Blind SQL Injections with SQLMap against the DVWA

In our playlist on how to perform SQL injections, we've been attacking our targets manually. In this video, we use a tool called sqlmap to automate our Blind SQLi attacks against the Damn Vulnerable Web Application (DVWA).
See how to use sqlmap to find blind SQL injections in the OWASP Juice Shop: • Video
The DVWA is meant to be a safe and fun place to practice our skills. Do not perform these attacks against resources you do not have explicit permissions for. However, doing this against applications you do own or have written permissions for is highly recommended in order to help you find vulnerabilities before malicious actors do.
This video is extracted from our free course called "Injection Attacks: The Free Guide" available here: cybr.com/cours...
This video is part of a playlist on SQL injections: • SQL Injections

[@daelonvondavis6802]

Good info, straight to the point, fast paced but easy to follow. Keep making videos please.

[@Cybrcom]

Thank you for your feedback! Super helpful

[@Cybrcom]

Our free eBook covers the topics reviewed in our course. It explores one of the biggest risks facing web applications today: SQL injections. Think of this as your reference guide that includes concepts to understand, attacks you can perform in safe & legal environments, and defense controls you can implement for your network, applications, and databases. Download your free eBook here: cybr.com/ebooks/sql-injection-attacks/

[@Free.Education786]

Thank you brother. You and your channel is world best channel who teaches noobes from 0 2 h3r0. Love U Respect U Salute U 🤝❤💙💚💐👍

[@babashehumodu1463]

Good a very great tutorial am understands a lots about sqlmap, please next sir.

[@drego05]

Great video man, I also discovered that you can use the -r parameter, and give it the actual saved request data from Burp or whatever else you use to capture the POST request

[@Cybrcom]

Great tip!

[@Free.Education786]

Please share more complex real life examples like Finding Vulnerable Columns, SQLMAP WAF BYPASS techniques, UPLOAD SHELL and MD5 HASH decryption n other types of error handling. Remember in real life examples SQLMAP got failed because 99.99% people don't know advanced options. Thanks for your help and support brother 🤝❤💙💚💐👍

[@Cybrcom]

We're working on more content that I think you're going to like based on your requests :-) stay tuned!

[@muhammadsuleman1242]

Quite elaborate! Good video quality as well!

[@Cybrcom]

Thank you! We've got a full course on SQL injections that's available for free here if you'd like more content like this: cybr.com/courses/injection-attacks-the-free-2020-guide/

[@linnhushovd6651]

is this manual or automated blind sql injection? great video!

[@Cybrcom]

Thanks! Automated is when you’re using automated tools to find injections, so when we’re using sqlmap we’re performing automated attacks

[@nogoodhacker6944]

Video was quite crisp and clear man, thanks for the content but can you tell me how to find for vulnerable areas of a website except google dorking?

[@Cybrcom]

Thanks for the kind comment! That is a huge question that I definitely can't answer in just a comment like this :-). You will learn this by continuing to train

[@nogoodhacker6944]

@@Cybrcom yeah, so please try to make a series of videos if you (can) ❤️

[@Free.Education786]

I am lazy and hate manual SQLi using hack bar. One day I saw SQLMAP and I was on sevent sky but after some tries I realized it is excellent SQLi tool but alas no one knows about it completely. Like for instance SQLMAP stucks with error no 400 till 502 I mean different WAF. Then again I discovered that has built-in 65 WAF BYPASS scripts in it but alas AGAIN I failed to find any complete tutorial about SQLMAP where it bypass different types of WAF n WAF relared errors like 404...etc.... Inshort please teach us how to exploit different types of SQLi vulnerabilities with different WAF error numbers only using SQLMAP.... Accept my apologies for any inconvenience. Thanks for your help and support brother Lov3 U R3sp3ct U S4lu7e U 🤝😘😍❤💚💙🤗🤩👍

[@Cybrcom]

We're working on a course that will do just that right now actually :). It will launch this month in early release and then be complete next month. You can get notified here: cybr.com/courses/sqlmap-the-ultimate-guide/

[@jaeger809]

Boss. I found xss and sql injection vulnerable in a website and I don't know how to make a report. Do i need to make a list of all the data which i took from the database to prove them?

[@Cybrcom]

Was this part of a bug bounty? If so, they should have instructions on how to submit. Otherwise, they may have security reporting contact form on their website. If they don't, you can always try reaching out via their regular support channels.

[@DEADCODE_]

Skip --batch