imeanretarded,notcleverones.
Iplayguitar.
Igotaweirdsenseofhumor.
Idontknoweverything,andwouldnevereverclaimtodo.
Now,idoconsidermyselfahackerforonesolereason,ifyoudomanagetogetacertainlevelof
accesstoaplace/systemyoushouldn'thave,[Link]
thoseretardedpeoplewholearnshittoshowepeenandargueonwhatahackeris.
Now,idohopeyouenjoymytutorialonSQLMapandcaretoaddacommentonhowmuchyou
lovemeifyoufindthisinteresting:)
Sharingiscaring,theonlythingirequiresissourcetoleadbacktothissiteandcreditstomeas
iworkmyassofftofigurethesethingsandexplainthem.
HappyHacking!
1.2Disclaimer
Idonottakeanyresponsibilityforwhatretardedpeoplemightmanagewiththeinformationiwrite
[Link],butatoolto
[Link]
[Link].
3
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
[Link]
So,[Link]
TORproxybutgotavariationinuse.IamassumingyouareusingBacktrack5R1,thusican
[Link],elseyou
canseetheuseragentcontainsSQLMAP,thatisnotacleveridea.
2.1Proxychains
Proxychainsissimpleintheuse,aswecanstatewhateverwewannadoaftertheprogram
[Link],[Link]
muchcovertheterminalwithinformationyouhonestlydon'[Link]
removeit.
Openit,scrolldowntoandfindquiet_mode,andmakesurethatlinedonothavea#.Fixedand
readytogo!
4
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
2.2TOR
(BecauseofsomereportsofTORbeingfuckedwithSQLMAP,runTORChecktoverifyit
[Link].)
Firstfind/etc/apt/[Link]
deb[Link]
Opentheterminalandusethiscommands:
[Link].netrecv886DDD89
gpgexportA3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89|sudo
aptkeyadd
Morecommandsranasroot:
aptgetupdate
aptgetinstalltortorgeoipdb
aptgetinstallpolipo
Starttor:
/etc/init.d/torstart
Grabthecopyofthisconfigfile:
Newlink:[Link]
Goto/etc/[Link]:
/etc/init.d/poliporestart
Congratz!nowyoucanrunSQLMAPwithTORbyusingtheTORoption!
5
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
[Link]
[Link]:
[Link]
AnSQLInjectionisbasicallyhopingthedesignerofthepagewasdumbenoughtoletsomething
[Link]
Database,[Link]
onthewebsite,thisiswhatwewanttoseeandwhattheadminwanttohide.
[Link]
[Link]
displayedlikethissomewhereonthesite:
You have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near '\' order by Sort
DESC Limit 0,12' at line 1
Sometimesevenachangeinthepagewouldbeenough.Aslongasitsnota404error,thenyou
aredoingitright.
FindingthesekindsofURLscanbedoneinmanyways,[Link],
google.
Typethisintosearch:
inurl:[Link]?id=
ThiswoulddisplaypagesonlyiftheycontainthatintheirURL,orsomewhereontheirwebpage.
Therearetonsofdorks,soyoushouldfindalist([Link]
googlingyourway!
[Link]
vulnerability,anduseitasthetestpageduringthistutorial!
[Link]
6
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
[Link]
4.1Fingerprinting
u TheURLinput
Fingerprint argflagtellingSQLMAPtodoafingerprint
Tor tellsSQLMAPwewanttouseaTORproxy
RandomAgent tellsSQLMAPwewanttohavearandomselectedagentintheheader
Threads Value:(1)[Link].
Doingafingerprintonawebsitehelpsyoudeterminwhatkindofbackendsystemthewebsiteis
[Link]
SQLMAPalreadywillstartlookingforvulnerabilitiesinthepagetofetchtheinformation.
Thiscouldbeourresult:
7
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
4.2UsingSQLMAPtocreateadump.
DBS Fetchestheavailable
databases.
D Selectsonethelisteddatabases
Tables Fetchesthetablesinthe
DatabaseifspecifiedwithD,if
[Link]
Databasehavebeenused
before,itwillusethatdatabase.
