Lab: authorized extraction and detection

Reproduce the audit against a local vulnerable application (e.g., a Docker container running owasp/webgoat or a custom vulnerable PHP script at http://10.10.10.50/page.php?id=1). Work each step, predict the outcome, then reveal it. (In the live site this runs against the built-in terminal engine.)

STEP 01 · DISCOVERY

Run sqlmap against the target URL to confirm the parameter is vulnerable and list the databases.

sqlmap -u "http://10.10.10.50/page.php?id=1" --batch --dbs

What flag tells sqlmap to automate all prompts, and what does --dbs do?

--batch tells sqlmap to never pause for user input, answering 'yes' to everything. --dbs instructs it to enumerate and list all available database names on the backend server.

STEP 02 · ENUMERATE TABLES

Target the discovered database (e.g., customer_db) and list its tables.

sqlmap -u "http://10.10.10.50/page.php?id=1" --batch --tables -D customer_db

Why is specifying -D important before dumping?

Specifying -D tells sqlmap exactly which database to query. Without it, sqlmap might dump tables from the wrong database or waste time scanning system databases like information_schema that contain metadata but no business data.

STEP 03 · EXTRACT DATA

Dump the contents of the users table, focusing only on the username and email columns.

sqlmap -u "http://10.10.10.50/page.php?id=1" --batch --dump -T users -C username,email

What do the -T and -C flags control?

-T specifies the target table, and -C specifies the exact columns to extract. This limits the noise and focuses the extraction on the sensitive fields you are authorized to test.

STEP 04 · CAPTURED REQUESTS

You have a saved HTTP request file (request.txt). Feed it to sqlmap instead of constructing the URL manually.

sqlmap -r request.txt --batch

Why would an attacker use -r instead of -u?

Using -r allows the attacker to bypass basic URL-based WAF rules. They can capture a legitimate, authenticated, or POST-based request, modify the parameter slightly in the raw text file, and re-send it, making the automated attack look like legitimate application traffic.

STEP 05 · ADJUSTING AGGRESSIVENESS

Increase the risk and level to force sqlmap to test for more complex injection techniques (like time-based blind).

sqlmap -u "http://10.10.10.50/page.php?id=1" --batch --risk=3 --level=5

What is the trade-off of increasing --risk and --level?

Higher risk and level values make sqlmap test for more obscure and destructive injection payloads, increasing the chance of successful data extraction. The trade-off is a massive increase in network traffic, a higher probability of triggering WAF blocks or IDS alerts, and a greater chance of causing database performance issues or crashes.

Finish and you've run the full authorized extraction arc: discover → enumerate → dump → capture → adjust. That's the loop an attacker uses to drain a database, and the exact pattern you must hunt for in your logs.

TOOL ARSENAL