SQL Injection with SQLmap on Kali: From Login Form to Database

SQLmap is a powerful open-source tool for automating SQL injection testing. Essentially, if a web application neglects to filter user input before sending it to the database, SQL injection attacks become possible. These attacks involve targeting login forms, search boxes, or URL parameters to manipulate the database.

For demonstration purposes, we'll use a self-hosted instance of the Damn Vulnerable Web Application (DVWA) running via Docker. To begin, ensure Docker is installed and running, then launch DVWA with the command `docker run --rm -d -p 80:80 vulnerables/web-dvwa`. After accessing the application via your browser at `http://localhost/login.php` and logging in as "admin" with the password "password", navigate to the SQL injection page by selecting it from DVWA's left menu.

SQLmap requires the session cookie to act as if the application is logged in. Retrieve this cookie from your browser's developer tools and transmit it along with the target URL, security level, and database specifications when executing `sqlmap`. Use the `-u` flag for the URL, `--cookie` for the session cookie, `--dbs` to enumerate databases, and `--batch` to automate the process.

Upon identifying the DVWA database, list the available tables using `-D` followed by the database name. The `users` table is expected to contain username and password fields. To extract the stored user data, execute `sqlmap` again with the `-T` flag pointing to the target table, and use `--dump` to extract the information. SQLmap will automatically attempt to crack MD5 hashes using a dictionary attack, revealing potential login credentials in the process. Always ensure you have authorization before conducting any such tests on live systems.