SQLmap non authorized user, but the url works in browser

Question

Through Burp Suite I get a possible SQL injection point using this request:

POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1
Host: test-san-as01:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://test-san-as01:8080/restrict/menuApc.do?MVPG=ApcAssistitoDatiAnagraficiInserisci
Content-Type: application/x-www-form-urlencoded
Content-Length: 1893
Cookie: JSESSIONID=ID.testsan; JSESSIONIDSSO=12345678

[email protected]&[email protected]

I am able to go inside this page using the browser test-san-as01:8080/restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci. I am NOT able to go inside test-san-as01:8080/restrict/menuApc.do.

I run python sqlmap.py -u "http://test-san-as01:8080/restrict/menuApc.do?MVPG=ApcAssistitiRicerca&s_ELIMINATI=1&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO=1" --level 5 --risk 3 --threads=3 -v 2 --dbms=oracle --method=POST --data "[email protected]&[email protected]" but I get this error: [CRITICAL] not authorized, try to provide right HTTP authentication type and valid credentials (401).

Why? Is there a way to go through this? Am I doing something wrong?

Answer 1

The URL works in the browser because your browser sends your cookies for every request you make.

You need to tell sqlmap to send your cookies by adding this option in your command line:

--cookies="JSESSIONID=ID.testsan; JSESSIONIDSSO=12345678"