8 ms·

Sqlmap: Automatic SQL injection and database takeover tool

248 points by madewulf 14y ago

mrkmcknz 14y ago
How can I donate to you guys?
lucasgameiro 14y ago
Thanks god this kind of tools now has so much better layouts than few years ago.
tptacek 14y ago
If you're a small startup looking to automate security testing against your application, I strongly recommend just shelling out for Burp Suite; it's like a couple hundred bucks tops, can be used to automate almost every common web app attack, and is the tool most likely to be used by good auditors when you eventually decide to get tested professionally. http://portswigger.net/burp/ http://portswigger.net/burp/ There's a free version, which disables the (mostly vestigial, anyways) "scanner", and slows down the fuzzer tool; if you're really automating security testing --- which, do --- pay for the real version; you want the fuzzer to work. There are things sqlmap does that Burp does not do easily, but they're not important to app developers; if you're generating database exceptions with inputs, don't dick around trying to make time-based blind SQL work; just fix the bugs.
- taylorbuley 14y ago
  Nice recommendation tptacek. Also nice is the book by the author of the same software: http://www.amazon.com/The-Web-Application-Hackers-Handbook/dp/0470170778 http://www.amazon.com/The-Web-Application-Hackers-Handbook/d...
  - tptacek 14y ago
    If you click over to my profile, there's an Amazon reading list I made up to answer the question "what should I read up on to get better at appsec". I think WAHH is #2 or #3 on it. If you're a talented programming (we especially like talking to people who are good in C, but we're happy to meet anyone) and you're seriously interested in working from Chicago, NYC, or SFBA doing appsec, but don't feel like you have the background, drop me a line. My usual next step for people who I think would be ready to interview with us but for some web app knowledge is to shoot them a copy of that book. Infinite free books is a small perk here.
- 127001brewer 14y ago
  Here's a blog posting from Bruce Schneier on getting started in computer security: http://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html http://www.schneier.com/blog/archives/2012/07/how_to_become_... There are links within his blog posting to other tools.
  - tptacek 14y ago
    I wrote a similar piece for Krebs the week prior; I think it's linked from this one. I'm not a fan of Schneier's take on this. Don't start a career in security by thinking about certification.
    - 127001brewer 14y ago
      Can you provide the link to Krebs?
      - ontoillogical 14y ago
        Here: http://krebsonsecurity.com/2012/06/how-to-break-into-security-ptacek-edition/ http://krebsonsecurity.com/2012/06/how-to-break-into-securit...
    - lightweb 14y ago
      I have found that certification courses can give a proper introduction to specific technical areas. Of course, if the goal is to just get the cert, then one would probably miss most of the learning aspects of the certification process. The cert curriculum can be a great learning tool, in addition to just plain playing around and learning from other social networks.
- spydum 14y ago
  This has been one of my most favored tools in my belt. It is extremely handy for more than just security work. The proxy and intercept, and repeater tools are excellent. The only complaint I have is that the proxy is sluggish compared to something like Fiddler2. Never have figured out why though.
- scarmig 14y ago
  I probably misinterpreted you, but haven't you written skeptically of automated security testing in the past? Or is it just people who actually work in security shops that should stay away from them?
  - tptacek 14y ago
    I am very skeptical of tools that find security flaws automatically. I am enthusiastic about automation. The holy grail is to strip away all the tedium from testing, leaving only the mental challenge of finding and exploiting the broken assumptions of our adversary developers. Burp Suite does a very good job here. sqlmap crosses the line for us. But that doesn't make it a bad tool.
    - david_shaw 14y ago
      >I am very skeptical of tools that find security flaws automatically. I am enthusiastic about automation. Just my $0.02 here, since I think tptacek has it covered (as usual). The way I explain use of automated tools to our clients is that, yes, the assessment you're paying for is to have a skilled security expert manually assessing your application. That said, in order to get the most efficiency out of manual testing, those parts which can be easily automated should be. A few trivial examples would be finding open ports, or detecting expired/weak SSL certificates. Sure, an engineer could manually connect to all 65535 ports to see if they're open, and manually grab banners, or he could just run `nmap -p- -sV hostname`. Similarly, he could use openssl to check all aspects of an SSL certificate, but why bother when there are tools to do this for you? The same is true in application security, although the examples can be a little fuzzier (pun intended?). The more seamless automation can be integrated into testing, the more time for manual analysis can be allotted. I think this is the point that tpatacek was making, and just wanted to expand upon it for those that might be a little confused.
taylorbuley 14y ago
Here's a video demonstration playlist: http://www.youtube.com/watch?v=fGBQm9Nfn24&list=UU8lIbC-tp4cPosY0kB8Xkxg&index=9&feature=plcp http://www.youtube.com/watch?v=fGBQm9Nfn24&list=UU8lIbC-...
Toshio 14y ago
Has anyone done a comparative review of sqlmap vs skipfish?
- tptacek 14y ago
  They're not really comparable. Skipfish is a fast crawler with some checks for DOM corruption, SQL metacharacters, and hygiene. sqlmap is a tool for exploiting SQL injection. I like the code for Skipfish a lot, but neither tool is particularly important in the profession; if you're working with a contract application security firm and they give you findings that came from sqlmap or Skipfish, you should be irritated.
  - jvdongen 14y ago
    I'm not sure I read your final remark correctly. Do you mean to say that using Skipfish or sqlmap has no place in a professional pen test or that a professional pen tester should not subject his clients to the raw results from said tools? The latter I agree with, the former I don't. Any automated security scanner has its shortcomings - combining the results of various scanner products generally has a positive effect upon the quality of the test. I've often been in a situation where one tool (commercial or otherwise) indicated or hinted at a vulnerability while all other tools (commercial or otherwise) used did not indicate anything.
    - tptacek 14y ago
      The former. With some very minor exceptions, we don't use automated scanners at all in our practice. We use Burp to set up testing experiments, and we use ruby for automation. We've found that "scanners" make good testers much less sharp; if the tool spits out the names of specific vulnerabilities, it's suspect. But even practices that do use automated scanners won't be relying on Skipfish or sqlmap. This obviously doesn't hold for network pentesters. For tests in which application flaws aren't the whole story, and you're just looking for the fastest way in you can find, sure; sqlmap is valuable there, much more so than Skipfish. We don't do those kinds of tests often.
BaconJuice 14y ago
Very cool, Thanks
maratd 14y ago
Forgive my ignorance, but if you're using prepared statements for all your SQL queries using user input, aren't you by definition safe from any kind of injection?
- tptacek 14y ago
  Of course not. This is a pernicious myth about SQL security. Many inputs to query construction can't be parameterized.
  - bni 14y ago
    "Many inputs to query construction can't be parameterized." Such as? If you only use PreparedStatment (Java), or the equivalent for your language, and have a rule against, and never broken, to concatenate SQL strings together, you are safe from SQL injection.
    - j_s 14y ago
      Without dynamic sql, it is tough to do arbitrary (user-selected) columns, sorting, and server-side paging simultaneously (limiting the result set in the query instead of skipping through results in the app). SQL does not allow use of parameters in all the necessary locations in the query (result column list, order by list, etc.), and some databases are more limited than others. There are options available as one or more of the above 3 requirements is dropped: http://stackoverflow.com/questions/149380/dynamic-sorting-within-sql-stored-procedures http://stackoverflow.com/questions/149380/dynamic-sorting-wi...
      - bni 14y ago
        User selected columns is easy, just select all required columns each time and display as needed, the performance impact of this is minimal. The fact that the query need not be reparsed is probably a bigger benefit performance wise. Paging is equally easy, using ROWNUM < X in Oracle or equivalent in other RDBMS. The order by is a good point. The obvious solution here would be to always have the same sorting as default, and do the user sorting client side (by client here, I mean calling application).
daksatech 14y ago
Havij is a similar tool thats gaining in popularity due to its point and click interface. check out: http://blog.imperva.com/2012/04/dissecting-the-sql-injection-tools-used-by-hackers.html http://blog.imperva.com/2012/04/dissecting-the-sql-injection...
benatkin 14y ago
Here's a better web page that contains the same information: https://github.com/sqlmapproject/sqlmap https://github.com/sqlmapproject/sqlmap
wglb 14y ago
This is an excellent tool. But generally on a penetration test, BurpSuite is what you want to use. If, however, simply demonstrating that SQLi is there is not sufficient, or if the blind SQLi is too ephemeral sounding to the client, Sqlmap can help you dump the entire database. This will convince even the most skeptical.
- emidln 14y ago
  I prefer using w3af over BurpSuite. Full source is a good thing.
countessa 14y ago
Nice little tool thanks

