I have an asp login form (username & password) that is SQL-injectable when the username is found in the database

For example, if I inserted

-username : foo   (foo founded in database)

-password : '.;/; 

Then the result is:

Incorrect syntax near ';'. Unclosed quotation mark after the character string ' order by dat desc '.`

Question: In sqlmap I wrote

sqlmap --url="foo.com/login.aspx" --data="username=foo&password=.';.;."

But the sqlmap result is: all tested parameters appear to be not injectable.

What is the wrong with my sqlmap statement?

  • 2
    you are trying to inject it while injecting? just do this... sqlmap --url="foo.com/login.aspx" --data="username=foo&password=bar" --level=5 – TheHidden Jul 25 '16 at 17:12

That you can generate an error doesn't necessarily mean you can exploit it. Did you try something like

bad' or '1' = '1

Can you bypass the login?

| improve this answer | |
  • i have used ,but doesn't work – Mortada Jafar Jul 26 '16 at 12:05
  • 1
    Can you share the asp code with us? Maybe the code is not injectable the way you expect it to be. – kaidentity Jul 26 '16 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.