SQL Map Basics

Overview

 

SQL map is a software which is available open-sourced to the general users and is usually used as a SQL injection tool to identify the vulnerabilities in a SQL injection. ( Ibrahim & Kant (2018). It can also be used to gain access to a database running on those injections. It can enable the user to add, delete, modify, alter or even compromise the said database on which the attack is happening. It is backed by a potent detection engine and has a broad range of features along with various switches which can be used for executing commands through external connections.

Capabilities

 

SQL map is capable of doing many things and has a varied set of features, as discussed earlier. It supports varieties of database formats such as Microsoft SQL, MySQL, Oracle, PostGRE SQL, IBM DB2, Microsoft Access, firebird, SQ lite and many others. Commands can be executed with relative ease on the SQL injections as compared to other tools.

It enables the user to connect directly to the database by proving the port number, IP address and other credentials without passing through an injection. Passwords and hash formats are recognized automatically and are cracked using a dictionary-based attack. Specific database names, specific tables across a database table, or specific database tables can be searched using this. Arbitrary commands can be executed, and their standard outputs can be easily retrieved.  User privilege system is supported by using a get-system command.

Development History

 

This first SQL map was developed in 2006 by Daniele Bellucci. He wrote an algorithm based on MySQL support. Later, in August of the same year and came up with version 0.1 after adding support of PostGRE SQL, which was the first model to be launched. Daniele left the project later in that year, which was taken over by Bernado Damele AG. (Akbar & Ridha (2018). Bernado wrote a new algorithm for the map and replaced the older one who had limited support. He also made significant enhancements, added the support of DBMS fingerprint, and launched version 0.2 in December. With time, many variants have been introduced after upgrading, the latest one being launched in January 2020.

SQL Attacks

 

SQL attacks on a company or an individual can result in significant losses and can compromise a considerable set of data belonging to them. For an individual, SQL attacks can endanger the security of passwords, login credentials, credit card data, personal transaction data, browsing history, among others. (Holík & Neradova (2017). For a company or an organization, it can compromise the confidential company data, employee details, transactional details, production history, system records, customer details and many others, which can majorly tarnish the image of the company and result in loss of goodwill. Furthermore, it can affect the stick prices if the company, and for an individual, it can cause irreversible damage to his/her data. If left unchecked, any outside user can use SQL maps to gain unwanted access to the database of the system, and can siphon off data from the inside, or can illegally surveil a system.