SlideShare ist ein Scribd-Unternehmen logo
1 von 46
Downloaden Sie, um offline zu lesen
sqlmap – why (not how)
it works?
Miroslav Stampar
(miroslav@sqlmap.org)
sqlmap – why (not how)
it works?
Miroslav Stampar
(miroslav@sqlmap.org)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 2
Formal introduction
sqlmap is an open source penetration testing
tool that automates the process of
detecting and exploiting SQL injection
flaws and taking over of database
servers. It comes with a powerful detection
engine, many niche features for the ultimate
penetration tester and a broad range of
switches lasting from database fingerprinting,
over data fetching from the database, to
accessing the underlying file system and
executing commands on the operating system
via out-of-band connections.
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 3
Birthday
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 4
Short history
Daniele Belluci (@belch) – July 1st
2006,
birthday of @sqlmap
Bernardo Damele A. G. (@inquisb) – late 2006,
joins the @sqlmap
Daniele Belluci (@belch) – late 2006, leaves the
@sqlmap
Miroslav Stampar (@stamparm) – late 2009,
joins the @sqlmap
...and they lived happily ever after :)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 5
sqlmap.py (1)
Version Release date Switches / options Code files LOC Total size
0.(0.)1 2006-06-01 16 3 339 64KB
0.2 2006-12-13 20 7 1117 116KB
0.3 2007-01-20 24 8 1731 160KB
0.4 2007-06-15 34 18 3819 468KB
0.5 2007-11-04 37 23 5711 680KB
0.6 2008-09-01 47 55 11920 1.2MB
0.7 2009-07-25 75 85 19387 5.1MB
0.8 2010-03-14 94 96 22840 5.7MB
0.9 2011-04-10 115 212 38787 9.5MB
1.0(-dev-f89ce21) 177 375 60995 12MB
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 6
sqlmap.py (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 7
sqlmap.py (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 8
sqlmap.org (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 9
sqlmap.org (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 10
sqlmap.org (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 11
sqlmap.org (4)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 12
SourceForge (obsolete)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 13
Mailing list (deprecated)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 14
GitHub (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 15
GitHub (2)
cuckoobox/cuckoo
beefproject/beef
andresriancho/w3af
sqlmapproject/sqlmap
rapid7/metasploit-framework
bro/bro
sleuthkit/sleuthkit
wireshark/wireshark
aircrack-ng/aircrack-ng
...
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 16
GitHub (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 17
GitHub (4)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 18
GitHub (5)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 19
GitHub (6)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 20
GitHub (7)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 21
sqlmapreporter (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 22
sqlmapreporter (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 23
sqlmapreporter (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 24
sqlmapreporter (4)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 25
testenv (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 26
testenv (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 27
testenv (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 28
Benchmark (sectoolmarket.com)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 29
Twitter (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 30
Twitter (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 31
Twitter (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 32
Twitter (4)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 33
Twitter (5)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 34
Donations (PayPal)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 35
???
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 36
Donations (Ƀitcoin)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 37
Dual license (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 38
Dual license (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 39
sqlmappro (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 40
sqlmappro (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 41
BOFH (1)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 42
BOFH (2)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 43
BOFH (3)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 44
BOFH (4)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 45
Answer to the title's question
Because of the long-lasting enthusiasm of a
couple of guys having a large, (very)
demanding and quite responsive user-base
(and couple of angry trolls)
...
...and they lived happily ever after :)
Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 46
Questions?

Weitere ähnliche Inhalte

Was ist angesagt?

Advanced Sql Injection ENG
Advanced Sql Injection ENGAdvanced Sql Injection ENG
Advanced Sql Injection ENG
Dmitry Evteev
 
Oracle Clusterware Node Management and Voting Disks
Oracle Clusterware Node Management and Voting DisksOracle Clusterware Node Management and Voting Disks
Oracle Clusterware Node Management and Voting Disks
Markus Michalewicz
 

Was ist angesagt? (20)

Advanced SQL injection to operating system full control (slides)
Advanced SQL injection to operating system full control (slides)Advanced SQL injection to operating system full control (slides)
Advanced SQL injection to operating system full control (slides)
 
Advanced SQL injection to operating system full control (whitepaper)
Advanced SQL injection to operating system full control (whitepaper)Advanced SQL injection to operating system full control (whitepaper)
Advanced SQL injection to operating system full control (whitepaper)
 
Deep review of LMS process
Deep review of LMS processDeep review of LMS process
Deep review of LMS process
 
DNS exfiltration using sqlmap
DNS exfiltration using sqlmapDNS exfiltration using sqlmap
DNS exfiltration using sqlmap
 
Expanding the control over the operating system from the database
Expanding the control over the operating system from the databaseExpanding the control over the operating system from the database
Expanding the control over the operating system from the database
 
ORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORM
 
I Know Your P4$$w0rd (And If I Don't, I Will Guess It...)
I Know Your P4$$w0rd (And If I Don't, I Will Guess It...)I Know Your P4$$w0rd (And If I Don't, I Will Guess It...)
I Know Your P4$$w0rd (And If I Don't, I Will Guess It...)
 
