For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the name of a user and a submit button, the output produced just informs about the existence or not of the introduced user. The html code is:
<html> <head> <title>User info</title> </head>... <p> Introduce an user to check if it's in the database </p> <form method="post"> User <input type="text" value="" name="user"> <input type="submit" value="Check!"> </form> <hr> </center> </html>
I know that 'guest' is a valid user name (it returns true) and I've checked manually that it's vulnerable to blind sql injection by introducing guest' and '1'='1 (which return true), and guest' and '1' = '0, (which returns false). Once being sure that it's vulnerable I've tried to use sqlmap to explode the vulnerability using the following command:
# sqlmap -u "http://foo.com/checkuserform" --method "POST" --data "user=guest" --dbms "mysql" -p "user"
But it seems not being able to explode the vulnerability:
... **[00:23:01] [WARNING] the web server responded with an HTTP error code (405) which could interfere with the results of the tests** [00:23:01] [INFO] testing if the target URL is stable [00:23:02] [INFO] target URL is stable [00:23:02] [WARNING] heuristic (basic) test shows that POST parameter 'user' might not be injectable ... **[00:23:18] [WARNING] POST parameter 'user' is not injectable** [00:23:18] [CRITICAL] all tested parameters appear to be not injectable. Try to increase '--level'/'--risk' values to perform more tests. Also, you can try to rerun by providing either a valid value for option '--string' (or '--regexp') If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could retry with an option '--tamper' (e.g. '--tamper=space2comment') [00:23:18] [WARNING] HTTP error codes detected during run: 405 (Method Not Allowed) - 175 times
A part of not being able to explode the vulnerability what surprises me is the HTTP 405 error,since I've forced the use of POST in the sqlmap command (and I'm not able to reproduce this error if I check it manually with a browser). I've also tried increasing the values of the level and risk parameters without succeed. Do you have any clue why it's happening?