I'm using the following command to inject the
sqlmap -r Path_Of_Myfile -p UserName
It's running well. But there's also a second parameter of
Password. How can I also attempt to inject the
Password parameters in sqlmap?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You can just comma-separate the parameters you want to test.
In a GET request:
$ sqlmap -u "http://example.com/?a=1&b=2&c=3" -p "a,b"
In a POST request:
$ sqlmap -u "http://example.com/" --data "a=1&b=2&c=3" -p "a,b" --method POST ... [13:37:54] [WARNING] heuristic (basic) test shows that POST parameter 'a' might not be injectable ... [13:37:59] [WARNING] heuristic (basic) test shows that POST parameter 'b' might not be injectable ...
Both examples would test the specified parameters
b, but ignore
c. (I also put them into double quotes which isn't actually necessary on Linux.)