Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean?

I know how to test my sites that have urls like: http://mysite.com/?id=1

But what about my sites that have clean urls, like: http://mysite.com/1

share|improve this question
    
I haven't had to deal wit this before, but i would just throw it through burp or some other proxy and see how it places it's calls.... then act accordingly. –  Ormis Aug 2 '11 at 17:02
    
I guess I don't know what your talking about. I know how the parameters are parsed and used (it is my website), but, to be clear, my question is can sqlmap be used to test for sql injections for sites with url rewrites (and how). –  chadgh Aug 2 '11 at 17:33
    
This question is confusing. (It's hard to tell what you mean by "clean".) After re-reading it several times, I'm guessing you might mean that the web server is rewriting URLs to embed all request parameters into the path itself, instead of using standard HTTP syntax for request parameters (e.g., http://mysite.com/path/doit&a=foo&b=bar&c=baz becomes http://mysite.com/path/doit/foo/bar/baz, or something like that). Is that the issue? –  D.W. Aug 2 '11 at 19:21
    
This is common not just with mod-rewrite, but also with any MVC framework... Are you asking specifically about using sqlmap for this, or any SQLi pentesting in general? –  AviD Aug 7 '11 at 14:27

3 Answers 3

you should use * in your uri :

sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*"

instead of website.com/script/paramrewrited1/paramrewrited2

share|improve this answer

If I understand your question, I believe sqlmap is not designed to deal with this situation (where the web server does not follow web standards for how to represent request parameters). So, I can think of a few options:

  1. Turn off URL rewriting. Temporarily turn off request parameter rewriting on your web server (if there's an easy way to do that), to let you run sqlmap.

  2. Try POST requests. You showed us that your web server encodes request parameters for GET requests in a non-standard fashion. How does it encode request parameters for POST requests? If it conveys web server encodes request parameters in a more standard fashion, and if every request is accessible via both GET and POST (a misconfiguration, but a common one), you may be test your server by sending POST requests instead of GET requests. See the --data option to sqlmap.

  3. Use some other tool. Look for some other tool, since sqlmap doesn't seem designed for this particular case.

  4. Modify sqlmap. sqlmap is open source. You could dive into the source code and extend it to support the use case you have in mind. (You might want to look at the code that handles the -p option to sqlmap.) Heck, it is free; you have to expect that if you have an unusual situation, it might not already handle it, and you might have to do a little bit of work on your own. If you follow this route, give back to the community by donating your code to the sqlmap maintainers.

share|improve this answer
    
sqlmap can deal with this situation. Just see @dz.'s answer above. –  Halil Özgür Aug 3 '12 at 9:28

You'll run into this a lot because of search engine optimization (SEO). SEO is the strongest enemy and most web sites use it because it usually consists of using a simple plugin and filling out some keywords. This is when you know you've run into a site whose content is optimized SEO,

Instead of

http://www.com/index.phpoption=com_blahbla&Item=2&ItemId=5

you'll see

http://www.website.com/index,51,blabla

or

http://website.com/guestbook/page2

then you're most likely looking at a URL which is optimized.

In these situations we need to look at the source code to put the URL back together in the form we need it to be in to do a SQLi attack. In the source code, you need to determine:

  1. What component is currently active;
  2. What parameter it takes;
  3. What their current values are.

Bingo we got what we need! You'll see in the source code something like this:

<input type="hidden" name="option" value="com_blabla" />
<input type "hidden" name="ItemId" Value="5" />
<input type="hidden" name="Item" Value="2" /> 
<input type="hidden" Name="entry" Value="451" />
<input type="hidden" Name="view" Value="entries" />

Now compose your original URL by simply filling out the well-known URL pattern:

http://www.website.com/index.php?option=com_blabla&Itemid=5&ItemId=2&Entry=451&View=Entries

That's it.

Note: This particular example is based on Joomla source code. So this will always be the exact information you're looking for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.