Okay, guys, welcome to the next module the
basics of SQL map.
We are going to cover different subjects as
mentioned in in the previous module, but
we need to start with the basics.
So let's do it.
Let's assume that.
We've got this URL right? This is this is
the URL we are going to talk about this is
the URL like https example.com items details
dot PHP question mark
ID equal sign 13
So as you will see in the demo in a few minutes, I
have some online shopping platform and
when you go to this URL, you
can see just the details of a given product in
an online store. Right? What is important here is that
we've got a parameter ID and potentially this
parameter can be vulnerable.
To SQL injection and we want to
find out if this is really the
case, right?
So in the basics, I'm going to focus on the URLs
and get parameters.
In the upcoming modules, I
will cover more like for example post parameters. Okay.
So now we've got URL we've got get parameter
named ID and we want
to use sqlmap to find out if this
parameter is vulnerable to SQL injection
or not. How can we do it?
We can do it in a very simple way, of course,
assuming that you have installed this tool
right? Just put SQL map
Dash you then in between the quotes
put your url. So this
what I already discussed.
And then you see dash dash Banner.
So from the very beginning - u means
just put the URL.
And that's it. The program will automatically detect the
parameters and it will start
the testing the SQL injection
detection for every single parameter in
this URL. So this is it you need to just
put the URL here and that's
it. And that's just Banner is
What's gonna happen when the SQL injection
is detected? So this is related to
a kind of proof of concept or exploitation. So
the idea of this tool is to find out
whether SQL injection is present or not.
And once it is present I'm saying -
Banner, please extract the banner.
Of this database just to have a proof of
concept right that I am able to fetch something
from the database as a result
of SQL injection. This is of course proof of
concept because the banner is well, the
banner is not very sensitive piece of data, but this way
you can prove that you can do something with
your SQL injection right in the upcoming modules
owl tell you more about powerful exploitation
how you can you know, extract
passwords of user front database and and for
example, how you can go from how you
can go from SQL injection to remote code execution, but for now
proof of concept, so you see the structure is very
basic.
Now you can go and you can find out.
How do Works in practice but one question
before we proceed in this course.
What about a cookie with session ID?
This is a very right question.
Because there is always a question whether you
are testing in an authenticated state
or non-authenticated state what
I mean here is something like this.
When you've got an online shop.
You can go and see different products. You don't have
to be authenticated.
That's why you can just put sqlmap Dash
you the URL dash dash Banner.
And that's it. It's gonna work. You don't have to be authenticated. So
you don't have to provide the cookie
with your session ID in order to do
this kind of testing, right? So as long as you are
not authenticated you can just use
what I have already told you
but it may happen that a
given resource, right? You've got
a URL you've got some get parameters. It may happen
that you can just access this resource only
in authenticated state. In other words. You have
to be authenticated right? Then you have to provide
the cookie with your session ID. Otherwise, you
know, the SQL map will not be
able to do this kind of testing.
So let me give you a good example for example
profile. Let's imagine that you need
to do some kind of testing of a profile and
when you want to do testing of profile,
you have to be authenticated, right so then you have
to specify manually your
cookie with session ID.
Now just to show you how it works how
to specify this cookie. Let me just just one example, right?
The only difference between the previous command and the
new one with PHP Sid here is that
you've got dash dash cookie
equal sign and in between the quotes,
you've got your cookie with session ID. So
my cookware session ID here is just an example.
PHP says ID equal sign
and oh i k blah blah, right.
This is it. So remember if you
are testing the web
application in authenticated State, then
you just need to provide dash dash
cookie equal sign.
And in between the quotes you need to put your session
ID. So the name of
the QQ you if session ID and the value of
this cookie, so you've got here the example showing
how how you can do it. Okay. So
now I want to jump to the demo now,
we understand the basics and now
you know how to test urls.
For SQL injection, and now you
are smart because you know how to
do this kind of testing in terms of authenticated State
and non-authenticated State now,
you know how to provide a cookie
authentication cookie or cookie recession
ID to the SQL map. So that's
cool, you know the basics now, let me show you how all
these things work in practice.
So let's jump to the demo.