I detect a sqli vulnerability in a target url using sqlmap. Now when I try this I always get "connection timed out to the target URL":

./sqlmap.py -u targetURL --dbs

How can I solve it?

  • 1
    It means that the server at the other end isn't responding in a reasonable time - might be that it's fallen over, or that a WAF or IDS has detected unusual traffic and blocked the source IP. – Matthew Nov 9 '16 at 14:00
  • Thanks, what's your idea to get DBs in this situation? Is it helpful use the above command with --tor switch,?@Matthew – ThisIsMe Nov 9 '16 at 14:13
  • Depends on the specific reason for the failure - you'd need to investigate that before trying to work around it. For example, if the site has fallen over, it doesn't matter what you do, since you won't get a response. Worth asking the site owner if you're in a pen testing situation. – Matthew Nov 9 '16 at 14:15

If this is a server you own, look at the logs. If you do not, you may have fallen into a honeypot/honeyport/active countermeasures url or otherwise been detected by Intrusion Detection or a Web Application Firewall - something like Fail2Ban may have gotten you. If you're a pentester, talk to your client - if they want you to proceed, they may have to whitelist you.

You can always try going through a proxy, see if that connection succeeds.

  • I have the payloads for injection point in url is detected by sqlmap. but when I try this: sqlmap.py -u myURL --dbs, the result is timed out. Is it possible I use the payloads for manual sql injection and access to DB? – ThisIsMe Nov 14 '16 at 14:40
  • Well, can you get to the website with a regular browser? If not, this is time to talk to your client. – crovers Nov 14 '16 at 14:41
  • Yes, I can get it – ThisIsMe Nov 14 '16 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.