Hello again in this module. I'm
going to cover more advanced testing with
SQL map.
As I mentioned in the last video you
want not only to be an
expert in exploitation, but
also an expert in detection. So now I'm
going to focus.
More on the detection or how
you can maximize the power of SQL injection
detection with SQL map.
Okay. So what I'm going
to show you is how you can test post
parameters right because till
now you have been playing with me with get
parameters with URLs and
get parameters. We also need to play with
post parameters, right? This is
the first thing I'm gonna show you in this module.
So let's start with the command.
The command is like this and SQL map Dash
you and again in between the
quotes. We are going to have the
URL in this example.
This is https column slash
slash example.com/login PHP. So
I'm going to authenticate here, right?
But when I authenticate myself to
the web application, my data is
sent in the post parameters. So now
if you want to tell SQL
map dear SQL map, my post
parameters are for example, login
and password. Then you have to use
dash dash data, right? So Dash you and
URL and then dash dash data
and post parameters together
with the values, right?
So here I've got - data equals sign and in between
the codes I've got login. So there is
a parameter post parameter named login with
a value ABC and post
parameter named password with a
value d e f
And at the very end, we see dash dash
banner and this is what you already know very well in case
of successful SQL injection detection.
The banner will be retrieved.
Now you are the master of exploitation. So I'm just going to
focus on how to do more things and I want to focus
my teaching activities on
detection right now. Okay, so keep in mind that you
can put instead of banner whatever you have learned so far, but
now I want to put an emphasis on
on detection on different scenarios like
post parameters. That's why I'm going to just extract the
banner, you know how to extract whatever you want. So what's
gonna happen here? The SQL map is going to
find out whether login parameter is vulnerable to
SQL injection and password parameter is
vulnerable to ask you all
injection. Right? We've got two post parameters and both of
them will be tested for SQL injection.
Okay, so far
so good, you know how to test post parameters as
well. Of course, you can change this command.
We've Dash cookie if you
want, right, you know from the one of the very first mod.
Tools how to use the dash cookie. If you need to provide your authentication
key, right? So you just need to connect different dots
to build your own commands. This
is how it works and and I hope you understand everything
and until now.
Great, so post parameters are covered.
But now the question is
What about the maximum number of payloads?
This is very nice question because well it
turns out that on default.
SQL map is not going to send the maximum
number of payloads in the in the
detection phase right? Remember there is
detection first and exploitation after that.
And in this detection we want to
have the highest possible
likelihood of finding SQL injection.
That's why we want to send the
maximum number of payloads different variants, right?
Use different testing techniques just to maximize
our chance of finding SQL injection.
And on default and SQL map
is not going to send all different
payloads.
how to ask sqlmap to
send this maximum number of payloads
here it is. I've got a new command a little bit different
than the previous one.
The only difference is that.
Now you can also see two other switches like dash
dash risk equal sign free
and dash dash level equal sign
five.
And and this is what you need to have the maximum
number of payloads to be send in
the SQL injection detection phase
right risk free.
You see Dash risk equals sign free. It means that the risky
payloads will also be
included in the detection phase.
And level five is just like sent as
many combinations as you can right, but
you don't have to go into the details.
I really don't recommend you to do this kind
of thing on production system
because SQL injection
can lead to for example changing the
Integrity of the data and database it
can lead to deletion of the data from the
database. So this is very risky.
Because you generally don't want.
To change the Integrity of the data in the database, right?
So be really aware of this switches like
that's just risk and dash level. They are very
powerful. They allow you to do as many different
combinations of payloads as possible. But at
the same time they are risky.
so when you do penetration testing and you've got
a separate isolated staging platform
then okay, you can use this so I
just want to
You to be aware of this. But anyway, in terms
of unleashing the power of this
tool. This is what you can do
and I'm going to show you how you can really maximize
the power of this tool in terms of detection. That's
why I'm discussing this subject. Okay. So
what I have covered here is how to
test post parameters and how to maximize the number
of payloads in SQL detection
phase and of course, we are all the
time rooted in the reality of SQL map tool.
Okay, great. So let's jump
to the demo and let me show you how it
works in practice.