0

I'm pen testing an application. The URL is basically app.php?app=appname. If app exists it gives correct output, but if it doesn't exist we get a internal server error 500.

Vega detects it as a SQL injection vulnerability, but when I test it with sqlmap it cannot find injection in this url. Vega shows the URL app.php?app=appname'%20AND%201=2%20--%20, but it also gives the same internal error.

In this case is it really a SQL injection vulnerability? Can I force sqlmap to use this URL as a help?

2

If the application is querying a database for appname, then most likely you have a SQL injection. To test the url with sqlmap run the command:

sqlmap -u "app.php?app=appname" -p "app"

Here is a quick cheat sheet to protect yourself from SQL injection.

2

It's possible that their could be some blind (time-based) SQL injection vulnerabilities present, you may not have "gone deep enough" with SQLMap. By default, SQLMap does not attempt all SQLi methods. You can try specifying the risk level (2):

Risk

Option: --risk

This option requires an argument which specifies the risk of tests to perform. There are four risk values. The default value is 1 which is innocuous for the majority of SQL injection points. Risk value 2 adds to the default level the tests for heavy query time-based SQL injections and value 3 adds also OR-based SQL injection tests.

Or Perform a simple time-based test like this:

Seconds to delay the DBMS response for time-based blind SQL injection

Option: --time-sec

It is possible to set the seconds to delay the response when testing for time-based blind SQL injection, by providing the --time-sec option followed by an integer. By default it's value is set to 5 seconds.

SQLMap Help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.