SQL Map

Introduction

SQL map is an open-sourced software that is often used as a SQL injection tool. It also automates the process of detecting and exploitation of SQL injection flaws (Johari & Sharma (2012). It also enables the attacker to control a web application database and lets him/her change, alter, read or delete important files as per wish. It has a powerful detection engine and many niche features for the ultimate penetration tester. Also, it has a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system through out-of-band connections.

Features

SQL maps have a definitive set of features that helps its user to gain access over a database. Some of them include full support for MySQL, PostgreSQL, Microsoft SQL Server, Oracle, IBMDB2, Microsoft access, and many other types of databases. It can fully support six types of injection techniques like Boolean based blind, error-based blind, time-based blind, and different types. Automatically recognizes password hash formats, and can crack them easily. It can also search individual databases for names, specified tables, or can search an entire database table looking for the desired column. It can download and upload any file from the database server system at any time. Arbitrary command execution is also possible in SQL maps, as it can retrieve the standard output of the command on the database server. It can simultaneously dump large database tables or a vast range of entries as per the demand of the user. It can also establish an out of band TCP connection between the user and the targeted database server. (Friedman, Pawlowski, & Cieslewicz (2009).

History of SQL maps

In July 2006, Daniele Bellucci developed an SQL map skeleton with a limited usage range and developed it. It had limited support for my SQL. In august of the same year, Daniele added another support for PostGRE SQL and released 0.1 version. This was the earliest known SQL map that ever existed. Later on, it was modified many times, and improvements were added over time. In December of 2006, Daniele had left the development, which was then taken up by Bernado Damele A.G. Bernado introduced version 0.2 after adding significant enhancements to the project and adding DBMS fingerprint functionalities. He also had replaced the older algorithm designed by Daniele with a new one designed by him, which had some upgrades.

Impact of SQL map attacks

SQL map attacks can lead to a variety of problems for the person or an organization that has been targeted by the attacker. Personal information like passwords, mail Id, login credentials, bank details, credit card details, and others can be compromised. For a company, SQL attacks can leak information like access codes, employee details, customer transactions, and others. This can result in customer dissatisfaction and can affect the goodwill of the company in a significant way. (Gudipati, et al. (2016). Furthermore, it can provide unwanted access to the company to the attacker, who can exploit it if it is left unchecked.