This article gives you an overview of SQLMAP, an SQL injection tool used for detecting and exploiting the SQLI.
What is SQLI?
Burp Suite is an integrated platform for performing web application security testing. It is not a point-and-click tool, it is designed to be used by testers in manual mode to support the testing process. With a little effort, anyone can start using key Burp features to test the security of their applications. Burp Suite portable. Burp Suite Professional 2020.9 Build 3968 Download with Crack Full September 4, 2020 Category: Webmaster Author: kolpac 0. Burp Suite is a.
SQL Injection is a web based attack used by the hackers to steal the sensitive information from the organizations through web applications. It is one of the most common application layer attack used today. This is a kind of an attack that takes an advantage of improper coding of the web applications that allow the hackers to exploit the vulnerability by injecting SQL commands into the prior web application.
Underneath fact for the SQL Injection is because of the fields available for the user input in the web application allows SQL statements to pass through and interacts or queries the database directly.
For Example, Let us consider a web application that implements forms-based login mechanism to store the user credentials and perform a simple sql query to validate each login attempt. Here is a typical example.
select * from users where username=’admin’ and password=’admin123′;
If the attacker knows the username of the application administrator is admin, he can login as admin without supplying any password.
The query in the back-end looks like
Select * from users where username=’admin’–‘ and password=’xxx’;
Note the comment sequence (–) causes the followed query to be ignored, so query executed is equivalent to:
Select * from users where username=’admin’;
So password check is bypassed.
What is SQLMAP?
SQLMAP is an open source penetration testing tool that helps in automating the process of detecting and exploiting SQL injection vulnerabilities and taking full access over the database servers. SQLMAP comes with powerful detecting engine, and many niche features for the penetration tester and wide range of switches lasting from database fingerprinting, data fetching from the database, accessing the underlying file system and executing the commands on Operating System via Out-of-band Connections.
Since SQLMAP is developed in python it is a portable application, meaning that it will work in any operating system that supports python.
What is SQLMAP burp plug-in?
When we audit a web application, we normally configure an intermediate proxy to have more control over the request and response parameters.
SQLMAP plug-in is an add-on feature that we can configure to the burp through which we can redirect a URL or a request directly to the SQLMAP with a single mouse click
How to download the plug-in:
You can download the zip file from the following URL:
Unzip the file and keep it in the same folder where burp proxy is located.
Then execute the following command to run the burp with plug-in
Java –classpath burpplugins.jar:”burpsuite_v18.104.22.168.jar” burp.StartBurp
Java –classpath burpsuite_v22.214.171.124.jar;burpplugins.jar burp.StartBurp
Replace the burpsutie with the appropriate version that you are using. In my case I am using burpsuite_v126.96.36.199.jar
You need to download the SQLMAP as you need to give the executable to the plug-in
Setting up SQLMAP:
- Download and Install python 2.7*(http://www.python.org/getit/) official website for downloading python
- Download sqlmap(https://github.com/sqlmapproject/sqlmap)
- Unzip the name.zip file to sqlmap directory.
On Debian or Ubuntu
- Sudo apt-get install python-tk python2.7
- git clone git://github.com/sqlmapproject/sqlmap.git
- cd sqlmap
- wget http://gui-for-sqlmap.googlecode.com/files/sqm-60712.zip
- unzip sqm-60712.zip
Setting up the environment:
- If you are using OWASP broken web application, then simply access one of the vulnerable site from your local browser where you are running SQLMAP
- If you don’t use OWASP broken web application, then you need to set up a virtual machine that has a web server to host the vulnerable web application.
- Configure another VM with ubuntu where the attacker runs SQLMAP
Configuring the Proxy:
- If you are using Mozilla Firefox, then go to Edit > Preferences > Advanced > Network > settings and select “Manual Proxy Configuration” by enabling the radio button. Run the HTTP proxy with local-host and the port in which the proxy is running
- If you are using Chrome, then go-to settings > Show Advanced Options > Network > Change proxy Settings > Connections > Lan settings.
How to use the plug-in:
Once you load the plug-in, then it is very easy to make use of it. Run the burp proxy with loaded plug-in. In the “site map” tab under the “target” you can see the particular domain that you are trying to test for SQLI and all the crawled pages related to the domain.
On the right side click on the URL that you want to test, you can see the request parameters of the URL in the bottom panel. Right click on the request parameters and you can see the option “Send to sqlmap” as shown in the figure (I).
