5

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie), b) a user SSL certificate and c) a PREFIX.

My command is:

python ./sqlmap.py --auth-file ~/welcomecert.p12 -u "http://komodobank.com/index.php?profile=adminsnowball" -p profile --cookie="PHPSESSID=sp1222aplv64fok7pa7voe447" --prefix="adminsnowball'" -v 3 --dbms mysql --level 5 --risk 3 --union-cols 10-16

I can see that SQLmap is working away, but it never finds the field to be injectable.

A manual injection like this works:

http://vulnapp.com/index.php?profile=admin' or '1'='1

Things that might be causing SQLmap to fail:

  1. The returned error message is a custom error message, not a MySQL error message.
  2. The profile prefix must be the logged in username.
  3. The UNION isn't testing enough fields possibly
  4. Its not testing strings but just integers (for instance AND 3347=7762 and not AND '3347'='7762
  5. Its testing AND and not OR (I can't see any ORs being tested)
  6. The http GET request is then passed to JS which ajax's for the data from the server. Perhaps the response is lost to SQLmap?

Below is some of the queries that can see it is testing, but apparently they all fail.

[PAYLOAD] admin' AND 3115=1602 AND (3320=3320
[PAYLOAD] admin' AND 5213=5213 AND (8263=8263
[PAYLOAD] admin' AND 3347=7762
[PAYLOAD] admin' AND 5213=5213
[PAYLOAD] admin' ORDER BY 1--
[PAYLOAD] admin' ORDER BY 3421--
[PAYLOAD] admin' UNION ALL SELECT NULL--
[PAYLOAD] admin' UNION ALL SELECT NULL,NULL--
[PAYLOAD] admin' UNION ALL SELECT NULL,NULL,NULL--
[PAYLOAD] admin' UNION ALL SELECT NULL,NULL,NULL,NULL--

EDIT: This query also works manually:

' union select table_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.tables where 'x'='x

However, SQLmap doesn't seem to test unions like that.

  • 3
    There are a lot of moving parts to this (certs, cookies, authentication, etc.). If it is your app, I'd suggest reducing the complexity and retesting to narrow in on the problem. As it stands, there are too many factors for us to guess. – schroeder Oct 21 '15 at 17:13
1

Whilst it's impossible to say exactly why sqlmap is failing without having access to the test application you could look at using an intercepting proxy to review the requests/responses from the app. to see where its failing . Using a proxy like OWASP ZAP or Burp you could look at the queries sent by sqlmap and get an idea of why they might be failing.

  • It turned out that there were a couple of minor bugs in sqlmap that have now been fixed. I have been speaking with one of the authors and am currently generating a certificate for them to try the app behind a client cert so that any problems in that can be pinned down. – amlwwalker Oct 31 '15 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.