SQLMap VS setoolkit

Open-source tools have led to a significant transformation in cyber warfare for two primary reasons: cost-effectiveness and community-driven innovation. Tools such as SQLmap and Aircrack-ng exemplify how attackers exploit vulnerabilities, making it easier for individuals with limited resources to engage in cyber exploits. Conversely, defensive tools like Snort and OSSEC empower security professionals to monitor networks and system logs, helping organizations detect and mitigate breaches in real time. The evolution does not stop at merely having access to these tools but extends to how continuously they are updated and improved. The community-driven nature of open-source software encourages ongoing enhancements and shared knowledge. This, however, is paired with increased risk. With any tool that is available to all, the challenge of distinguishing ethical use from malicious intent becomes prominent, placing a heavier burden on security professionals to adapt and be vigilant.

SQL MAP, learning SQL

sqlmap

A few weeks ago, I took a short cyber security course on Udemy. SQL injection was a section of the course. I knew about the concept though, I hadn't tried it. I was planning to make a Restful API server and tried SQL injection using a tool sqlmap, which was introduced in the course. While I could have used existing server code, I decided to build one from scratch. It's been a while since I worked on a Restful API server, and I wanted to refresh my knowledge for learning purposes.

I recommend looking for an alternative or if you must do it this way test it with https://sqlmap.org to make sure you are not vulnerable to the lowest effort attacks.

The DAST checks can be automated up to a certain point, where the code should be able to withstand certain scans and attacks. For eg. SQL Injections can be checked with sqlmap which tests with each and every type of sql injection payload and reports it back to the user.

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

Sounds good, why not try making a simple vulnerability scanner for APIs too? Maybe something similar to SQLMap

[2] https://github.com/trustedsec/social-engineer-toolkit

There's programs out there to make these malicious PDFs, word documents, etc https://github.com/trustedsec/social-engineer-toolkit

Social Engineer Toolkit (SET)

Yes, you can find out who clicked, and more. Here's a link to the toolkit's documentation where you can get a lot of other help and tips: https://github.com/trustedsec/social-engineer-toolkit/blob/master/readme/User_Manual.pdf

git clone https://github.com/trustedsec/social-engineer-toolkit/ setoolkit/ cd setoolkit pip3 install -r requirements.txt python setup.py

Setoolkit GitHub