Why can't sqlmap find an SQL injection in my code?

Question

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL.

It comes with a test page "CD collection", with the following back-end PHP code:

mysql_query("DELETE FROM cds WHERE id=".round($_REQUEST['id']));

I'm not an expert in PHP, I'm guessing the round call is there to prevent SQL injection. So I removed it from the PHP code, leaving the following:

mysql_query("DELETE FROM cds WHERE id=".$_REQUEST['id']);

I verified that I can modify the query parameters in the URL to do whatever I like to the database, so the SQL injection vulnerability is definitely there.

Now I'm trying to use sqlmap to find the SQL injection vulnerability. I run it like this:

python sqlmap.py -u "http://127.0.0.1/xampp/cds.php?action=del&id=14"

But it returns the following:

[16:01:47] [WARNING] GET parameter 'id' is not injectable [16:01:47] [CRITICAL] all parameters are not injectable, try to increase --level/--risk values to perform more tests. Rerun without providing the --te chnique switch. Give it a go with the --text-only switch if the target page has a low percentage of textual content (~15.27% of page content is text)

Any idea of what I may be doing wrong?

Answer 1

There is a huge probability, that your server doesn't display any errors/warnings. Sqlmap tries to inject sql inj.-like payloads and observes the webapp "state". As sqlmap hasn't got an access to your vulnerable code or DB content it could just only guess the potential vulnerability by observing webapp behaviour – in this case „visual” behaviour (no warnings/errors – no potential sql-inj.).

However, sqlmap gave you pretty nice hint: try to increase level/risk values:

    python sqlmap.py -u "http://..." --level=3 --risk=3

after that change you will increase the amount of payloads (sent to your webapp) and you will find blind sql.inj!. It means that on level 3 (and --risk=3) sqlmap doesn't check only „visible” effects. It uses some time-taking operation [BENCHMARK()] which delays server response if sql. Inj. occurs.

Answer 2

Do you have to log into the web application, to visit that page? If so, sqlmap doesn't have your authentication cookie, so you may need to feed it a valid cookie with --cookie=....

I don't have much experience with sqlmap, but I noticed one web page online claims that sqlmap 0.9 is unreliable and the latest development version is more reliable. That's one more thing you could try.

There's always the obvious: did you try the recommendations it suggests in the output you quoted?

Answer 3

1) Please use the latest revision from our repository (from your given output it's obvious you are using older v0.9 - a lot of things has changed till then):
$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

2) Error messages are not necessity for sqlmap's detection (as is on other "tools"). Sqlmap's finds way how to inject something to use it and it doesn't "only" look for error messages (which don't prove anything)

3) Increase level/risk when you are sure that it should be exploitable (e.g. --level=3 --risk=3) but in most number of non-OR cases default level/risk should be enough

Kind regards,
Miroslav Stampar

Answer 4

C'mon stack exchange! Really? This is so easy to answer! Take another look:

id=".round($_REQUEST['id']));

See it yet? Your SQL injection is being rounded out of the picture! PHP is rounding "0 OR 1 = 1;--" to just 1. Remove the round function and hack yourself all night.