Then you can see a new window (SQLMap wrapper) that will allow you to configure sqlmap. Below Image gives you a clear view of the wrapper. Let’s observe figure (ii),
Now let us have an over view of configuration features of the wrapper. In the “Target” textbox specify the URL that you are willing to test. (Normally it will be filled by default as you have sent the request parameters previously, if needed you can change the URL).
Specify the method on which the domain is accessible (GET/POST). In the “Bin-path” give sqlmap executable.
If you are aware of the DBMS of the web application, specify the database by selecting one of the options listed in the dropdown list. By default “auto” is selected which means that the SQLMAP wrapper tries with all the databases listed in the dropdown list to find out the database used by the application.
You can enumerate the database users, passwords, roles, privileges, databases etc by selecting the appropriate option from the Action dropdown list. By default it is set to “auto” which means it will try to enumerate all the options listed in the dropdown list in the sequential order.
If you are aware of the databases, users, tables, or columns, you can enumerate it by simply specifying it in the Database options.
Tampers are a kind of special characters or symbols that you are willing to insert into the query while pen-testing the application.
Once we configure the SQLMAP click on the “RUN”, this will open a new tab with execution of the program with the configuration that you have given to the wrapper or the SQLMAP. We can make any number of simultaneous execution tabs with difference instances.
Burp Suite Free Edition Download
Below image shows the output tab. Let’s observe figure (III),
Bored with theory, now let us see an example, the below URL is a vulnerable site for practicing the SQLI. You can also find the SQLI practice URL’s by goggling.
Id parameter in the above URL is vulnerable to SQLI; let us find it out through our SQLMAP wrapper (Burp suite plug-in).
Open the URL in the browser for which the proxy has been configured. In the proxy (burp) go to the “site map” and click on the URL and send it to the sqlmap by right clicking on the response parameters of the website, as I mentioned previously. Figure (IV) shows you the wrapper opened for the above mentioned URL.
The target specifies the URL we are testing, cookie specifies the cookie or session id. Wrapper automatically identifies the positions in the URL where SQLI can be injected and specifies list of the parameters in “Parameters to test” text area (in our case we have only one possibility for injection which is “id” parameter).
In this example I have configured the SQLMAP wrapper to enumerate the list of databases that are configured in the backend database.
Figure (V) shows you the output tab which intend displays you how the plug-in tried to exploit the SQLI vulnerability in different ways
We can see that initially the wrapper tried to exploit the vulnerability by using “Boolean-based blind SQLI” by using AND operator. The payload shows how the tool tried to exploit the vulnerability. Here we can see the payload: id=22 AND 4626=4626, which is equivalent to the following URL:
http://www.eastodissa.ac.IN/news-and-events.php?id=22 AND 4626=4626
As the URL is always true, the above URL returns the same page as of the original URL.
In the second trail it tried “error-based SQLI”. Later by using UNION operator
From the figure (VI) we can observe more server details like web server, Operating System, back-end DBMS.
” Information_schema” and “nilakantatrust” are the two databases that are used by the web application.
Now let us try to enumerate all the tables and the columns of the tables from the above databases. To do so configure the SQLMAP wrapper Action field with the option “Enumerate database tables and columns”. Figure (VII) shows you the same.
Figure (VIII) shows us the tables of the database “nilakantatrust”
Let us see the columns of these tables. Figure (IX) shows the columns and their data types of two tables “est_notice” and “est_news” of nilakantatrust database.
We can also dump complete database by selecting the option “dump dbms databases”. And also store complete data into a file by using the option “save to file” in the output tab.
Figure (X) shows the dumped data of the table “est_admin” from “nilakantatrust” database and storing it into a file.
SQLMAP is a powerful tool which is used to automate the process of detecting and exploiting the SQLI.
Proxies like the one included in Burp Suite are designed for traffic interception. This allows the owner of the proxy to view, modify and drop packets passing through the proxy. While this can certainly be used for criminal purposes, it can also be used by cyberdefenders to protect against malware and dangerous user behavior.
In this article, we’ll discuss how to use Burp Suite to intercept Web traffic, both encrypted and unencrypted. We’ll start with unencrypted traffic (HTTP) and then cover the modifications necessary for HTTPS.
