WEBVTT

00:00:05.340 --> 00:00:09.300
Welcome to Pluralsight and this Red Team tools course featuring sqlmap,

00:00:09.430 --> 00:00:12.830
the open source SQL injection exploitation tool developed and

00:00:12.830 --> 00:00:15.710
maintained by Bernardo Damele and Miroslav Stampar.

00:00:15.710 --> 00:00:20.380
SQL injections can affect applications of any type and are one of

00:00:20.380 --> 00:00:22.870
the most critical application security flaws.

00:00:23.640 --> 00:00:26.740
A SQL injection can expose applications to data loss

00:00:26.750 --> 00:00:28.780
or even lead to server compromise.

00:00:28.790 --> 00:00:32.290
Testing for SQL injections can be time consuming and error prone.

00:00:32.299 --> 00:00:34.260
When you do find an injection flaw,

00:00:34.270 --> 00:00:36.750
it can be extremely difficult and tedious to exploit.

00:00:37.240 --> 00:00:39.520
You'll also most likely need to write custom scripts to

00:00:39.520 --> 00:00:41.080
exploit the flaw in a useful way.

00:00:41.180 --> 00:00:43.360
This all eats up valuable time during an engagement.

00:00:43.740 --> 00:00:46.800
To make sure you're able to provide enough application test coverage,

00:00:46.810 --> 00:00:48.990
you need to use automation where it makes sense.

00:00:49.440 --> 00:00:52.860
You also need to use automation tools with care and be smart about it.

00:00:53.280 --> 00:00:57.480
Sqlmap reduces the time spent to identify and exploit SQL injection flaws.

00:00:58.040 --> 00:01:02.360
It simplifies the entire process of database enumeration and data exfiltration.

00:01:03.140 --> 00:01:06.950
You can even use sqlmap to gain an initial foothold into the target environment,

00:01:07.540 --> 00:01:09.970
a foothold you can use for further exploitation.

00:01:10.930 --> 00:01:13.860
Sqlmap is a powerful tool for automating all aspects

00:01:13.860 --> 00:01:15.550
of SQL injection exploitation.

00:01:16.040 --> 00:01:18.250
If you're seeking to learn how to use sqlmap to exploit

00:01:18.250 --> 00:01:20.270
SQL injections on your next engagement,

00:01:20.940 --> 00:01:24.060
or if you want to learn how attackers can use these same techniques,

00:01:24.540 --> 00:01:27.540
come join me and learn how to gain initial access using sqlmap,

00:01:27.540 --> 00:01:29.160
here at Pluralsight.