Mastering SQLMAP: A Step-by-Step Walkthrough of the TryHackMe Lab

Introduction

SQL Injection remains one of the most common and dangerous web vulnerabilities. While manual testing is crucial, automation tools like SQLMAP allow penetration testers to efficiently detect and exploit these flaws. In this write-up, I’ll walk through how I completed the SQLMAP room on TryHackMe, moving from initial reconnaissance to full database compromise.

Step 1: Reconnaissance & Directory Brute-forcing

Every successful attack starts with enumeration. I began by scanning the target IP to find hidden directories using Gobuster.

Command: gobuster dir -u http://10.48.174.136/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

The scan revealed a directory named /blood/. Navigating to http://10.48.174.136/blood/ led me to a Blood Donation Management dashboard.

Step 2: Identifying the Vulnerable Parameter

While exploring the dashboard, I noticed a page that displayed donor details based on an ID. The URL looked like this: [http://10.48.174.136/blood/view.php?id=1](http://10.48.174.136/blood/view.php?id=1)

[Insert image_01442b.png here] Caption: The Blood Donation dashboard where the vulnerable ID parameter was found.

In web security, any URL with a ?id= parameter is a prime candidate for SQL Injection testing.

Step 3: Database Enumeration with SQLMAP

Now that I had a target URL, I fired up SQLMAP on my Kali Linux machine to check for vulnerabilities and list the available databases.

Command: sqlmap --url http://10.48.174.136/blood/view.php?id=1 --dbs -batch

The tool confirmed that the back-end DBMS is MySQL and identified the blood database as our primary target.

Step 4: Dumping the Data

With the database name confirmed, the next step was to extract (dump) the contents of the tables to find sensitive information and the final flag.

Command: sqlmap --url http://10.48.174.136/blood/view.php?id=1 --dump -batch

SQLMAP performed a series of UNION-based and Error-based injections to pull the data. It successfully dumped the users table, which contained names, emails, and passwords.

Step 5: Capturing the Flag

Among the dumped tables, I found a table named flag. Inside, the final flag for the room was revealed.

flag

Conclusion

This lab was a fantastic exercise in using SQLMAP for automated exploitation. By moving from directory discovery with Gobuster to full data extraction with SQLMAP, I was able to see how a small misconfiguration in a PHP parameter can lead to a total database breach.

Final Result: Room Completed 100%!

CyberSecurity #EthicalHacking #SQLMAP #TryHackMe #PenetrationTesting #InfoSec #BugBounty