Initialize the sqlmap Environment in Kali Linux

Introduction

In this lab, you will learn the fundamental steps to initialize and verify the sqlmap environment within Kali Linux. sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. Understanding how to properly set up and interact with sqlmap is crucial for anyone looking to perform web application security assessments. You will verify its installation, explore its extensive help menu, understand different verbosity levels, and identify a target URL for testing.

Access the Kali Linux Terminal

In this step, you will access the Kali Linux terminal, which is the primary interface for interacting with sqlmap and other command-line tools. The terminal provides a powerful environment for executing commands and viewing their output.

First, ensure you are in the ~/project directory. This is the default working directory for your lab environment.

cd ~/project

Now, open a new terminal window if one is not already open, or ensure you are in the existing terminal. You should see a prompt similar to labex@labex-vm:~/project$.

Verify the sqlmap Installation with sqlmap --version

In this step, you will verify that sqlmap is correctly installed and accessible in your Kali Linux environment by checking its version. This is a quick way to confirm that the tool is ready for use.

Execute the following command in your terminal:

sqlmap --version

You should see output similar to the following, indicating the installed version of sqlmap:

sqlmap version 1.x.x.x ## or similar version number

This output confirms that sqlmap is installed and can be executed from the command line.

Explore the Main Help Menu with sqlmap -h

In this step, you will explore the main help menu of sqlmap. The help menu provides a comprehensive overview of all available options and their functionalities, which is essential for understanding how to use the tool effectively.

Execute the following command to display the main help menu:

sqlmap -h

This command will output a long list of options, categories, and examples. Scroll through the output to get a general idea of the capabilities of sqlmap. You will notice sections for target specification, request options, optimization, injection, detection, and more.

        _
 _ __  _ __| | __  ___  ___
| '_ \| '__| |/ / / __|/ __|
| |_) | |  |   <  \__ \\__ \
| .__/|_|  |_|\_\ |___/|___/
|_|

... (truncated output) ...

Usage: python3 sqlmap [options]

Options:
  --version           Show program's version number and exit
  -h, --help          Show this help message and exit
  -v VERBOSE          Verbosity level: 0-6 (default 1)

  Target:
    At least one of these options has to be provided to define the
    target(s)

    -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
    -g GOOGLEDORK       Process Google dork results as target URLs

... (truncated output) ...

This output is crucial for understanding the various parameters you can use with sqlmap.

Understand Verbosity Levels with the -v Option

In this step, you will learn about the verbosity levels in sqlmap using the -v option. Verbosity levels control the amount of information sqlmap displays during its execution, which can be very useful for debugging or getting more detailed insights into its operations.

The -v option ranges from 0 (silent) to 6 (debug). Let's try a few to see the difference.

First, try a low verbosity level (e.g., 0):

sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -v 0 --batch

You will notice very little output, as sqlmap is running silently. The --batch option is added to avoid interactive prompts for this demonstration.

Next, try a higher verbosity level (e.g., 3):

sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -v 3 --batch

You will see significantly more output, including HTTP requests, responses, and detailed information about the testing process. This level is often useful for understanding what sqlmap is doing behind the scenes.

        _
 _ __  _ __| | __  ___  ___
| '_ \| '__| |/ / / __|/ __|
| |_) | |  |   <  \__ \\__ \
| .__/|_|  |_|\_\ |___/|___/
|_|

... (truncated output) ...

[HH:MM:SS] [INFO] starting @ HH:MM:SS /YYYY-MM-DD/
[HH:MM:SS] [INFO] fetched data: 'cat=1'
[HH:MM:SS] [INFO] testing connection to the target URL
[HH:MM:SS] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[HH:MM:SS] [INFO] the target URL is not protected by any kind of WAF/IPS/IDS
[HH:MM:SS] [INFO] testing if the target URL is stable
[HH:MM:SS] [INFO] target URL is stable
[HH:MM:SS] [INFO] testing for GET parameter 'cat'
[HH:MM:SS] [INFO] GET parameter 'cat' is vulnerable.
... (truncated output) ...

Understanding verbosity levels helps you control the amount of information displayed, which is crucial for efficient analysis during penetration testing.

Identify the Vulnerable Test Application URL

In this step, you will identify a publicly available vulnerable web application URL that can be used for testing sqlmap. For ethical hacking and learning purposes, it's crucial to use designated test environments or applications for which you have explicit permission to test.

For this lab, we will use http://testphp.vulnweb.com/listproducts.php?cat=1 as our target URL. This URL is intentionally vulnerable to SQL injection and is provided by Acunetix for testing purposes.

You can simply note this URL. In future labs, you will use this URL with sqlmap to perform various SQL injection attacks.

The URL is: http://testphp.vulnweb.com/listproducts.php?cat=1

This URL contains a GET parameter cat which is known to be vulnerable. This will be your target for subsequent sqlmap exercises.

Summary

In this lab, you have successfully initialized and verified your sqlmap environment in Kali Linux. You learned how to access the terminal, check the sqlmap version, explore its comprehensive help menu, and understand the importance of verbosity levels for detailed output. Furthermore, you identified a publicly available vulnerable web application URL (http://testphp.vulnweb.com/listproducts.php?cat=1) that will serve as your target for future SQL injection exercises. These foundational steps are crucial for effectively utilizing sqlmap in penetration testing scenarios.