Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL.

It comes with a test page "CD collection", with the following back-end PHP code:

mysql_query("DELETE FROM cds WHERE id=".round($_REQUEST['id']));

I'm not an expert in PHP, I'm guessing the round call is there to prevent SQL injection. So I removed it from the PHP code, leaving the following:

mysql_query("DELETE FROM cds WHERE id=".$_REQUEST['id']);

I verified that I can modify the query parameters in the URL to do whatever I like to the database, so the SQL injection vulnerability is definitely there.

Now I'm trying to use sqlmap to find the SQL injection vulnerability. I run it like this:

python sqlmap.py -u "http://127.0.0.1/xampp/cds.php?action=del&id=14"

But it returns the following:

[16:01:47] [WARNING] GET parameter 'id' is not injectable [16:01:47] [CRITICAL] all parameters are not injectable, try to increase --level/--risk values to perform more tests. Rerun without providing the --te chnique switch. Give it a go with the --text-only switch if the target page has a low percentage of textual content (~15.27% of page content is text)

Any idea of what I may be doing wrong?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

There is a huge probability, that your server doesn't display any errors/warnings. Sqlmap tries to inject sql inj.-like payloads and observes the webapp "state". As sqlmap hasn't got an access to your vulnerable code or DB content it could just only guess the potential vulnerability by observing webapp behaviour – in this case „visual” behaviour (no warnings/errors – no potential sql-inj.).

However, sqlmap gave you pretty nice hint: try to increase level/risk values:

    python sqlmap.py -u "http://..." --level=3 --risk=3

after that change you will increase the amount of payloads (sent to your webapp) and you will find blind sql.inj!. It means that on level 3 (and --risk=3) sqlmap doesn't check only „visible” effects. It uses some time-taking operation [BENCHMARK()] which delays server response if sql. Inj. occurs.

share|improve this answer
    
Thanks for the answer, it turns out that increasing the level and risk did work. Apologies to @D.W. who did ask me this earlier, but it appeared I wasn't running it properly. –  LeopardSkinPillBoxHat Jun 6 '12 at 7:42

Do you have to log into the web application, to visit that page? If so, sqlmap doesn't have your authentication cookie, so you may need to feed it a valid cookie with --cookie=....

I don't have much experience with sqlmap, but I noticed one web page online claims that sqlmap 0.9 is unreliable and the latest development version is more reliable. That's one more thing you could try.

There's always the obvious: did you try the recommendations it suggests in the output you quoted?

share|improve this answer
    
No, there is no authentication required. I downloaded the latest version of sqlmap but the results are the same. And yes, I tried the recommendations in the output, but no luck. –  LeopardSkinPillBoxHat Jun 4 '12 at 7:57

1) Please use the latest revision from our repository (from your given output it's obvious you are using older v0.9 - a lot of things has changed till then):
$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

2) Error messages are not necessity for sqlmap's detection (as is on other "tools"). Sqlmap's finds way how to inject something to use it and it doesn't "only" look for error messages (which don't prove anything)

3) Increase level/risk when you are sure that it should be exploitable (e.g. --level=3 --risk=3) but in most number of non-OR cases default level/risk should be enough

Kind regards,
Miroslav Stampar

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.