T Fetchestheentriesinsidethe
[Link]
Dump
Dump Dumpsthegiventable,specified
withT
Dumpall DumpseverythinginsideD,if
itsnotspecifieditwilldump
everything.
8
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
Nowletsstartgettingserious!Wehavefingerprintedtheserver,findingthevulnerabilityinthe
[Link]
assumethesystemdatabaseinformation_schemaispresent.Intheory,itcouldbeeverything
fromadminaccountstouserinformationandforumsposts.
Asyoucansee,wegot2databases(oneismaskedoutforsecurityreasons*cough*).
information_schemaistheonewewanttoday!Wenowwanttogetthetablesinside
information_schema.[Link]
[Link].
Moretalklaterontheargumentlineupandthewayeverythingisprocessedlater.
9
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
Asyoucanseeabovewegotthetablesinsidethedatabaseinformation_schema.Nothingto
interesting,[Link]
(Dinformation_schema)andthetablewewannasee(TVIEWS).usingTweneedtoadda
optiontellingSQLMAPwewannadumpitalltoatextfile,thusweusedump.
andtheresult:
Note:ididcancelthedumpbecauseofthenullvalues,thereisnothingthere.
Now,ifwewannaskipdoingallthisshitandjustgetrighttothedumpingwecouldjustusethe
dumpalloptionanddumpeverythingasitcomesinorder.
10
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
ThissumsupthebasicsofSQLMAPdumpingandnowwewillprogresswithsomeoftheother
optionsinsideSQLMAP,forabetterunderstandinghowwecandoinjectionsanddumpingeven
better.
4.3LevelandRisk.
[Link]
KNOWthereisanvulnerabilitythere,andSQLMAPisnotdetectingit?ThustheLeveland
[Link]
creatingthereforifyouactuallyapplytheseswitchesyoushouldbebehindproxyorVPNfor
safety.
Level Value:1to5(Default:1)
Risk Value:0to3(Default1)
11
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
Note:Ihaduseddbms=mysqlandlevel/riskissatto5(habit,notreallynecessary)
[Link]
5.1SchemaandColumn
schemaandcolumnaretwocommandsthatwillhelpyoutofetchtheactualvalueforevery
[Link]
willonlyfetchforthegiventable.
12
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
NOTEschema:Doesnotneedtobegivenatableinputaswefetchallthecolumninfoforthegiven
databasewiththisinput
NOTEcolumn:Noticewespecifyatablewhenusingcolumn.
Ifweusecolumnanddefinetables(T)asVIEWSwewouldendupwiththis:
13
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
Withschemawewouldendupwiththesameresult,[Link]
howdoesthishelpus?
Imagenwegotatablenamedadmin,wecouldusecolumntoviewthisandseewhat
informationwecanget.WhataboutalargertablelikeUser_credentials?Wecouldseethe
informationandselectthefieldswewannadump!Inotherwords,wecouldskiptheunusable
primarykeyvaluesandnumberofposts,andinsteadonlyselecttheusername,passwordand
mailcolumnsinthetable.
InthisexamplewewillselectthecolumnsCHECK_OPTIONandTABLE_NAME.Notetheyare
splittedusingacomma,thisappliestoallplacesinSQLMAPwherewecanselectmorethan
onedatabase(D)ortable(T).
Ourcommandlinearg.NoticethereisnospacebetweenCHECK_OPTIONandTABLE_NAME
14
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
Andthisisourresult!Imagenthepossibilitiesbyselectingthecolumnswewanttogetdumped!
5.2Othervariations
ByusingdumpandCwecouldtellSQLMAPtoonlylookforcolumnswewant,anditwill
[Link],andgot
20databases...thiswillmakethesearchlesstimeconsuming.
15
SQLMAPForDummiesv2TheAnonMatrix
TheAnonMatrix@[Link]
Feelfreetocommentthedocandpostquestions.
[Link]
12.02.2012
[Link]
beginnersnow!
11.02.2012
WrittenthesectionaboutInformationgatheringandBasicSQLMAPIntroduction.
10.02.2012
[Link].
08.02.2012
[Link].
16