I was just messing around with SQLMap on Kali and I have now got an
--sql-shell on the main database. With this, I wondered what I can do now with this access. How would I insert data into the database et cetera is this possible?
Typically, one would use either the
--sql-query flag (one line at a time) or your
--sql-shell flag (which provides a SQLi REPL, or interactive shell) to test out functionality of the found SQLi against the target RDBMS' capabilities. This is often only needed when outside of the scope of what sqlmap can already perform, capability-wise.
Two prominent examples are:
Finding the base directory for LOAD_FILE() by using
select @@datadir against MySQL / MariaDB.
Hoping for the default file size allowed or querying it for a fit using
select @@max_allowed_packet in this same attack scenario.
Querying an MS-SQL Server Hostname (
select @@servername) or even the productversion/productlevel/edition. In MySQL / MariaDB this same command would be
select @@hostname from the sql-shell REPL.
What can you do with SQLmap?
Your question is What can I do with an SQL shell?
Short answer: (almost) anything!
Nuanced answer: depending on the rights of the user that is running on your end-point, almost nothing, something or possibly anything.
But, the only right question would be:
What should you do with SQLmap?
SQLMap is not something that you should be "messing around" with and to "insert data" with. That affects the integrity of the database. Inserting, deleting or altering even a small thing, makes the database corrupt. Either way you have ethical intentions or have no idea what you're doing.
SQLmap it selfs states the following for a good reason:
Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
It's good you're interested in information security and "playing around" with tools like "Kali" and "SQLmap" will give you powerfull skills. But use them good! Hopefully, in the best case you do that on a test environment that you own and run. Or in a second best case on a target that you have upfront permission from to test. WebGoat is a good example of such project: https://github.com/WebGoat/WebGoat.
Hacking is only legal when you have upfront permission and understanding with your customer about how, where and when you'll perform the test. This is called Ethical Hacking, the only way of "legal" hacking. Also the understanding usually includes defined testing borders about what you can and especially cannot do. Borders that should not be crossed. Mostly part of this borders are quite simple, proof a vulnerability or risk (even theoretically) by not altering, inserting or deleting any of it's data (in other words, read-only), unless you have explicit permission to do so.
Furthermore, I'd like to advice to only practice your SQLmap skills in one of the following three cases:
- You own the environment (it's your test environment, in order to gain skills with the SQLmap tool)
- You have upfront permission of the target you're hacking. Having a clear understatement of two parties about rules and borders.
- You stick to Bug Bounty programs like on HackerOne and BugCrowd accepting and respecting the rules of the specific program.
If the sql user has write permission on the table you can use an INSERT INTO command to insert data into the table.
On w3school you can find more info on how to write sql-statements.