Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used.

How should I perform SQL injection on this application? I have already followed the answers in Testing clean urls with sqlmap but it was't very useful.

share|improve this question

1 Answer 1

You need to look at the actual HTTP requests that are happening as the page loads. When a page uses an MVC framework, like in your example, there will be Javascript that runs in the browser, which reads the fragment (the part of the URL following the "#"), and makes some ajax requests to load the page's content.

The ajax requests are likely to have parameters that you can attack with sqlmap.

There are many tools you can use to record the ajax requests as the page loads, including Chrome's Developer Tools (press F12 and look at the Network tab), or Burp, ZAP, Fiddler, Firebug, and many others.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.