Fun with Burp Suite Session Handling, Extensions, and SQLMap Ryan Wendel / April 30, 2019 I’ve been a little obsessed with the session handling tool-set that Burp Suite provides. Burp Suite provides a very basic SDK known as Burp Extender. Burp Extender allows third parties to extend the features of an already powerful web application testing suite. In March of this year, Daniel Garcia (cr0hn) created a SQLmap plugin for Burp using the Burp Extender SDK. With Daniel’s SQLmap plugin, automated SQL injection discovery.

SQLiPy is a Python plugin that integrates Burp Suite with SQLMap using the SQLMap API. Benefits of this plugin: No need of remembering commands Can send the request for scan from any Burp tab like. Open the OWASP ZAP (you can also try using Burp Suite) and click the firefox button. SQLMap is a fantastic tool for SQL Injection attacks. Of course, it’s not infallible, and some security. Introduction to Sqlmap Sqlmap an open source penetration testing tool that automates the detection and exploitation of SQL injection. I use when I suspect an endpoint to be vulnerable, or to automate the process of dumping sensitive data from the database server. For beginners, you can use sqlmap –wizard option, then follow the instructions.

This extension integrates Burp Suite with SQLMap.

Requirements:

Jython 2.7 beta, due to the use of json.
Java 1.7 or later (the beta version of Jython 2.7 requires this).
A running instance of the SQLMap API server.

SQLMap is embedded within the extension; it will be automatically configured, so you can click Start API.In some cases you may need to manually adjust the configuration or run the SQLMap API manually.

Once the SQLMap API is running, you just need to right-click in the 'Request' sub tab of either the Target or Proxy main tabs and choose 'SQLiPy Scan' from the context menu.This will populate the SQLMap Scanner tab with information about that request. Clicking the 'Start Scan' button will execute a scan.

If the page is vulnerable to SQL injection, then these will be added to the Scanner Results tab.

Rating
Author	Josh Berry @ CodeWatch
Version	0.8.2
Popularity
Last updated	04 March 2021

Please note that JavaScript must be enabled to display rating and popularity information.

You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.

You can view the source code for this BApp by visiting our GitHub page.

Follow @BApp_Store on Twitter to receive notifications of all BApp releases and updates.

Download BApp

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.

According to OWASP, injection attacks are still a common attack vector. There are several tools which can be used to exploit a SQL vulnerability. A personal favourite is SQLmap. However, understanding how SQLi works is an important aspect of penetration testing. It is also crucial to understand how the underlying infrastructure works when conducting these types of attacks. PentestMonkey has a great cheat sheet for when conducting manual SQLi.

Developing a vulnerable application

A vulnerable application was developed using Python with its Flask library. And yes, I am fully aware that the application might be a bit silly. However, these types of vulnerabilities are common due to poor coding practices – which is demonstrated in this example. The code snippet above shows how the application extracts the visitor’s User-Agent and IP address. The values are inserted into the logging table under the user_agent and ip columns. From thereon, the newly logged information is shown to the visitor.

The code itself seems secure enough for many developers, as the SQL query is “properly” formatted and the quotes are prepared on forehand. The format feature is widely used among other Python programmers. The same feature is used to insert the data directly into their specific value. This is (of course) secure! Right…?

The image above shows the application’s feature. When a client visits the web server, the User-Agent and IP address gets stored in the database and informs the user of the values.

Exploitation

The web request is sent to Burp Suite’s repeater. The User-Agent is modified to Hello world!, which has successfully been stored in the database. Great! We can modify the User-Agent and modify the stored value. Now what?

Changing the value to a ' displays an Internal Server Error. This is a clear indication that the value was not understood by the server, which is also known as an insufficient SQL query.

INSERT INTO logging (user_agent, ip) VALUES ('', '192.168.0.51')

The query above is what was executed by the server. No wonder it threw an error! Three ' follow by a , is bad news for the server. The SQL query is not complete. However, this is good news for an attacker, as it is vulnerable to SQLi.

Hello world!', (SELECT VERSION()))-- -

The payload above enters Hello world! into the user_agent table. However, the following value ', is used to “break out” of the SQL query and continue the syntax. From thereon, a subquery is used to select the SQL version number. The version is 10.3.23-MariaDB-1, which is basically MySQL.

Furthermore, when attempting to enumerate the existing databases, the server throws the error Subquery returns more than 1 row. This is because of the insert statement only inserts two values. The first value is used by the User-Agent, whilst the second for the IP address. If the requested output contains more than one value (such as listing the databases), these must be concatenated. Otherwise, the SQL query will not work. Listing the used database with Hello world!', (SELECT database())-- - reveals that the database is named platform. However, listing all the databases is preferred.

However, without all table and column names in the database, there is still “nothing” we can do. Therefore, the database’s contents must be enumerated further.

Hello world!', (SELECT GROUP_CONCAT(schema_name) FROM information_schema.schemata))-- -

The output displays that there are two databases: information_schema and platform. These are now concatenated together due to the output limitation.

Hello world!', (SELECT GROUP_CONCAT(table_schema, table_name, column_name) FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'))-- -

The query above enumerates all tables and columns in the platform database. The output shows a series of interesting tables, such as usernames and passwords.

The table and column names in the platform database have now been discovered. The final step is to select these values.

The usernames were successfully extracted from the usernames table. However, the values are still concatenated, as the query would not work without the GROUP_CONCAT() function.

The passwords were also successfully extracted from the database. The hashes can now be appropriately formatted before being cracked with either Hashcat or John the Ripper.

gareth:$2a$10$zd96ciX9Z8rWZOGFB7k/ou8gIWLeFqDcFAY9nqkQUui4Gy/vE1gUq john:$2a$10$MVMc8UJdcP9UrOoN46aNbOn6zP.13jt11uQzQ8xTBoMogaS2gPK.6 foo:$2a$10$FYJCqeO//Uq9EblIO4wfyezxUo.g/qtpynfyAJAe4pv9OPM/XoTuu

hashcat -D 2 -a 0 -m 3200 crack.txt /usr/share/seclists/Passwords/darkc0de.txt

The hashes can be cracked with hashcat with the syntax shown above. Any wordlist will do for weak/common passwords (such as these. Feel free to crack them). However, ensure that the driver for your GPU is installed, as hashcat supports GPU cracking, which is tremendously more powerful than CPU.

Fast track with SQLmap

sqlmap -u http://192.168.0.51:5000/ --dbms=mysql

The following syntax will automatically attempt to inject different payloads to exploit SQLi vulnerabilities. SQLmap will automatically detect injection points and attempt to exploit these, such as user agents,

Burp Suite Sqlmap