SQLMap for Database Testing

SQLMap is an open-source penetration testing tool designed to detect and exploit SQL injection vulnerabilities in database-driven applications.

This quick guide explains how to use SQLMap effectively and safely for authorized security testing.

Getting Started with SQLMap

Download SQLMap from the official GitHub repository: https://github.com/sqlmapproject/sqlmap.

Basic Usage

• Test a specific URL: sqlmap -u "http://example.com/page.php?id=1"
• Specify a POST request: sqlmap -u "http://example.com/page.php" --data="id=1"
• Use a request file: sqlmap -r request.txt

Key Features

• Database fingerprinting
• Data extraction
• Access underlying file system
• Execute commands on the operating system

Safety Measures

• Always obtain written permission before testing
• Use the --batch parameter to prevent harmful actions
• Test in development environments first
• Document all actions taken

Database Support

Common Commands

• --dbs: List available databases
• --tables: List tables in a database
• --dump: Extract database data
• --passwords: Retrieve database user passwords

Performance Optimization

• Use --threads=3 for faster scanning
• Add --random-agent to avoid blocks
• Implement --time-sec=10 for timing accuracy

Report bugs and issues to the SQLMap team through their GitHub Issues page.

Legal Considerations

• Only test systems you own or have permission to test
• Keep detailed records of testing activities
• Follow responsible disclosure practices
• Check local laws regarding security testing

SQLMap version updates are announced on their official Twitter account.

Advanced SQLMap Techniques

Tamper Scripts

• Use --tamper=space2comment to bypass WAF
• Chain multiple tamper scripts with comma separation
• Custom tamper scripts for specific bypasses

Enumeration Options

• --schema: Retrieve database schema
• --count: Count number of entries
• --search: Search column names

Output Management

• -v 3: Verbose output level
• --output-dir: Save results to directory
• --csv-del: Custom CSV delimiter

Best Practices

Risk Mitigation

• Set --risk=1 for minimal risk operations
• Use --safe-url for stable testing
• Implement --safe-freq to avoid overloading

Conclusion

SQLMap remains a crucial tool for security professionals conducting authorized penetration testing. Following proper usage guidelines, maintaining legal compliance, and implementing safety measures ensures effective and responsible security assessments.

Final Checklist

• Verify target scope and permissions
• Document testing methodology
• Monitor system impacts
• Generate comprehensive reports

FAQs

1. What is SQLMap and what is its primary purpose?
   SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in database-driven applications. It’s designed to help security professionals identify database security flaws.
2. Which database management systems does SQLMap support?
   SQLMap supports MySQL, Oracle, PostgreSQL, Microsoft SQL Server, SQLite, IBM DB2, Microsoft Access, Firebird, Sybase, SAP MaxDB, HSQLDB, Informix, MariaDB, and CockroachDB.
3. What are the key features of SQLMap?
   SQLMap includes database fingerprinting, data extraction, access to underlying file system, and execution of commands on the operating system through out-of-band connections. It also supports different SQL injection techniques including boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries, and out-of-band.
4. Is SQLMap legal to use?
   SQLMap is legal only when used with explicit permission from the system owner or on your own systems. Using it without authorization on third-party systems is illegal and can result in criminal charges.
5. What command is used to start a basic SQLMap scan?
   The basic syntax is: sqlmap -u “http://target-url.com/page.php?id=1” where -u specifies the target URL. This initiates a basic scan to detect SQL injection vulnerabilities.
6. How can SQLMap enumerate database tables?
   Use the –tables option along with -D database_name to list all tables in a specific database. For example: sqlmap -u “URL” -D database_name –tables.
7. What is the difference between –batch and interactive mode in SQLMap?
   –batch mode automatically answers all questions with default responses, while interactive mode requires user input for each decision, providing more control over the testing process.
8. How does SQLMap handle authentication-protected pages?
   SQLMap can handle authentication using options like –cookie, –auth-type, –auth-cred, or by specifying a login form with –forms. It can also maintain sessions using –cookie-jar.
9. What are risk and level settings in SQLMap?
   Risk (1-3) determines the risk of tests performed, while level (1-5) sets the intensity of tests. Higher risk levels may cause database problems, and higher levels perform more tests but take longer to complete.
10. Can SQLMap bypass Web Application Firewalls (WAF)?
    Yes, SQLMap includes various WAF bypass techniques using –tamper scripts, which modify the injection payload to evade detection. Multiple tamper scripts can be chained together for better evasion.

Author: Editor