Intercepting HTTP Traffic
The first step to intercepting web traffic with Burp Suite is installing it on your system. The Burp Suite Community Edition is available from PortSwigger. After installing and opening Burp Suite, you’ll see a screen similar to the one below. [CLICK IMAGES TO ENLARGE]
When using Burp Suite as a proxy, it’s a good idea to ensure that the proxy is active. As shown in the screen above, this information is found under Proxy in the first row of tabs and Options in the second row. Note that the Burp proxy runs on 127.0.0.1:8080 by default.
If the proxy is running, the next step is setting up a Web browser to use the proxy. In this example, we’re using Chrome, so these settings can be found by opening Options and searching for Proxy as shown below.
Clicking on the “Open proxy settings” button in the above screen opens up the computer’s Internet Settings. As shown in the screen below, we’re using Windows for this example.
In the above screen, click on the LAN settings button, which opens the screen below. At the bottom of this screen is the computer’s proxy settings.
As shown above, we’ve set the proxy settings for the computer to Burp Proxy’s default address and port (127.0.0.1 and 8080). If you’ve changed this information for your Burp Suite instance, use your modified values here.
When complete, click OK and attempt to browse to a website. For this example, we’ve used an HTTPS site. As a result, we see the warning below.
Clicking Advanced and Proceed to site allows us to actually visit the website. At this point, take a look at Burp Proxy. Under the Proxy → Intercept tab, you can see the requests as they move through. As shown below, we see the GET request for the requested website.
Forwarding the requests in Burp eventually allows the webpage to load (as shown below).
However, as shown in the address bar, the site is not considered secure. This is because Burp breaks the certificate chain between the client and the server and uses its own certificate instead. Since Burp’s certificate is self-signed and untrusted by the browser, Chrome makes it obvious to the user that this isn’t a secure connection.
But what if we try to visit a site using HTTPS Strict Transport Security (HSTS), where the site requires that a secure connection is made between the server and the client? The image below shows an attempt to browse to Google while Burp is performing interception.
As shown in the screen above, Chrome gives you no option to continue on to the untrusted site. Since Burp is providing its own (untrusted) certificate to the client, the connection is completely untrusted and not allowed to continue. In order to visit Google, we need to get Chrome to trust Burp Proxy’s certificate.
Making the jump to HTTPS
Burp Proxy generates its own self-signed certificate for each instance. In order to get a copy of your Burp CA certificate, browse to 127.0.0.1:8080 (or wherever your Burp Proxy instance is running). Once there, you’ll see the screen below.
In the screen above, click on CA certificate in the top right corner. This will allow you to save a copy of your CA certificate to your computer.
Live 9 lite. Once you have the certificate, you need to mark it as trusted in your browser. In Chrome, this option is under Settings → Advanced Settings → Privacy and Security. At the bottom of the screen below is an option to manage certificates.
Clicking on “Manage certificates” will open up a window for managing certificates locally on your computer. On Windows, you will see the screen below.
To force Chrome to trust Burp’s certificate, move to the Trusted Root Certification Authorities tab and click Import. Click through the prompts and point it to your newly downloaded certificate. Once you have received a success message, restart both Burp and your browser.
Browsing to our original site on infosec.com, we no longer get an error message about an untrusted certificate. Examining the certificate (shown below), we see that Chrome is perfectly happy to accept a certificate signed by PortSwigger CA, which is the company that makes Burp Suite.
Burp Suite Free Download
But what about interception for sites enforcing HTTPS via HSTS? Browsing to Google again throws no errors and, as shown below, Chrome accepts the PortSwigger CA certificate as valid.
At this point, we’re capable of intercepting any Web traffic using Burp Proxy.
Conclusion: Applications and limitations of HTTPS interception
As mentioned above, interception of HTTPS traffic is valuable for both benign and malicious purposes. A cyberdefender who can unwrap the encryption provided by TLS may be able to detect and remediate malware infections or threat actor intrusions on the corporate network. However, an attacker with the same capabilities poses a significant threat to the privacy and security of users on the network.
The fact that the user needs to trust the Burp proxy certificate can be an annoyance to the defender but is a significant bonus when dealing with malicious parties. An organization can force trust of the Burp CA (and many have similar policies for organizational root CA certificates for deep packet inspection), but this makes it necessary to appropriately protect the Burp proxy instance. Anyone with access to the private key corresponding to Burp’s self-signed certificate has the ability to read any data sent by browsers using the proxy.
- Download Burp Suite Community Edition, PortSwigger
- Intercepting HTTP and HSTS enabled HTTPS / SSL traffic on Chrome/Firefox using Burp Suite, Zeroday-Security