WEBVTT

00:00:00.040 --> 00:00:00.840
In this course,

00:00:00.840 --> 00:00:03.920
we've only been able to scratch the surface of sqlmap's functionality.

00:00:04.330 --> 00:00:07.450
I use it on almost every engagement, and I'm still learning new tricks.

00:00:07.840 --> 00:00:11.740
It's easy to add new payloads to sqlmap, as well as modifying existing ones.

00:00:12.050 --> 00:00:14.110
This can be necessary when trying to exploit

00:00:14.110 --> 00:00:16.149
vulnerabilities in complicated places.

00:00:17.140 --> 00:00:20.280
Another area that we didn't cover that you will run into is

00:00:20.280 --> 00:00:21.970
the issue of web application firewalls.

00:00:21.970 --> 00:00:26.250
Sqlmap doesn't perform any obfuscation on the payloads it sends.

00:00:26.940 --> 00:00:30.310
You can use sqlmap's tamper option to perform obfuscation or

00:00:30.320 --> 00:00:32.689
other transformations on your payloads.

00:00:32.700 --> 00:00:35.840
Sqlmap has a list of common obfuscation techniques built in,

00:00:35.850 --> 00:00:38.160
but it's also very easy to create your own tamper scripts.

00:00:39.040 --> 00:00:42.970
This can be helpful in bypassing web application firewalls or other

00:00:42.970 --> 00:00:45.670
custom input validation routines that might be in place.

00:00:46.640 --> 00:00:48.460
For out‑of‑band data exfiltration,

00:00:48.470 --> 00:00:50.870
you can use sqlmap's built‑in DNS capabilities.

00:00:51.840 --> 00:00:55.300
For scripting and automation, sqlmap also provides a RESTful Web API.

00:00:55.300 --> 00:00:58.950
We gained our initial server access through a web shell.

00:00:59.440 --> 00:01:02.560
While this works for initial access, you'll want something more robust.

00:01:03.030 --> 00:01:06.270
To this end, sqlmap also supports Metasploit integration.

00:01:06.740 --> 00:01:08.730
This means that when exploiting a SQL injection,

00:01:08.740 --> 00:01:11.450
instead of a web shell, you can go right to a Metasploit session.

00:01:12.040 --> 00:01:14.330
Sqlmap is open source and written in Python.

00:01:14.340 --> 00:01:18.110
If you're interested in working on new features or adding additional features,

00:01:18.120 --> 00:01:19.800
check out the FAQ to get started.

00:01:19.810 --> 00:01:23.520
Also on the Wiki is one of my most referred to resources. The Usage

00:01:23.520 --> 00:01:25.300
Wiki page lists all the command line options,

00:01:25.300 --> 00:01:27.370
along with a detailed explanation of each.

00:01:28.040 --> 00:01:30.190
I hope you leave this course with enough information to start

00:01:30.190 --> 00:01:32.060
using sqlmap as part of your tool chain.

00:01:32.640 --> 00:01:34.050
Thank you for watching Pluralsight.

00:01:34.060 --> 00:01:36.460
I hope you join me and other authors to add to your

00:01:36.460 --> 00:01:38.460
arsenal of red team tools in the future.