Only one thing is impossible for God: To find any sense in any copyright law on the planet.
Mark Twain
Kali Linux is a Debian-derived software and has been described as an Advanced Penetration Testing tools Kali Linux is a bundler with more than almost 700 powerful and advanced Penetration Testing tools. Kali Linux is free and open-source, making it the ideal tool for systems vulnerability testing, but also the perfect tool for a hacker with malicious intent.
It also conforms to the File-system Hierarchy Standard, thus allowing Linux users to quickly locate binaries, support files, and libraries, making it unique among similar software. Kali Linux supports the Sqlmap Framework, a powerful network penetration tool targeting SQL databases (Sinha, 2018).
Keywords: Kali Linux, Sqlmap, Hacking, Network Penetration Tools
Introduction.
Sqlmap is one of the most popular forensics, penetration, and security testing tools bundled in Kali Linux tools. Sqlmap is open-source software and a powerful penetration tool targeting SQL databases. It works by exploiting SQL Injection flaws then takes total control of the database server. Its detection mechanism is powerful with features such as database fingerprinting, data extraction from databases, accessing databases file systems, and running commands on the Operating systems.
Sqlmap boasts of 6 different injection techniques: boolean-based blind, time-based blind, error-based, UNION query, stacked queries, and out-of-band. It is capable of direct connection to a database by merely using database credentials, IP address, port, and database name.
The ability of Sqlmap to list users, password hashes, privileges, roles, databases, tables, and columns is unparalleled. For cracking passwords, it used automatic recognition of password hash formats then breaks them using a dictionary-base. It is also capable of dumping entire database tables, or specific columns as requested by the user.
Sqlmap is a potent tool with many advanced capabilities that can be used for excellent penetration testing. However, it can also be used to cause a whole lot of damage if the intentions are evil. Sqlmap full supports all injection techniques, including Boolean, Error, Stack, Time, and Union (Ojagbule, Wimmer, & Haddad, 2018).
Implementation.
The standard implementation of Sqlmap is as follow:
sqlmap -u "http://172.16.0.0/files/file.php?id=[QUERY STRING VALUE]"
Other parameters that can be combined:
-- dbs: will display the databases.
-- tables: will display tables in the database.
-- columns: Will display columns in the database.
-- dump: Will dump DBMS database entries.
For the help command, the syntax is as follow:
sqlmap -h
Running sqlmap yourself is not difficult. Sqlmap is based on the python programming language, so it will run smoothly on any Linux backend, mainly Linux, with Ubuntu, which makes it easy to install and implement. Download and install, unpack it and run the command with the necessary options.
SQLmap has a large number of features and is a great penetration testing tool for databases of all types. It can pop shells on the host target, send exploits via tor, locate vulnerable pages for SQL injection automatically, ability to spider sites, and lastly, execute HTTP POST based testing using URLs with query strings; and these are just a few examples of the capabilities of Sqlmap (Guimaraes, 2018).
How to Prevent SQL Injections.
To prevent and minimize SQL injections, you should:
1. Have a good Firewall with excellent rules
2. Avoid the use of files with query string POST method
3. Use the mysql_real_escape_string() function. This function prevents SQL injection
A programming language is for thinking about programs, not for expressing programs you’ve already thought of. It should be a pencil, not a pen.
Rainbow-Themes
Conclusion.
Kali Linux is no doubt a powerful distribution tool bundled with valuable network penetration tools. Sqlmap is one of the more powerful, capable of exposing vulnerabilities and it makes testing websites vulnerabilities within networks easy. If a hacker with malicious intent employs the use of Sqlmap, they can run malicious SQL queries that can take control of a database. The most vulnerable pages are webpages with URL containing query strings, which can be used to “Post” or ‘GET’ values from the database tables.
References
Guimaraes , B. D. (2018). Sqlmap: Automatic SQL injection and database takeover tool. Retrieved from http://sqlmap.org/.
Ojagbule, O., Wimmer, H., & Haddad, R. J. (2018). Vulnerability Analysis of Content Management Systems to SQL Injection Using SQLMAP. SoutheastCon 2018. doi: 10.1109/secon.2018.8479130
Sinha, S. (2018). Kali Linux and Python. Beginning Ethical Hacking with Kali Linux, 137–188. doi: 10.1007/978-1-4842-3891-2_7
Sinha, S. (2018). SQL Mapping. Beginning Ethical Hacking with Kali Linux, 221–258. doi: 10.1007/978-1-4842-3891-2_9
