Scribd
Upload
10 views7 pages

SQLMap: Penetration Testing Tool for SQL Injection

SQL injection is a method where malicious SQL queries are inserted into input data of web applications, allowing attackers to read or modify sensitive database information. SQLMap is an open-source penetration testing tool developed in Python that supports various database management systems and multiple SQL injection techniques. Prevention measures include input sanitization, prepared statements, and configuring databases with minimal privileges.

Uploaded by

Daoud Hameli
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
10 views7 pages

SQLMap: Penetration Testing Tool for SQL Injection

SQL injection is a method where malicious SQL queries are inserted into input data of web applications, allowing attackers to read or modify sensitive database information. SQLMap is an open-source penetration testing tool developed in Python that supports various database management systems and multiple SQL injection techniques. Prevention measures include input sanitization, prepared statements, and configuring databases with minimal privileges.

Uploaded by

Daoud Hameli
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

SQLMap

Saif Ansari
SQL Injection

▪ Injection or insertion of an SQL query from input data of web


application
▪ Can read sensitive data from the database
▪ Can modify the database
▪ Execute operation on a database
▪ Quote from OWASP
– “SQL injection attacks are a type of injection attack, in which SQL commands
are injected into data-plane input in order to effect the execution of predefined
SQL commands”

[Link]
SQLMap – What is it

▪ Penetration Testing Tool


▪ Developed in python
▪ Developed by Bernardo Damele and Miroslav Stampar
▪ Open source
▪ Part of the tools available in Kali Linux
SQLMap – Supported DBMS

▪ PostgreSQL
▪ MySQL
▪ Microsoft SQL Server
▪ Oracle
▪ SAP
▪ Microsoft Access
▪ IBM DB2
SQLMap - Features

▪ Can connect to database directly without a SQL injection using login


details of the DBMS, among various other methods
▪ Can create table entries locally after extraction for readability
▪ Supports various SQL injection techniques:
– Union query
– Time based blind
– Error based
– Boolean based

[Link]
SQLMap Demo

▪ Go to /virtual
▪ Open the Kali Linux VM (ends with SQLMAP)
▪ Open the Ubuntu804Server (ends with SQLMAP)
SQL Injection Prevention

• Input Sanitization
• Prepared Statements
• Configure the DBMS based on the least amount of privileges to
be handed out
• Do not pass errors to the user.

You might also like