4

I have a lab machine that I have been practicing some SQL injection on.

I know that the POST parameter that I am trying to exploit is vulnerable as I was able to extract the user DB manually.

I then went to do this with SQLmap with the below command.

sqlmap -u 192.168.1.50/base-login.asp --dbms="Microsoft SQL Server 2000" --data="txtLoginID=admin&txtPassword=test&cmdSubmit=Login" -p txtLoginID --method=POST

Every time I run the sqlmap command I am told that the txtLoginID is not injectable. I thought this was weird as I know for a fact that it is. (I also tried the above command with the highest risk and level set)

I proceeded to take a capture of the traffic to see if I saw anything out of place. Everything looked okay and I even took some of variables that sqlmap was trying to pass and manually entered them. When I did this I was given output as you would expect when injecting SQL.

I even captured the HTTP headers with Live HTTP headers plugin and was able to successfully replay them which produced output as I would expect.

I am new to sqlmap so I was wondering if I am missing something? From everything I have read/seen on the internet it appears I am doing it correctly.

2 Answers 2

3

To be sure of your syntax, you can intercept a regular request of your post by burp for example. You save it in a file and you can inform sqlmap to use this request for testing an injection. For that the option in sqlmap is -r.

Target:
    At least one of these options has to be provided to set the target(s)

    -d DIRECT           Direct connection to the database
    -u URL, --url=URL   Target URL (e.g. "www.target.com/vuln.php?id=1")
    -l LOGFILE          Parse targets from Burp or WebScarab proxy logs
    -m BULKFILE         Scan multiple targets enlisted in a given textual file
    -r REQUESTFILE      Load HTTP request from a file
2
  • Awesome. I'll give that a try later tonight. Commented Feb 23, 2016 at 16:47
  • That worked! I guess my syntax must be incorrect for the POST.. even though I copied it from an actual POST. Commented Feb 24, 2016 at 0:58
1

Is this just a typo?

--data"=txtLoginID=admin&txtPassword=test&cmdSubmit=Login"

should be

--data="txtLoginID=admin&txtPassword=test&cmdSubmit=Login"
1
  • Yeah, it actually works both ways and in one of the many examples I found someone was doing it like that so i gave it a try and forgot to switch it back... Good catch though. Commented Feb 22, 2016 at 1:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .