1

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point.

For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not detecting the injection point under ?id.

Has anyone successfully exploited such an injection point?

  • personally I would do this manually... do this id=10-(SELECT 1), if that works just type your injection bit b bit. I have exploited such an injection point quite a lot, its my favourite kind, math based sql injection – TheHidden Jan 31 '18 at 9:11
  • Have you entered the URL as you put it here to Sqlmap? URL's fed to it should be valid, non injected URL's. It might have something to do with that. So instead of using http://127.0.0.1/index.php?id=10-1, trying with id=9 might produce different results. – Nomad Apr 1 '18 at 20:06
1
  • Make sure your URL does not contain any SQL injection snippets. The URL should be valid. Also try using * on the parameter like so:http://mysite.com/test.php?id=*

  • Make sure your request is a valid GET request and not POST. Mixing those up can cause to miss your target.

  • Try using the -r flag with an intercepted request you've saved from something like burp. This way I know I'm not missing anything important. Do this if you want to test POST method requests.
0

Try to use * after the id parameter. It will definitely work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.