I can successfully perform a sqlmap scan of my target from a host. However, if I run sqlmapapi from that same host and use SQLiPy from Burp, sqlmapapi returns connection errors.

The specific SQLiPy errors retrieved are:

INFO: 16:55:43 - testing connection to the target URL CRITICAL: 16:55:44 - page not found (404) WARNING: 16:55:44 - HTTP error codes detected during run: 404 (Not Found) - 1 times

The successful sqlmap scan is using the same command generated by SQLiPy.

I have also confirmed connectivity/DNS etc to the target.

So what is the difference between the manual command and the SQLiPy initiated command via sqlmapapi?

  • What error (specifically) are you getting back Burp? – HashHazard Jul 18 '16 at 21:27
  • Updated question with specific error retrieved by sqlipy. – garthoid Jul 19 '16 at 13:24
  • This sounds like the URI is wrong or missing something which is causing the 404. Can you tell exactly what the URI it's trying to connect to is? May want to consider opening a chat for this question if my comment doesn't trigger a lightbulb or ID the issue. Other's will likely ask additional diag questions. – HashHazard Jul 19 '16 at 13:40
  • This appears to be independent of host I have installed SQLMap on. In the Burp/SQLiPy case to a SQLMapAPI server running locally this time the same error as above appears from the SQLMap Logs tab. However if I copy and paste that exact same sqlmap command that the log identifies into a CLI locally it connects and continues testing. – garthoid Jul 19 '16 at 15:21
  • 1
    I am the developer of SQLiPy. I will work on adding an option to change the VERB, and pass it to the sqlmapapi. Follow the project on GitHub for changes: github.com/codewatchorg/sqlipy – Josh Berry Aug 24 '16 at 21:00

I have added an update to SQLiPy that will hopefully be incorporated into the BApp store soon that allows the user to toggle the HTTP method/verb. If you don't want to wait on the update in the BApp store, you can get it at https://github.com/codewatchorg/sqlipy. The latest version is 0.5.2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.