So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to test the application sqlmap is unable to get an sql injection. Can anybody help to modify the code to get an sql injection. The redir cookie is set when there is GET for home route. I am using flask-sqlalchemy as an ORM

Or can somebody provide sqlmap command to get a sql injection on this code

def page_not_found(e):
    cookie = request.cookies.get('redir')
    redir_url = url_for('home')
    if cookie:
            redir_loc = base64.b64decode(cookie)
        except binascii.Error:
            result = db.engine.execute('SELECT * FROM user WHERE cookie=' + cookie)
            return json.dumps(result)
        redir_url = json.loads(redir_loc)['location']
    return redirect(redir_url)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.