I was wondering whether
sqlmap is able to test HTTP headers for SQL vulnerabilities. I know that if I use
--level>=3 then it will automatically check for User-Agent and Referrer HTTP headers, but I would also like to check for others.
I've found the
--header options, which I can use to specify the headers that will be sent in requests, but I have no idea whether
sqlmap will actually test those headers. Let's say I want to add a header:
to the http request. I would add the
--headers="CustomHeader: testing" to the
sqlmap command line and then I could specifically tell
sqlmap to test for the SQL vulnerabilities in CustomHeader HTTP header with the
-p option, like this:
Testable parameter(s) Switch: -p By default sqlmap tests all GET parameters and POST parameters. When the value of --level is >= 2 it tests also HTTP Cookie header values. When this value is >= 3 it tests also HTTP User-Agent and HTTP Referer header value for SQL injections. It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence on the value of --level too. For instance, to test for GET parameter id and for HTTP User-Agent only, provide -p id,user-agent.
So the command could be:
Does anybody know how to actually test custom HTTP headers with