1

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through the UserID field will get you through the login.php script:

'|| 1=1#;

This injection also worked:

'OORR 1=1#;

Given that a simple SQL injection like this works on the form, I'm not sure why SQLMap keeps reporting that there are no injection vulnerabilities in the page. I'm guessing that I'm writing my shell commands incorrectly, since I'm just getting started with the tool. So far, I've run the following:

sqlmap --wizard 192.168.254.21
sqlmap --level=5 --risk=3 -a 192.168.254.21

In both cases, SQLMap comes back reporting no vulnerabilities. Any ideas on how to improve my use of the tool so that it will correctly identify basic vulnerabilities like this?

  • point sqlmap to the login form, specifically? – schroeder Jun 1 '17 at 9:41
2

You usually need to provide sqlmap with the specific request that you want to test for SQL injections. It's not sufficient to specify a plain IP address since sqlmap can't reliably analyze the web application and recognize the form parameters by itself.

Your command would have to look something like this:

./sqlmap.py --data "user=test&password=test" -u http://192.168.254.21/login.php

(You'd have to replace user and password with the correct parameter names of your login form.)

Alternatively, you can experiment with the --forms argument that instructs sqlmap to search for form parameters itself, but that's not always reliable as sqlmap isn't built for scraping complex web apps.

  • Thanks for the tip. I just ran sqlmap --data "email=test&password=test" -u http://192.168.254.21/login.php against the form (email and password being the parameter names in the form's script), and SQLMap came back with both being non-injectable. – nxl4 Jun 1 '17 at 9:55
  • @Psychonaut418 Did you try increased --risk and --level parameters? – Arminius Jun 1 '17 at 9:55
  • No luck. sqlmap --data "email=test&password=test" --level=5 --risk=3 -u http://192.168.254.21/login.php still returns: "all tested parameters appear to be not injectable". – nxl4 Jun 1 '17 at 10:12
  • @Psychonaut418 Do you have SQL errors turned on? Can your reproduce the injection using, say, curl? Can you simplify the injection to guarantee that sqlmap picks it up and then work your way to more complicated ones? sqlmap really shouldn't have problems with these. – Arminius Jun 1 '17 at 10:38
  • 1
    Can't hurt to give that whirl. Thanks for all the suggestions @Arminius! – nxl4 Jun 2 '17 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.