Offensive Security Tooling: SQLMap: The Basics (TryHackMe)

Search for a command to run...

No comments yet. Be the first to comment.
Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

In this article, I will write a write-up for SQLMap: The Basics that covers SQL Injection Vulnerability, Automated SQL Injection Tool, and a Practical Exercise.
This room was a bit complicated to me so I’ll share this LinkedIn article that has clear steps to navigate the practical exercise. I wasn’t able to capture them well since we have few to the closure of the challenge.
Which language builds the interaction between a website and its database? SQL
Which boolean operator checks if at least one side of the operator is true for the condition to be true? or
Is 1=1 in an SQL query always true? (YEA/NAY) YEA
Which flag in the SQLMap tool is used to extract all the databases available? —dbs
What would be the full command of SQLMap for extracting all tables from the "members" database? (Vulnerable URL: http://sqlmaptesting.thm/search/cat=1) sqlmap -u <http://sqlmaptesting.thm/search/cat=1> -D members --tables
How many databases are available in this web application? 6
What is the name of the table available in the "ai" database? user
What is the password of the email test@chatai.com? 12345678
Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.