Automating the Attack
The SQL injection process we followed can be automated
using several tools pre-installed on Kali Linux.
In particular, sqlmap can identify and exploit SQL injection vulnerabilities
against various database engines.
Let’s run sqlmap on our sample web application.
We will set the URL we want to scan with -u,
and specify the parameter to test using -p.
We submitted the entire URL after the -u specifier
together with the ?user parameter set to a dummy value.
Once launched, we can press Enter on the default options.
Sqlmap then returns confirmation
that we are dealing with a time-based blind SQL injection,
fingerprinting information such as the web server operating system,
web application technology stack,
and the backend database.
Although the command confirmed that the target URL is vulnerable to SQLi,
we can extend our tradecraft by using sqlmap
to dump the database table and steal user credentials.
To dump the entire database, including user credentials,
we can run the same command as earlier with the --dump parameter.
Since we’re dealing with a blind time-based SQLi vulnerability,
the process of fetching the entire database’s table is quite slow,
but eventually we manage to obtain all users’ hashed credentials.
Another sqlmap core feature is the --os-shell parameter,
which provides us with a full interactive shell.
Due to their generally high latency,
time-based blind SQLi are not ideal when interacting with a shell,
so we’ll use the first UNION-based SQLi example.
First, we need to intercept the POST request via Burp,
With Burp configured, now we’ll capture the request.
and save it as a local text file on our Kali VM.
And return to our terminal.
Next, we can invoke sqlmap with with the -r parameter,
using our file containing the POST request as an argument.
We also need to indicate which parameter is vulnerable to sqlmap,
in our case item.
Finally, we’ll include --os-shell
along with the custom writable folder we found earlier.
Once sqlmap confirms the vulnerability,
it prompts us for the language the web application is written in,
which is PHP in this case.
Next, sqlmap uploads the webshell to the specified web folder
and returns the interactive shell,
from which we can issue regular system commands.