sqlmap - why (not how) it works?

sqlmap – why (not how)it works?

Miroslav Stampar([email protected])

sqlmap – why (not how)it works?

Miroslav Stampar([email protected])

Navaja Negra & ConectaCon, Albacete (Spain) October 02nd, 2015 2

Formal introduction

sqlmap is an open source penetration testing tool that automates the process of

detecting and exploiting SQL injection flaws and taking over of database

servers. It comes with a powerful detection engine, many niche features for the ultimate

penetration tester and a broad range of switches lasting from database fingerprinting,

over data fetching from the database, to accessing the underlying file system and

executing commands on the operating system via out-of-band connections.


Birthday


Short history

Daniele Belluci (@belch) – July 1st 2006, birthday of @sqlmap

Bernardo Damele A. G. (@inquisb) – late 2006, joins the @sqlmap

Daniele Belluci (@belch) – late 2006, leaves the @sqlmap

Miroslav Stampar (@stamparm) – late 2009, joins the @sqlmap

...and they lived happily ever after :)


sqlmap.py (1)

Version Release date Switches / options Code files LOC Total size

0.(0.)1 2006-06-01 16 3 339 64KB

0.2 2006-12-13 20 7 1117 116KB

0.3 2007-01-20 24 8 1731 160KB

0.4 2007-06-15 34 18 3819 468KB

0.5 2007-11-04 37 23 5711 680KB

0.6 2008-09-01 47 55 11920 1.2MB

0.7 2009-07-25 75 85 19387 5.1MB

0.8 2010-03-14 94 96 22840 5.7MB

0.9 2011-04-10 115 212 38787 9.5MB

1.0(-dev-f89ce21) 177 375 60995 12MB


sqlmap.py (2)


sqlmap.py (3)


sqlmap.org (1)


sqlmap.org (2)


sqlmap.org (3)


sqlmap.org (4)


SourceForge (obsolete)


Mailing list (deprecated)


GitHub (1)


GitHub (2)

cuckoobox/cuckoobeefproject/beefandresriancho/w3afsqlmapproject/sqlmaprapid7/metasploit-frameworkbro/brosleuthkit/sleuthkitwireshark/wiresharkaircrack-ng/aircrack-ng...


GitHub (3)


GitHub (4)


GitHub (5)


GitHub (6)


GitHub (7)


sqlmapreporter (1)


sqlmapreporter (2)


sqlmapreporter (3)


sqlmapreporter (4)


testenv (1)


testenv (2)


testenv (3)


Benchmark (sectoolmarket.com)


Twitter (1)


Twitter (2)


Twitter (3)


Twitter (4)


Twitter (5)


Donations (PayPal)


???


Donations (Ƀitcoin)


Dual license (1)


Dual license (2)


sqlmappro (1)


sqlmappro (2)


BOFH (1)


BOFH (2)


BOFH (3)


BOFH (4)


Answer to the title's question

Because of the long-lasting enthusiasm of a couple of guys having a large, (very) demanding and quite responsive user-base (and couple of angry trolls)

......and they lived happily ever after :)


Questions?

sqlmap - why (not how) it works?

Internet

Transcript of sqlmap - why (not how) it works?