I have a REST API running on a server.

Is there a way to detect an unexpected sqlmap analysis?


SQLMap works by sending a lot of different requests to the server. It is pretty easy to see the scan if you look at your server logs manually.

If you want to do it programatically, just look for SQL verbs in your logs in the input fields where they don't make sense (select, from, where, order by).

  • 3
    I believe it may have a unique user agent by default as well. Of course that can be changed, but some adversaries might not think to change it. – multithr3at3d Apr 15 '16 at 5:11
  • 1
    yep ` --user-agent ` and --random-agent, actually – schroeder Apr 15 '16 at 5:14
  • What in case he uses a random agent? Is there a way to detect it? It seems soo easy to be anonymous otherwise. Thanks for your response – jscherman Apr 16 '16 at 0:49
  • 1
    @jscherman Random agents will mimic real agents, and therefore undetectable as sqlmap – schroeder Apr 16 '16 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.