I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point.

For example, displays the content of id=9. But SQLMAP is not detecting the injection point under ?id.

Has anyone successfully exploited such an injection point?

  • personally I would do this manually... do this id=10-(SELECT 1), if that works just type your injection bit b bit. I have exploited such an injection point quite a lot, its my favourite kind, math based sql injection
    – TheHidden
    Jan 31, 2018 at 9:11
  • Have you entered the URL as you put it here to Sqlmap? URL's fed to it should be valid, non injected URL's. It might have something to do with that. So instead of using, trying with id=9 might produce different results.
    – Nomad
    Apr 1, 2018 at 20:06

2 Answers 2

  • Make sure your URL does not contain any SQL injection snippets. The URL should be valid. Also try using * on the parameter like so:http://mysite.com/test.php?id=*

  • Make sure your request is a valid GET request and not POST. Mixing those up can cause to miss your target.

  • Try using the -r flag with an intercepted request you've saved from something like burp. This way I know I'm not missing anything important. Do this if you want to test POST method requests.

Try to use * after the id parameter. It will definitely work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .