2

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through the UserID field will get you through the login.php script: 

'|| 1=1#;

This injection also worked:

'OORR 1=1#;

Given that a simple SQL injection like this works on the form, I'm not sure why SQLMap keeps reporting that there are no injection vulnerabilities in the page. I'm guessing that I'm writing my shell commands incorrectly, since I'm just getting started with the tool. So far, I've run the following:

sqlmap --wizard 192.168.254.21
sqlmap --level=5 --risk=3 -a 192.168.254.21

In both cases, SQLMap comes back reporting no vulnerabilities. Any ideas on how to improve my use of the tool so that it will correctly identify basic vulnerabilities like this?

Improve this question
1
  • point sqlmap to the login form, specifically?
    – schroeder ♦
    Jun 1, 2017 at 9:41

1 Answer 1

Reset to default
2

You usually need to provide sqlmap with the specific request that you want to test for SQL injections. It's not sufficient to specify a plain IP address since sqlmap can't reliably analyze the web application and recognize the form parameters by itself.

Your command would have to look something like this:

./sqlmap.py --data "user=test&password=test" -u http://192.168.254.21/login.php

(You'd have to replace user and password with the correct parameter names of your login form.)

Alternatively, you can experiment with the --forms argument that instructs sqlmap to search for form parameters itself, but that's not always reliable as sqlmap isn't built for scraping complex web apps.

Improve this answer
8
  • Thanks for the tip. I just ran sqlmap --data "email=test&password=test" -u http://192.168.254.21/login.php against the form (email and password being the parameter names in the form's script), and SQLMap came back with both being non-injectable.
    – nxl4
    Jun 1, 2017 at 9:55
  • @Psychonaut418 Did you try increased --risk and --level parameters?
    – Arminius
    Jun 1, 2017 at 9:55
  • No luck. sqlmap --data "email=test&password=test" --level=5 --risk=3 -u http://192.168.254.21/login.php still returns: "all tested parameters appear to be not injectable".
    – nxl4
    Jun 1, 2017 at 10:12
  • @Psychonaut418 Do you have SQL errors turned on? Can your reproduce the injection using, say, curl? Can you simplify the injection to guarantee that sqlmap picks it up and then work your way to more complicated ones? sqlmap really shouldn't have problems with these.
    – Arminius
    Jun 1, 2017 at 10:38
  • 1
    Can't hurt to give that whirl. Thanks for all the suggestions @Arminius!
    – nxl4
    Jun 2, 2017 at 0:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .