I have a pretty simple HTML page that submits a
password to the server via
<doctype html> <head> <title>SQLMap dynamic parameters</title> </head> <body> <form id="sqliForm" action="sqli.php" method="POST"> <input id="username" type="text" name="username"> <input id="password" type="password" name="password"> <input type="submit" value="Submit"> </form> </body> </html>
My goal is to perform an automated test which SQLMap provides against the
password fields upon clicking the "Submit" button, which turns the field names into smth. like
password3vOklA, seemingly different every time. The JS code has been understood so that I can predict the correct name of the fields upon submission though.
Needless to say, SQLMap fails here and picks out only the field names that are currently inside HTML code (i.e.
username=&password= when passing the
--forms option to
sqlmap.py). I've embarked on a good old technique of Manual Staring and found out that there's an
--eval option to SQLMap which might have helped me: I could generate a correct username but it's value is what I want to test and not specify myself like in the example provided by the manual:
python sqlmap.py -u "http://www.target.com/vuln.php?id=1&hash=c4ca4238a0b923820dcc509a6f75849b" --eval="import hashlib;hash=hashlib.md5(id).hexdigest()"
Is there any way I could leverage SQLMap's powers here (or maybe even another tool in combination with it)?
P.P.S.: My other thought was that I could write a BASH script and feed the resulting "correct" username and password field names to SQLMap but then again, that would be true just for the first requst (?)