Home
Bug Bounty Tips
SQL Injection

Exploiting SQL Injection with SQLMAP using Session Cookies

SQL Injection is a critical cybersecurity vulnerability that can have severe consequences for web applications if left unaddressed. Attackers can exploit this vulnerability to gain unauthorized access, steal sensitive data, or even manipulate the entire database. As a penetration testing tool, SQLMAP assists security researchers in identifying and exploiting SQL Injection flaws to evaluate the security of web applications. In this article, we will focus on using SQLMAP with session cookies to detect and exploit SQL Injection vulnerabilities in login-protected web pages.

Prerequisites

Before proceeding, ensure you have the following:

  1. A target web application with a login-protected dashboard suspected to have a SQL Injection vulnerability.
  2. SQLMAP installed on your machine. You can download it from the official SQLMAP GitHub repository.

Step 1: Identifying the Vulnerable Parameter

Begin by identifying the parameter where the SQL Injection vulnerability might exist. This parameter is typically found in the URL query string or POST data of a login form. Understanding the vulnerable parameter is crucial for exploiting the SQL Injection effectively.

Step 2: Extracting the Session Cookie

To access the login-protected dashboard, you need a valid session cookie. Obtain this cookie by logging into the target web application using your web browser. You can use browser developer tools or extensions like EditThisCookie to extract the cookie's value.

Step 3: Initiating SQLMAP Scan with Session Cookies

Now, open a terminal or command prompt and run SQLMAP with the following command:

sqlmap -u "<host>" --cookie="<cookie>" --dbs

  • <host> should be replaced with the URL of the target web page containing the vulnerable parameter.
  • <cookie> should be replaced with the valid session cookie obtained in Step 2.

Example

sqlmap -u "http://host.id/dashboard/?vuln=1" --cookie="PHPSESSID=fofm4dushi1cogn2khm56rff7" --dbs

By using the --cookie option, SQLMAP will utilize the session cookie to simulate an authenticated user, attempting to exploit the SQL Injection vulnerability.

How to obtain a valid session cookie?

  1. Log in to the vulnerable website.
  2. Retrieve the cookie using Burp Suite or inspect element > network

Step 4: Analyzing the Results

SQLMAP will begin scanning the target web application for SQL Injection vulnerabilities using the provided session cookie. If the vulnerability is exploitable, SQLMAP will display the names of the databases retrieved from the server.

Step 5: Advanced Exploitation (Optional)

Based on the results obtained in Step 4, you may choose to perform more advanced exploitation with SQLMAP. For instance, you can use the --dump option to extract data from specific database tables or execute custom SQL queries with --sql-query. Additionally, SQLMAP provides an option to gain a command shell on the server using --os-shell.

Related Article : Explanation of what is SQLmap and its commands

Important Notes

  1. Obtain explicit permission from the website owner before conducting any penetration testing or vulnerability scanning. Unauthorized testing is illegal and unethical.
  2. Practice responsible use of SQLMAP and only on systems you own or have explicit permission to test.
  3. Stay updated on security best practices to protect your web applications from SQL Injection and other vulnerabilities.

Using SQLMAP with session cookies provides penetration testers with a powerful tool to detect and exploit SQL Injection vulnerabilities in login-protected web applications. By simulating an authenticated user, SQLMAP can effectively test the security of such applications and help developers identify and fix potential SQL Injection flaws. Always remember to conduct ethical hacking, seek permission, and prioritize the security of web applications to maintain a safer online environment.