I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through the UserID field will get you through the
This injection also worked:
Given that a simple SQL injection like this works on the form, I'm not sure why SQLMap keeps reporting that there are no injection vulnerabilities in the page. I'm guessing that I'm writing my shell commands incorrectly, since I'm just getting started with the tool. So far, I've run the following:
sqlmap --wizard 192.168.254.21 sqlmap --level=5 --risk=3 -a 192.168.254.21
In both cases, SQLMap comes back reporting no vulnerabilities. Any ideas on how to improve my use of the tool so that it will correctly identify basic vulnerabilities like this?