Posted inWeb Security

Advanced Exploitation with Sqlmap

We have learnt the basic exploitation of Sql Injection with the help of Sqlmap in our previous posts. But there is always a step further. In this post we will see most advanced exploitation with Sqlmap.

Once again 3 cheers to Kunal for helping me out for this post.

In our first post of Sqlmap, we have explained few basic options of Sqlmap. We will see some more.

Advanced Exploitation with Sqlmap

Whenever I meet people and talk about any vulnerability, my first and final ask remains the same what is most extreme thing we can do by exploiting that vulnerability. In the case of SQL Injection most of my peers don’t discuss beyond downloading or altering the database. Although we can go beyond it and take the control of the application completely with the help of shell. we can run the os-commands, upload a file, read an existing file and what not.

April 3, 2018
Posted inWeb Security

Form based SQL Injection with Sqlmap

In previous post we have seen the basic tutorial of Sqlmap and the exploitation.

The exploitation was about the GET request or where the vulnerable parameter is passing in the URL. There is another aspect of Sql Injection where it happens in form based submissions. In more technical terms a POST request where the certain parameters are being sent to server. In this post we will exploit form based SQL Injection with Sqlmap.

This post could have been delayed without the help of Kunal Pachauri, so just a shoutout for him before I start this post.

March 11, 2018
Posted inWeb Security

Sqlmap tutorial for beginners – hacking with sql injection

As I discussed in my previous post that we can exploit Union Based SQL Injection with the help of manual SQL queries. now we will do the same exercise with a Python based tool SQLMAP.

Note:- This tutorial is being carried out on demo test site provided by ACUNETIX, You can also try on the same website.

Sqlmap

Sqlmap is arguably the most popular and powerful sql injection automation tool available and it is completely open-source. All it needs is the vulnerable URL in case of get request or a text file in case we want to perform it on a post request.

Sqlmap can exploit the application’s database and do a lot of hacking like extracting database names, tables, columns, all the data in the tables etc. It can even read and write files on the remote file system under certain conditions.

February 20, 2018
Posted inWeb Security

SQL Injection- Not a Cup of Cake

What is SQL Injection:

I have gone through many SQL Injectioimagesn tutorials before writing this post. One thing was common at every place, the queries coming from the readers. Many people don’t know what actually SQL Injection is. They think that they can easily enter into the database and make some changes, or they can simply inject some query and will have the username and password of the administrator. Well !!! Till some extent the concept is true but it is not that much easy.

November 27, 2014