If there’s one thing that’s guaranteed in the tech world it’s that nothing is guaranteed. From AOL, Netscape, Yahoo, and MySpace, every tech empire seems to eventually fall to ruin. One method to reliably maintain information or online experiences that are lost to whims of computer users and markets is to backup, preserve, and host that information on one’s own computers, and the Kiwix project aims to help make offline backups of favorite websites.
The open-source tool started as a way for users to make their own offline backups of Wikipedia but eventually expanded into having the ability to backup many other sites as well. Wiki-type sites are generally the easiest, but it can also create backups of other sites like StackExchange so that when the Internet goes down or the site vanishes from the world, the information is preserved for use. There are plenty of guides online for setting up Kiwix as well, with it running easily on most Linux systems with or without the help of Docker, as well as versions available for Windows, Android, and Apple platforms.
Although the Kiwix software hosts the website backups, creating the backups needs to be done with another tool called Zimit to create the .zim files Kiwix uses. The Kiwix organization also hosts pre-downloaded .zim files of common websites so each user is not independently crawling Wikipedia on their own, a task that could take months on limited consumer hardware. As for what hardware to ultimately host it on, we might recommend an armageddon-proof machine like this one.
While DOOM remains the undisputed champion of ‘game you play on every piece of hardware’ it seems that the role of ‘game you play on everything just because you can’ is slowly being shifted to Minecraft, as we have yet another Minecraft server somewhere Minecraft has no business being served– in this case, a Samsung Printer.
The hack actually requires opening up the printer to get at the debug ports to bang your way in via serial, but as any security expert will tell you, once the black hats have physical access to a machine, they own it. That isn’t to say it’s easy– [vimpo] had to dump the firmware and find an exploit. Since it’s 2026 [vimpo] tried to get an LLM to do all that hard work for him, and while it helped with identifying functions in the dump, ultimately the hacking still fell upon [vimpo]’s human intelligence, though not before burning through millions of tokens. Having found a good old fashioned UDP overflow exploit, he’s gets control of the printer and puts an improved version of his lightweight Minecraft server, UCraft, on it. Like the server, the exploit is also on GitHub but you’ll very likely need the exact same printer to get it to work: a Samsung C410W with firmware V3.00.02.20, DEC-15-2015. One important caveat is that while you can still use the printer as intended after this hack, you cannot do so while playing Minecraft: it crashes the server if you try. Good to know.
In case you’re wondering, yes, this is the same guy who got a Minecraft server running on a light-bulb, which arguably more impressive. Where he might mine and/or craft next is anybody’s guess. Somebody else already did the ESP32-C3, and while we suspect nothing will ever beat the 1960s Univac implementation for sheer impracticality, we’re willing to be surprised.
Today we are going to cover the use of SQLMap in bug bounty and web pentest. This tool has been around for years and proved to be the top choice. When you test websites for SQLi, you often start manually with known payloads and then move to your tools. Although there are a few tools available out there, this one is the most capable. So it’s a good idea to start with it.
This article will teach you how to work with flags and options. Since all the heavy lifting is done by the tool, it’s enough for you to start finding bugs and report them. SQLi is considered to be a critical vulnerability, as it may lead to RCE or a full website compromise. That really depends on the database management system (DBMS). We had a case during a pentest where an admin’s IP was whitelisted in the MySQL database. That same IP also had SSH open, and credential reuse got us into that server too. You never know what you’re going to run into once you’re inside a database. Sometimes one finding can lead to the next. That’s why this vulnerability is critical.
OWASP Top 10
Although the injections moved down the list, they’re still out there and very much exploitable. There are many gov websites that are vulnerable to it. Sometimes you’ll come across a time-based injection that’s pretty slow to work with. Other times, you might get a union-based injection that will let you dump entire databases fast and clean. Error-based injections are common and easy to spot. And finally, there are boolean-based injections.
It’s not always obvious that a website is vulnerable to an injection. It might look totally outdated but give you nothing. And on the other hand, solid looking websites can leak everything with just one payload.
Simple payload
Let’s start with the basics. Often, you don’t need to go overboard as SQLMap can handle most of it for you. You can stick with simple payloads and only then get into complex ones. The complexity of the payload doesn’t always increase the chance of a successful SQLi. Even changing parameters like –risk or –level too early can make your payload fail.
Let’s take a Russian ISP website as an example. The one-liner here is simple. Below you can see an intercepted POST request that we saved from Burp. It had random login credentials for the test.
kali > sudo sqlmap -r website.ru.txt --risk=3 --level=4 --batch --random-agent
You can play with levels and risks, but be careful as some websites may have WAF, so try to keep it low in the beginning.
Now let’s try dumping their data with –dump. We are interested in the billing database (-D billing) and users11 table (-T users11). At the end of the line we will add –columns to enumerate the columns.
You can also use –users and –passwords to dump credentials of database admins.
–users extracts database management users. Here you will see all the whitelisted IPs, but sometimes you will come across localhost, which won’t let you connect to the DB externally. –passwords will dump password hashes if available. If you succeed, it opens up a new attack vector, as mentioned before.
Let’s now test a second example where higher risk and level work just fine and actually give better results.
Here is a furniture shop in Moscow. Even though the website seems pretty modern, the id= parameter is injectable.
We will go with –level=4 and –risk=3 again this time. The asterisk (*) points at the parameter that needs to be tested. You can also use -p for that.
It worked. Now we dump the users table with usernames and hashes. But keep in mind, not all hashes can be cracked by SQLMap. If it fails, don’t be surprised. Just export them and use Hashcat or John the Ripper.
Once cracked, we can log into the website. If someone cracks an admin’s hash, they can cause real damage to the website.
That was easy. Let’s look at a different challenge.
Tampers
This is a gov.ru website. It’s different compared to the previous ones, because regular SQLMap payloads fail here. It’s protected by a WAF that filters suspicious requests. For this reason we will use tampers. There are many of them and random isa popular choice. It randomizes the casing of your payload, which can help bypass WAFs.
Another flag you might notice is –no-cast. This tells SQLMap not to cast data types. It can be useful after you find a working injection. Before that, it might get in your way.
There are tons of tamper scripts designed for different firewalls. If you find out what firewall is running, you’ll have a better chance of picking the right one.
Columns
Here is another government-associated website for the city of Khabarovsk. Khabarovsk is a major city in the Russian Far East, close to China. It’s known for its military importance and some sketchy biological programs during the Soviet era. This website looks like a city archive. Let’s dig into it.
Look at the search functions. It shows results in a table format. That’s your clue. We need to know how many columns are returned. If your union payload uses the wrong number of columns, it won’t work.
As you can see above, there are four of them. So we will go with –union-col=4
Using a union character (a random string or ID) can sometimes help stabilize your payload and avoid false positives. Don’t forget to add tamper scripts. You can even stack them, just make sure they don’t conflict with each other.
Conclusion
That’s it for Part 1. We’ve laid the foundation in this chapter showing you the real use of SQLMap and its functions. As it was mentioned previously, SQLi are critical vulnerabilities and it’s always a good idea to test them during your Web App Hacking or Bug Bounty. We have training on each, where we give you the needed skills to start finding your first bugs or land a job as a pentesters, as many companies require these skills.
Login
