I was wondering whether sqlmap is able to test HTTP headers for sql vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referer HTTP headers, but I would also like to check for others.
I've found the --header options, which I can use to specify the headers that will be sent in requests, but I have no idea whether sqlmap will actually test those headers. Let's say I want to add a header:
to the http request. I would add the --headers="CustomHeader: testing" to the sqlmap command line and then I could specifically tell sqlmap to test for the SQL vulnerabilities in CustomHeader HTTP header with the -p option, like this:
Testable parameter(s) Switch: -p By default sqlmap tests all GET parameters and POST parameters. When the value of --level is >= 2 it tests also HTTP Cookie header values. When this value is >= 3 it tests also HTTP User-Agent and HTTP Referer header value for SQL injections. It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence on the value of --level too. For instance, to test for GET parameter id and for HTTP User-Agent only, provide -p id,user-agent.
So the command could be:
Does anybody know how to actually test custom HTTP headers with sqlmap?