SQLMap VS PHPGGC

Open-source tools have led to a significant transformation in cyber warfare for two primary reasons: cost-effectiveness and community-driven innovation. Tools such as SQLmap and Aircrack-ng exemplify how attackers exploit vulnerabilities, making it easier for individuals with limited resources to engage in cyber exploits. Conversely, defensive tools like Snort and OSSEC empower security professionals to monitor networks and system logs, helping organizations detect and mitigate breaches in real time. The evolution does not stop at merely having access to these tools but extends to how continuously they are updated and improved. The community-driven nature of open-source software encourages ongoing enhancements and shared knowledge. This, however, is paired with increased risk. With any tool that is available to all, the challenge of distinguishing ethical use from malicious intent becomes prominent, placing a heavier burden on security professionals to adapt and be vigilant.

SQL MAP, learning SQL

sqlmap

A few weeks ago, I took a short cyber security course on Udemy. SQL injection was a section of the course. I knew about the concept though, I hadn't tried it. I was planning to make a Restful API server and tried SQL injection using a tool sqlmap, which was introduced in the course. While I could have used existing server code, I decided to build one from scratch. It's been a while since I worked on a Restful API server, and I wanted to refresh my knowledge for learning purposes.

I recommend looking for an alternative or if you must do it this way test it with https://sqlmap.org to make sure you are not vulnerable to the lowest effort attacks.

The DAST checks can be automated up to a certain point, where the code should be able to withstand certain scans and attacks. For eg. SQL Injections can be checked with sqlmap which tests with each and every type of sql injection payload and reports it back to the user.

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

Sounds good, why not try making a simple vulnerability scanner for APIs too? Maybe something similar to SQLMap

Once we verify that the application uses this library in this specific version (usually through the composer.json file), we can test for insecure deserialization in an image upload route, for example. But first we need to create the gadget with the PHPGGC collection:

I won't explain how to write an exploit for something like this. Some tools can automatically generate a payload for you, and you can call yourself a script kiddie(we all start somewhere). The one I know is PHPGGC. To understand more about the exploit, you can read the OWASP article. If you didn't know this before, also read the rest of the OWASP articles about vulnerabilities

PHPGCC

To achieve RCE you’d need an unserialize “gadget” — PHPGGC might help.