I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new token from the app. To obtain a "fresh" token i did a python script but.. how to pass and upgrade this token to sqlmap for each sqlmap-request?

Example, request is:

POST /xxx/page.sto HTTP/1.1
Host: xxxx
Content-Type: multipart/form-data; boundary=------47876555712215045582138952413
...other headers...

Content-Disposition: form-data; name="CustomToken"

1240100630411055       *--this is the token i need to change every request--*
Content-Disposition: form-data; name="param2"

Content-Disposition: form-data; name="param3"

mike*  *--this is the vuln param--*
Content-Disposition: form-data; name="param4"


the commands:

sqlmap -r request.txt -p param3

with char '*' near param3 (mike) sqlmap automatically recognizes injection params, but how can i give dynamically a token (or a list of valid tokens) to tool?

ps. I have also tried with "--tamper" options, wrote a script that makes a request and then rebuilds a POST data but it doesn't work because sqlmap when makes post request it doubles the POST data.

  • Welcome to Information Security. While securely generating and passing tokens certainly have security implications, figuring out how to pass these tokens to different systems is either a software development or sysadmin problem. I'm flagging to migrate in the hopes that it'll get somewhere where people will be able to help you. Sorry about this! While waiting for mods to figure things out, feel free to browse other questions, get a better feel for the topics here, and take a tour. – Ghedipunk May 3 '19 at 23:21
  • @sense Take a look here: github.com/sqlmapproject/sqlmap/issues/2 – Tom K. May 11 '19 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.