I'm working on some security for a website that is built in classic ASP and MS SQL 2000.
I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using Sqlmap with the following commands:
python sqlmap.py -u "URL TO FORM" --forms --level=5 --risk=3 --batch python sqlmap.py -u "URL TO FORM" --forms --dbs --level=5 --risk=3 --batch
Now I'm trying to check another form that is using the multipart/form-data encoding type.
Sqlmap can't inject anything into this form but as it's using a different encoding type I don't know if it's because of the encoding type or because Sqlmap can't handle this form type?
The form does use concatenated queries so in my mind it should be unsecure but the Sqlmap result have thrown me a bit.
Does anyone know if I have to use a different command on this kind of form or can Sqlmap not be used here?
Just a quick update. This is the message I get from Sqlmap:
[WARNING] heuristic (basic) test shows that (custom) POST parameter 'MULTIPART #1*' might not be injectable
Then it continues to perform the tests until it starts over with:
[WARNING] heuristic (basic) test shows that (custom) POST parameter 'MULTIPART #2*' might not be injectable