Hacking Databases.

In this tutorial, we will follow up on a previous tutorial on MySQL. In that tutorial, I showed you the basics of running a MySQL server on BackTrack. In addition, you might want to take a look at my tutorial on the basics of databases, if you are not familiar with databases and DataBase Management Systems (DBMS). Since MySQL is SO important in so many web applications, I will be doing more MySQL tutorials in the future. The more you know about MySQL, the better you can hack MySQL! Hacking Databases 

Generally, MySQL is teamed up with PHP and an Apache web server (often referred to as LAMPP or XAMPP) to build dynamic, database driven web sites. Such development packages as Drupal, Joomla, WordPress, Ruby on Rails and others all use MySQL as their default database. Millions of websites have MySQL backends and very often they are “homegrown” websites, without much attention on security.

In this tutorial, we will looking to extract information about an online MySQL database before we actually extract information from the database. Once again, I’ll repeat, the more we know, the more successful we will be in hacking and the less chance you will be detected. Hacking Databases 

Here, we will be using one of the best database hacking tools available, sqlmap. Sqlmap can be used for databases other than MySQL, such Microsoft’s SQL Server and Oracle, but here we will focus its capabilities on those ubiquitous web sites that are built with PHP, Apache and MySQL.

When we do so, sqlmap will target the scanme database and attempt to enumerate the tables and columns in the scanme database.

As we can see below, sqlmap successfully was able to enumerate three tables; (1) accounts, (2) inventory, and (3) orders, complete with column names and datatypes. Not Bad!

As you can see, sqlmap can be very versatile and useful tool for MySQL, as well as SQL Server and Oracle database hacking. We will plan on coming back to sqlmap in the near future to explore more of its extensive database hacking capabilities.

Keep coming back, my amateur hackers, for more adventures in Hackerland!