2

I'm working on some security for a website that is built in classic ASP and MS SQL 2000.

I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using Sqlmap with the following commands:

python sqlmap.py -u "URL TO FORM" --forms --level=5 --risk=3 --batch

python sqlmap.py -u "URL TO FORM" --forms --dbs --level=5 --risk=3 --batch

Now I'm trying to check another form that is using the multipart/form-data encoding type.

Sqlmap can't inject anything into this form but as it's using a different encoding type I don't know if it's because of the encoding type or because Sqlmap can't handle this form type?

The form does use concatenated queries so in my mind it should be unsecure but the Sqlmap result have thrown me a bit.

Does anyone know if I have to use a different command on this kind of form or can Sqlmap not be used here?

Just a quick update. This is the message I get from Sqlmap:

[WARNING] heuristic (basic) test shows that (custom) POST parameter 'MULTIPART #1*' might not be injectable

Then it continues to perform the tests until it starts over with:

[WARNING] heuristic (basic) test shows that (custom) POST parameter 'MULTIPART #2*' might not be injectable
Improve this question
3
  • 4
    try passing the POST as --data "var1=1&var2=1"
    – rook
    Commented Jul 9, 2013 at 14:55
  • If I were you I wouldn't use the --forms option which can sometimes lead to parsing error when forms are a bit complex. Instead, assuming the data are sent via a POST, using a proxy like Burp, intercept the POST request and save it in a text file, then use the -r option to load the data and specify the parameters you want to test.
    – Moustache
    Commented Jul 9, 2013 at 14:56
  • 1
    There was feature request #79 to handle multipart forms that was released a year ago. Are you using the most recent version of sqlmap? github.com/sqlmapproject/sqlmap/issues/79
    – schroeder ♦
    Commented Jul 9, 2013 at 19:56

2 Answers 2

Reset to default
1

Why don't you do it Manually ?? . It's Pretty Simple plus will give you better understanding what sort of Filtering is Present in the back end and what can be done to bypass it . Right now you are simply relying on tool to give you result . If you are involved in pen testing the application , Beware , there still might be bugs . And if you are doing it for Fun , why not learn as well .

Use Burp or Tamper data see the request and reponse , play along with it and you will understand the application better .

Improve this answer
0

This is a good example of why penetration testers are not supposed to be fully reliant on tools as they often lead to false negatives. In this case, a possible vulnerable parameter would be regarded safe due to the obsurity of the said "encoding" type of the form that throws off SQL Map.

My recomendation would be to utilize a manual traffic interception proxy such as Burp Suite or Paros in order to better understand the data communicated and modify it then.

Refer to a SQLI cheatsheat for the exact syntax to test against.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .