Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually.
The vulnerability is in the cookie header 'userid' parameter. The application implements some SQLi filter to block spaces and some SQL keywords so you have to convolute a bit the payload.
I can successfuly exploit the vulnerability injecting the following payload in the mentioned 'userid' parameter with an HTTP proxy:
Then I tried to replicate the injection with sqlmap to no success with the following command:
sqlmap -u "http://cloaknet:8080/proxypanel.jsp" --cookie="JSESSIONID=CA97BAFA78E01D237B86278E9DFE12C3; userid=71934" -p "userid" --level 5 --tamper "nonrecursivereplacement.py,space2comment.py" --sql-query="71934 UNION SELECT * from users"
I expected sqlmap to inject only the given query and return a successful exploit, but sqlmap tries a lot of queries and at the end returns the 'userid' parameter not being vulnerable.
What am I doing wrong?