248 points by madewulf 14y ago

mrkmcknz 14y ago

How can I donate to you guys?

lucasgameiro 14y ago

Thanks god this kind of tools now has so much better layouts than few years ago.

tptacek 14y ago

If you're a small startup looking to automate security testing against your application, I strongly recommend just shelling out for Burp Suite; it's like a couple hundred bucks tops, can be used to automate almost every common web app attack, and is the tool most likely to be used by good auditors when you eventually decide to get tested professionally. http://portswigger.net/burp/ http://portswigger.net/burp/ There's a free version, which disables the (mostly vestigial, anyways) "scanner", and slows down the fuzzer tool; if you're really automating security testing --- which, do --- pay for the real version; you want the fuzzer to work. There are things sqlmap does that Burp does not do easily, but they're not important to app developers; if you're generating database exceptions with inputs, don't dick around trying to make time-based blind SQL work; just fix the bugs.

taylorbuley 14y ago
Nice recommendation tptacek. Also nice is the book by the author of the same software: http://www.amazon.com/The-Web-Application-Hackers-Handbook/dp/0470170778 http://www.amazon.com/The-Web-Application-Hackers-Handbook/d...
- tptacek 14y ago
  If you click over to my profile, there's an Amazon reading list I made up to answer the question "what should I read up on to get better at appsec". I think WAHH is #2 or #3 on it. If you're a talented programming (we especially like talking to people who are good in C, but we're happy to meet anyone) and you're seriously interested in working from Chicago, NYC, or SFBA doing appsec, but don't feel like you have the background, drop me a line. My usual next step for people who I think would be ready to interview with us but for some web app knowledge is to shoot them a copy of that book. Infinite free books is a small perk here.
127001brewer 14y ago
Here's a blog posting from Bruce Schneier on getting started in computer security: http://www.schneier.com/blog/archives/2012/07/how_to_become_a_1.html http://www.schneier.com/blog/archives/2012/07/how_to_become_... There are links within his blog posting to other tools.
- tptacek 14y ago
  I wrote a similar piece for Krebs the week prior; I think it's linked from this one. I'm not a fan of Schneier's take on this. Don't start a career in security by thinking about certification.
  - 127001brewer 14y ago
    Can you provide the link to Krebs?
    - ontoillogical 14y ago
      Here: http://krebsonsecurity.com/2012/06/how-to-break-into-security-ptacek-edition/ http://krebsonsecurity.com/2012/06/how-to-break-into-securit...
  - lightweb 14y ago
    I have found that certification courses can give a proper introduction to specific technical areas. Of course, if the goal is to just get the cert, then one would probably miss most of the learning aspects of the certification process. The cert curriculum can be a great learning tool, in addition to just plain playing around and learning from other social networks.
spydum 14y ago
This has been one of my most favored tools in my belt. It is extremely handy for more than just security work. The proxy and intercept, and repeater tools are excellent. The only complaint I have is that the proxy is sluggish compared to something like Fiddler2. Never have figured out why though.
scarmig 14y ago
I probably misinterpreted you, but haven't you written skeptically of automated security testing in the past? Or is it just people who actually work in security shops that should stay away from them?
- tptacek 14y ago
  I am very skeptical of tools that find security flaws automatically. I am enthusiastic about automation. The holy grail is to strip away all the tedium from testing, leaving only the mental challenge of finding and exploiting the broken assumptions of our adversary developers. Burp Suite does a very good job here. sqlmap crosses the line for us. But that doesn't make it a bad tool.
  - david_shaw 14y ago
    >I am very skeptical of tools that find security flaws automatically. I am enthusiastic about automation. Just my $0.02 here, since I think tptacek has it covered (as usual). The way I explain use of automated tools to our clients is that, yes, the assessment you're paying for is to have a skilled security expert manually assessing your application. That said, in order to get the most efficiency out of manual testing, those parts which can be easily automated should be. A few trivial examples would be finding open ports, or detecting expired/weak SSL certificates. Sure, an engineer could manually connect to all 65535 ports to see if they're open, and manually grab banners, or he could just run `nmap -p- -sV hostname`. Similarly, he could use openssl to check all aspects of an SSL certificate, but why bother when there are tools to do this for you? The same is true in application security, although the examples can be a little fuzzier (pun intended?). The more seamless automation can be integrated into testing, the more time for manual analysis can be allotted. I think this is the point that tpatacek was making, and just wanted to expand upon it for those that might be a little confused.

taylorbuley 14y ago

Here's a video demonstration playlist: http://www.youtube.com/watch?v=fGBQm9Nfn24&list=UU8lIbC-tp4cPosY0kB8Xkxg&index=9&feature=plcp http://www.youtube.com/watch?v=fGBQm9Nfn24&list=UU8lIbC-...

Toshio 14y ago

Has anyone done a comparative review of sqlmap vs skipfish?

tptacek 14y ago
They're not really comparable. Skipfish is a fast crawler with some checks for DOM corruption, SQL metacharacters, and hygiene. sqlmap is a tool for exploiting SQL injection. I like the code for Skipfish a lot, but neither tool is particularly important in the profession; if you're working with a contract application security firm and they give you findings that came from sqlmap or Skipfish, you should be irritated.
- jvdongen 14y ago
  I'm not sure I read your final remark correctly. Do you mean to say that using Skipfish or sqlmap has no place in a professional pen test or that a professional pen tester should not subject his clients to the raw results from said tools? The latter I agree with, the former I don't. Any automated security scanner has its shortcomings - combining the results of various scanner products generally has a positive effect upon the quality of the test. I've often been in a situation where one tool (commercial or otherwise) indicated or hinted at a vulnerability while all other tools (commercial or otherwise) used did not indicate anything.
  - tptacek 14y ago
    The former. With some very minor exceptions, we don't use automated scanners at all in our practice. We use Burp to set up testing experiments, and we use ruby for automation. We've found that "scanners" make good testers much less sharp; if the tool spits out the names of specific vulnerabilities, it's suspect. But even practices that do use automated scanners won't be relying on Skipfish or sqlmap. This obviously doesn't hold for network pentesters. For tests in which application flaws aren't the whole story, and you're just looking for the fastest way in you can find, sure; sqlmap is valuable there, much more so than Skipfish. We don't do those kinds of tests often.

BaconJuice 14y ago

Very cool, Thanks

maratd 14y ago

Forgive my ignorance, but if you're using prepared statements for all your SQL queries using user input, aren't you by definition safe from any kind of injection?

tptacek 14y ago
Of course not. This is a pernicious myth about SQL security. Many inputs to query construction can't be parameterized.
- bni 14y ago
  "Many inputs to query construction can't be parameterized." Such as? If you only use PreparedStatment (Java), or the equivalent for your language, and have a rule against, and never broken, to concatenate SQL strings together, you are safe from SQL injection.
  - j_s 14y ago
    Without dynamic sql, it is tough to do arbitrary (user-selected) columns, sorting, and server-side paging simultaneously (limiting the result set in the query instead of skipping through results in the app). SQL does not allow use of parameters in all the necessary locations in the query (result column list, order by list, etc.), and some databases are more limited than others. There are options available as one or more of the above 3 requirements is dropped: http://stackoverflow.com/questions/149380/dynamic-sorting-within-sql-stored-procedures http://stackoverflow.com/questions/149380/dynamic-sorting-wi...
    - bni 14y ago
      User selected columns is easy, just select all required columns each time and display as needed, the performance impact of this is minimal. The fact that the query need not be reparsed is probably a bigger benefit performance wise. Paging is equally easy, using ROWNUM < X in Oracle or equivalent in other RDBMS. The order by is a good point. The obvious solution here would be to always have the same sorting as default, and do the user sorting client side (by client here, I mean calling application).

daksatech 14y ago

Havij is a similar tool thats gaining in popularity due to its point and click interface. check out: http://blog.imperva.com/2012/04/dissecting-the-sql-injection-tools-used-by-hackers.html http://blog.imperva.com/2012/04/dissecting-the-sql-injection...

benatkin 14y ago

Here's a better web page that contains the same information: https://github.com/sqlmapproject/sqlmap https://github.com/sqlmapproject/sqlmap

wglb 14y ago

This is an excellent tool. But generally on a penetration test, BurpSuite is what you want to use. If, however, simply demonstrating that SQLi is there is not sufficient, or if the blind SQLi is too ephemeral sounding to the client, Sqlmap can help you dump the entire database. This will convince even the most skeptical.

emidln 14y ago
I prefer using w3af over BurpSuite. Full source is a good thing.

countessa 14y ago

Nice little tool thanks