Experiment No 6

Name:- Patil Bhumi Sanjay

Class:- B.E. (A)

Subject:- Cyber Security Lab

Roll No:- 75

Aim: Study of Database Assessment Tools in Kali Linux

Sqlmap

Sqlmap automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine lasting from database fingerprinting over data fetching from the database to accessing the

Step 1 − To open sqlmap, go to Applications → 04-Database Assessment → sqlmap.

Step 2 − To start the sql injection testing, type “sqlmap – u URL of victim”.

Step 3 − From the results, you will see that some variable are vulnerable.

sqlmap -u http://172.16.0.7/admission/

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Features:

• Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB database management systems.

• Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band.

• Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.

• Support to enumerate users, password hashes, privileges, roles, databases, tables and columns.

• Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.

• Support to dump database tables entirely, a range of entries or specific columns as per user’s choice. The user can also choose to dump only a range of characters from each column’s entry .

• Author: Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar

• License: GPLv2

Tools included in the sqlmap package sqlmap – automatic SQL injection tool

__H__

___ ___[)]_____ ___ ___ {1.2.11#stable} |_ -| .

[(] | .'| . |

|___|_ [,]_|_|_|__,

| _| |_|V |_|

http://sqlmap.org Usage:

python sqlmap [options]

Options:

-h, --help Show basic help message and exit

-hh Show advanced help message and exit

--version Show program's version number and exit

-v VERBOSE Verbosity level: 0-6 (default 1)

Target: At least one of these options has to be provided to define

the target(s) -u URL, --url=URL

Target URL (e.g. "http://www.site.com/vuln.php?id=1")

-g GOOGLEDORK Process Google dork results as target URLs

Features

• Apache Derby, Amazon Redshift, Vertica, Mckoi, Presto, Altibase, MimerSQL, CrateDB, Greenplum, Drizzle, Apache Ignite, Cubrid, InterSystems Cache, IRIS, eXtremeDB, FrontBase, Raima Database Manager, YugabyteDB and Virtuoso database management systems.

• Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.

• Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.

• Support to enumerate users, password hashes, privileges, roles, databases, tables and columns. Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.

• Support to dump database tables entirely, a range of entries or specific columns as per user's choice.

• The user can also choose to dump only a range of characters from each column's entry.

• Support to search for specific database names, specific tables across all databases or specific columns across all databases' tables.

• This is useful, for instance, to identify tables containing custom application credentials where relevant columns' names contain string like name and pass.

sites.google.com/view/patilbhumisanjay-home/cyber-security-lab/experiment-no-6