How to Hack Databases: Hacking MySQL Online Databases with Sqlmap « Null Byte :: WonderHowTo

Welcome back, my amateur hackers!In this tutorial, we will follow up on a previous tutorial onMySQL. In that tutorial, I showed you the basics of running a MySQL server on BackTrack. In addition, you might want to take a look at my tutorial on the basics ofdatabases, if you are not familiar with databases and DataBase Management Systems (DBMS). Since MySQL is SO important in so many web applications, I will be doing more MySQL tutorials in the future. The more you know about MySQL, the better you can hack MySQL!Generally, MySQL is teamed up with PHP and an Apache web server (often referred to as LAMPP or XAMPP) to build dynamic, database driven web sites. Such development packages as Drupal, Joomla, Wordpress, Ruby on Rails and others all use MySQL as their default database. Millions of websites have MySQL backends and very often they are "homegrown" websites, without much attention on security.In this tutorial, we will looking to extract information about an online MySQL database before we actually extract information from the database. Once again, I'll repeat, the more we know, the more successful we will be in hacking and the less chance you will be detected.Here, we will be using one of the best database hacking tools available,sqlmap. Sqlmap can be used for databases other than MySQL, such Microsoft's SQL Server and Oracle, but here we will focus its capabilities on those ubiquitous web sites that are built with PHP, Apache and MySQL.Step 1: Start SqlmapFirst, fire up BackTrack and go toBackTrack, thenInformation Gathering, thenDatabase Analysis, thenMySQL Analysisand finally,sqlmapas shown in the screenshot below.Step 2: Find a Vulnerable Web SiteIn order to get "inside" the web site and ultimately, the database, we are looking for web sites that end in "php?id=" where XXX represents some number. Those who are familiar with google hacks/dorks can do a search on google by entering:inurl:index.php?id=inurl:gallery.php?id=inurl:post.php?id=inurl:article?id=...among others.This will bring up literally millions of web sites with this basic vulnerability criteria. If you are creative and ambitious, you can find numerous web sites that list vulnerable web sites. You might want to check these out.For our purposes here and to keep you out of the long reach of the law, we will be hacking a website designed for this purpose,www.webscanhost.org. We can practice on this web site and refine your skills without worrying about breaking any laws and having to make bail money for you.Step 3: Open SqlmapWhen you click on sqlmap, you will be greeted by a screen like that below. Sqlmap is a powerful tool, written as a Python script (we will be doing Python tutorial soon) that has a multitude of options. We will just be scratching the surface of its capabilities in this tutorial.Step 4: Determine the DBMS Behind the Web SiteBefore we begin hacking a web site, we need to gather information. We need to know WHAT we are hacking. As I have said many times before, most exploits are very specific to the OS, the application, services, ports, etc. Let's begin by finding out what the DBMS is behind this web site.The start sqlmap on this task, we type:./sqlmap.py -u "the entire URL of the vulnerable web page"or this case:./sqlmap.py -u "http://www.webscantest.com/datastore/search_get_by_id.php?id=4"When we do so, sqlmap will return results like that below. Notice where I highlighted that the web site back-end is using MySQL 5.0Step 5: Find the DatabasesNow that we know what the database management system (DBMS) is MySQL 5.0, we need to know what databases it contains. sqlmap can help us do that. We take the command we used above and append to it--dbs, like this:./sqlmap.py -u "http://www.webscantest.com/datastore/search_get_by_id.php?id=4" --dbsWhen run this command againstwww.webscantest.comwe get the results like those below. Notice that I have highlighted the two available databases,information schemaandscanme. Information schema is included in every MySQL installation and it includes information on all the objects in the MySQL instance, but not data of interest. Although it can be beneficial to explore that database to find objects in all the databases in the instance, we will focus our attention on the other database here ,scanme, that may have some valuable information. Let's explore it further.Step 6: Get More Info from the DatabaseSo, now we know what the DBMS is (MySQL 5.0) and the name of a database of interest (scanme). The next step is to try to determine the tables and columns in that database. In this way, we will have some idea what data is in the database, where it is and what type of data (numeric or string). All of this information is critical and necessary to extracting the data. To do this, we need to make some small revisions to our sqlmap command. Everything else we have used above remains the same, but now we tell sqlmap we want to see the tables and columns from the scanme database. We can append our command with--columns -Dand the name of the database,scanmesuch as this:./sqlmap.py -u "http://www.webscantest.com/datastore/search_get_by_id.php?id=4" --dbs --columns -D scanmeWhen we do so, sqlmap will target the scanme database and attempt to enumerate the tables and columns in the scanme database.As we can see below, sqlmap successfully was able to enumerate three tables; (1) accounts, (2) inventory, and (3) orders, complete with column names and datatypes. Not Bad!Note that the orders table below includes credit card numbers, expiration dates and CVV. The hacker's "Golden Fleece"!!As you can see, sqlmap can be very versatile and useful tool for MySQL, as well as SQL Server and Oracle database hacking. We will plan on coming back to sqlmap in the near future to explore more of its extensive database hacking capabilities.Keep coming back, my amateur hackers, for more adventures in Hackerland!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow to Hack Databases:Extracting Data from Online Databases Using SqlmapHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)SQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)How To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1How to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedHow To:Enumerate MySQL Databases with MetasploitHow To:Hack TOR Hidden ServicesHow To:Use PHP to login to a MYSQL databaseHow To:The Art of 0-Day Vulnerabilities, Part3: Command Injection and CSRF VulnerabilitiesHow To:Create a MySQL user login database with PHPHow To:Import Excel to a MySQL database with cPanelHack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHow to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Export a MySQL database table to Excel with cPanelHow To:Make a MySQL database for CoffeeCup Form BuilderHow To:Connect to a database & add data in PHP & MYSQLHow To:Access and edit databases in MySQL Query BrowserHow To:Transfer data between 2 MySQL databases in DreamCoderHow To:Connect to a MySQL database using DreamCoderHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHow To:Synchronize two MySQL databases with DreamCoderHack Logs and Linux Commands:What's Going On Here?How To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsNews:ShouldIChangeMyPassword.comIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:Accessing a PostgreSQL Database in your C/C++ ProgramNews:PostgreSQL Quick Start