SQLMAP Database Hacking - An Easier Way

Using sqlmap in conjuction with burpsuite (easy)

tools:sqlmap, burpsuite
OS: kali linux

previously in this blog post we used passed some parameters to sqlmap to aid in our attack, well there is a faster method of passing data to sqlmap from burpsuite and its easy

navigate to

• http://192.168.0.9/mutillidae/index.php?page=login.php

which is the login page we wish to bypass

• attempt to login using ANY username & ANY password 
• capture the POST request using burpsuite
• right click on the request 
• select save item (then save to your chosen location)

now we can run the sqlmap command easily without passing all the parameters to it  we simply run

sqlmap -r "PATH_TO_SAVED_REQUEST"

I saved the request as sqlmap-practice

This makes it much easier to pass data to sqlmap, however to fully exploit the database ie hack the accounts we still need to find out the following;

database name

database tables

database column

this can only be done (as far as im aware) via experience and/or trial and error

I've utilized this easier method to successfully attack and own all
OWASP A1 (SQL Injection lessons) in mutillidae