Finding and exploiting SQL injections with SQLMap

As seen in the previous recipe, exploiting SQLi can be an industrious process. SQLMap is a command-line tool included in Kali Linux that can help us with the automation of detecting and exploiting SQL injections with multiple techniques and in a wide variety of databases.

In this recipe, we will use SQLMap to detect and exploit an SQLi vulnerability and to obtain usernames and passwords of an application.

How to do it...

Browse to http://192.168.56.11/mutillidae and go to OWASP Top 10 | A1 – SQL Injection | SQLi Extract Data | User Info:

1. Try any username and password, for example, user and password, and click View Account Details.
2. The login will fail, but we are interested...