Caching
CachingCaching
Caching
 
Oracle ASM Training
Oracle ASM TrainingOracle ASM Training
Oracle ASM Training
 
SQL Plan Directives explained
SQL Plan Directives explainedSQL Plan Directives explained
SQL Plan Directives explained
 
Sql injections - with example
Sql injections - with exampleSql injections - with example
Sql injections - with example
 
Oracle Performance Tuning Fundamentals
Oracle Performance Tuning FundamentalsOracle Performance Tuning Fundamentals
Oracle Performance Tuning Fundamentals
 
Redo log improvements MYSQL 8.0
Redo log improvements MYSQL 8.0Redo log improvements MYSQL 8.0
Redo log improvements MYSQL 8.0
 
Oracle_Multitenant_19c_-_All_About_Pluggable_D.pdf
Oracle_Multitenant_19c_-_All_About_Pluggable_D.pdfOracle_Multitenant_19c_-_All_About_Pluggable_D.pdf
Oracle_Multitenant_19c_-_All_About_Pluggable_D.pdf
 
Evading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory DominationEvading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory Domination
 
Sqlmap
SqlmapSqlmap
Sqlmap
 
Oracle 12cR2 Installation On Linux With ASM
Oracle 12cR2 Installation On Linux With ASMOracle 12cR2 Installation On Linux With ASM
Oracle 12cR2 Installation On Linux With ASM
 
Advanced Sql Injection ENG
Advanced Sql Injection ENGAdvanced Sql Injection ENG
Advanced Sql Injection ENG
 
Oracle Clusterware Node Management and Voting Disks
Oracle Clusterware Node Management and Voting DisksOracle Clusterware Node Management and Voting Disks
Oracle Clusterware Node Management and Voting Disks
 
InnoDB MVCC Architecture (by 권건우)
InnoDB MVCC Architecture (by 권건우)InnoDB MVCC Architecture (by 권건우)
InnoDB MVCC Architecture (by 권건우)
 

Andere mochten auch

Andere mochten auch (14)

Non-Esoteric XSS Tips & Tricks
Non-Esoteric XSS Tips & TricksNon-Esoteric XSS Tips & Tricks
Non-Esoteric XSS Tips & Tricks
 
SQLMAP Tool Usage - A Heads Up
SQLMAP Tool Usage - A  Heads UpSQLMAP Tool Usage - A  Heads Up
SQLMAP Tool Usage - A Heads Up
 
2014 – Year of Broken Name Generator(s)
2014 – Year of Broken Name Generator(s)2014 – Year of Broken Name Generator(s)
2014 – Year of Broken Name Generator(s)
 
Data Retrieval over DNS in SQL Injection Attacks
Data Retrieval over DNS in SQL Injection AttacksData Retrieval over DNS in SQL Injection Attacks
Data Retrieval over DNS in SQL Injection Attacks
 
Smashing the Buffer
Smashing the BufferSmashing the Buffer
Smashing the Buffer
 
Curious Case of SQLi
Curious Case of SQLiCurious Case of SQLi
Curious Case of SQLi
 
Riding the Overflow - Then and Now
Riding the Overflow - Then and NowRiding the Overflow - Then and Now
Riding the Overflow - Then and Now
 
Hash DoS Attack
Hash DoS AttackHash DoS Attack
Hash DoS Attack
 
Analysis of mass SQL injection attacks
Analysis of mass SQL injection attacksAnalysis of mass SQL injection attacks
Analysis of mass SQL injection attacks
 
Spot the Web Vulnerability
Spot the Web VulnerabilitySpot the Web Vulnerability
Spot the Web Vulnerability
 
Riding the Overflow - Then and Now
Riding the Overflow - Then and NowRiding the Overflow - Then and Now
Riding the Overflow - Then and Now
 
Revista derecho constitucional (derechos humanos y estados de excepción)
Revista derecho constitucional (derechos humanos y estados de excepción)Revista derecho constitucional (derechos humanos y estados de excepción)
Revista derecho constitucional (derechos humanos y estados de excepción)
 
Evolucion historica de la criminologia
Evolucion historica de la criminologiaEvolucion historica de la criminologia
Evolucion historica de la criminologia
 
Ladies waterproof head scarf
Ladies waterproof head scarfLadies waterproof head scarf
Ladies waterproof head scarf
 

Ähnlich wie sqlmap - why (not how) it works?

Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...
Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...
Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...
Alfredo BALLESTER FERNÁNDEZ
 
Tracxn - Big Data Infrastructure Startup Landscape
Tracxn - Big Data Infrastructure Startup LandscapeTracxn - Big Data Infrastructure Startup Landscape
Tracxn - Big Data Infrastructure Startup Landscape
Amar Christy
 

Ähnlich wie sqlmap - why (not how) it works? (16)

UKSG Conference 2015 - E-resources: ezPAARSE helps you discover who is readin...
UKSG Conference 2015 - E-resources: ezPAARSE helps you discover who is readin...UKSG Conference 2015 - E-resources: ezPAARSE helps you discover who is readin...
UKSG Conference 2015 - E-resources: ezPAARSE helps you discover who is readin...
 
Funnel Analysis with Apache Spark and Druid
Funnel Analysis with Apache Spark and DruidFunnel Analysis with Apache Spark and Druid
Funnel Analysis with Apache Spark and Druid
 
Azure Stream Analytics
Azure Stream AnalyticsAzure Stream Analytics
Azure Stream Analytics
 
RuleML2015: Compact representation of conditional probability for rule-based...
RuleML2015:  Compact representation of conditional probability for rule-based...RuleML2015:  Compact representation of conditional probability for rule-based...
RuleML2015: Compact representation of conditional probability for rule-based...
 
Real-time user profiling based on Spark streaming and HBase by Arkadiusz Jach...
Real-time user profiling based on Spark streaming and HBase by Arkadiusz Jach...Real-time user profiling based on Spark streaming and HBase by Arkadiusz Jach...
Real-time user profiling based on Spark streaming and HBase by Arkadiusz Jach...
 
SiamQuant Workshop 2.0 Slides
SiamQuant Workshop 2.0 SlidesSiamQuant Workshop 2.0 Slides
SiamQuant Workshop 2.0 Slides
 
Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...
Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...
Low-cost data-driven 3D reconstruction and its applications @ 6th ICE 3D Body...
 
LINEデリマでのElasticsearchの運用と監視の話
LINEデリマでのElasticsearchの運用と監視の話LINEデリマでのElasticsearchの運用と監視の話
LINEデリマでのElasticsearchの運用と監視の話
 
The RIPE Atlas Global Internet Measurement Network
The RIPE Atlas Global Internet Measurement NetworkThe RIPE Atlas Global Internet Measurement Network
The RIPE Atlas Global Internet Measurement Network
 
Exploratory data analysis in R - Data Science Club
Exploratory data analysis in R - Data Science ClubExploratory data analysis in R - Data Science Club
Exploratory data analysis in R - Data Science Club
 
Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Sour...
Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Sour...Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Sour...
Analyzing the State of Static Analysis: A Large-Scale Evaluation in Open Sour...
 
Tracxn - Big Data Infrastructure Startup Landscape
Tracxn - Big Data Infrastructure Startup LandscapeTracxn - Big Data Infrastructure Startup Landscape
Tracxn - Big Data Infrastructure Startup Landscape
 
RIPE Atlas streaming
RIPE Atlas streamingRIPE Atlas streaming
RIPE Atlas streaming
 
Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)
Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)
Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)
 
Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)
Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)
Scaling Agile Data Warehousing with the Scaled Agile Framework (SAFe)
 
Alessandro Terenzi (InGlobe Technologies): Object Tracking with ARMedia SDK
Alessandro Terenzi (InGlobe Technologies): Object Tracking with ARMedia SDKAlessandro Terenzi (InGlobe Technologies): Object Tracking with ARMedia SDK
Alessandro Terenzi (InGlobe Technologies): Object Tracking with ARMedia SDK
 

Mehr von Miroslav Stampar (7)

sqlmap - "One Tiny Step At a Time"
sqlmap - "One Tiny Step At a Time"sqlmap - "One Tiny Step At a Time"
sqlmap - "One Tiny Step At a Time"
 
Blind WAF identification
Blind WAF identificationBlind WAF identification
Blind WAF identification
 
sqlmap internals
sqlmap internalssqlmap internals
sqlmap internals
 
Why everybody should do CTF / Wargames?
Why everybody should do CTF / Wargames?Why everybody should do CTF / Wargames?
Why everybody should do CTF / Wargames?
 
Improving Network Intrusion Detection with Traffic Denoise
Improving Network Intrusion Detection with Traffic DenoiseImproving Network Intrusion Detection with Traffic Denoise
Improving Network Intrusion Detection with Traffic Denoise
 
APT Attacks on Critical Infrastructure
APT Attacks on Critical InfrastructureAPT Attacks on Critical Infrastructure
APT Attacks on Critical Infrastructure
 
WARNING: Do Not Feed the Bears
WARNING: Do Not Feed the BearsWARNING: Do Not Feed the Bears
WARNING: Do Not Feed the Bears
 

Kürzlich hochgeladen

Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLLucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
imonikaupta
 
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
nirzagarg
 
💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋
💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋
💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋
nirzagarg
 
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
@Chandigarh #call #Girls 9053900678 @Call #Girls in @Punjab 9053900678
 
VIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 

Kürzlich hochgeladen (20)

Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
 
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
 
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
 
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceBusty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
 
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLLucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
 
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
 
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
 
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
 
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Russian Call Girls in %(+971524965298  )#  Call Girls in DubaiRussian Call Girls in %(+971524965298  )#  Call Girls in Dubai
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
 
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready For S...Katraj ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
 
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Top Rated  Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...Top Rated  Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
 
💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋
💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋
💚😋 Bilaspur Escort Service Call Girls, 9352852248 ₹5000 To 25K With AC💚😋
 
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
 
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
 
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting  High Prof...VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting  High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
 
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...
 
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Himatnagar 7001035870 Whatsapp Number, 24/07 Booking
 
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
 
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
6.High Profile Call Girls In Punjab +919053900678 Punjab Call GirlHigh Profil...
 
VIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Pollachi 7001035870 Whatsapp Number, 24/07 Booking
 

sqlmap - why (not how) it works?

  • 1. sqlmap – why (not how) it works? Miroslav Stampar (miroslav@sqlmap.org) sqlmap – why (not how) it works? Miroslav Stampar (miroslav@sqlmap.org)
  • 2. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 2 Formal introduction sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
  • 3. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 3 Birthday
  • 4. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 4 Short history Daniele Belluci (@belch) – July 1st 2006, birthday of @sqlmap Bernardo Damele A. G. (@inquisb) – late 2006, joins the @sqlmap Daniele Belluci (@belch) – late 2006, leaves the @sqlmap Miroslav Stampar (@stamparm) – late 2009, joins the @sqlmap ...and they lived happily ever after :)
  • 5. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 5 sqlmap.py (1) Version Release date Switches / options Code files LOC Total size 0.(0.)1 2006-06-01 16 3 339 64KB 0.2 2006-12-13 20 7 1117 116KB 0.3 2007-01-20 24 8 1731 160KB 0.4 2007-06-15 34 18 3819 468KB 0.5 2007-11-04 37 23 5711 680KB 0.6 2008-09-01 47 55 11920 1.2MB 0.7 2009-07-25 75 85 19387 5.1MB 0.8 2010-03-14 94 96 22840 5.7MB 0.9 2011-04-10 115 212 38787 9.5MB 1.0(-dev-f89ce21) 177 375 60995 12MB
  • 6. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 6 sqlmap.py (2)
  • 7. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 7 sqlmap.py (3)
  • 8. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 8 sqlmap.org (1)
  • 9. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 9 sqlmap.org (2)
  • 10. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 10 sqlmap.org (3)
  • 11. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 11 sqlmap.org (4)
  • 12. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 12 SourceForge (obsolete)
  • 13. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 13 Mailing list (deprecated)
  • 14. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 14 GitHub (1)
  • 15. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 15 GitHub (2) cuckoobox/cuckoo beefproject/beef andresriancho/w3af sqlmapproject/sqlmap rapid7/metasploit-framework bro/bro sleuthkit/sleuthkit wireshark/wireshark aircrack-ng/aircrack-ng ...
  • 16. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 16 GitHub (3)
  • 17. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 17 GitHub (4)
  • 18. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 18 GitHub (5)
  • 19. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 19 GitHub (6)
  • 20. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 20 GitHub (7)
  • 21. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 21 sqlmapreporter (1)
  • 22. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 22 sqlmapreporter (2)
  • 23. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 23 sqlmapreporter (3)
  • 24. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 24 sqlmapreporter (4)
  • 25. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 25 testenv (1)
  • 26. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 26 testenv (2)
  • 27. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 27 testenv (3)
  • 28. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 28 Benchmark (sectoolmarket.com)
  • 29. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 29 Twitter (1)
  • 30. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 30 Twitter (2)
  • 31. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 31 Twitter (3)
  • 32. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 32 Twitter (4)
  • 33. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 33 Twitter (5)
  • 34. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 34 Donations (PayPal)
  • 35. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 35 ???
  • 36. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 36 Donations (Ƀitcoin)
  • 37. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 37 Dual license (1)
  • 38. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 38 Dual license (2)
  • 39. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 39 sqlmappro (1)
  • 40. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 40 sqlmappro (2)
  • 41. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 41 BOFH (1)
  • 42. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 42 BOFH (2)
  • 43. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 43 BOFH (3)
  • 44. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 44 BOFH (4)
  • 45. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 45 Answer to the title's question Because of the long-lasting enthusiasm of a couple of guys having a large, (very) demanding and quite responsive user-base (and couple of angry trolls) ... ...and they lived happily ever after :)
  • 46. Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 46 Questions?