0

I am trying to use sqlmap. Although every time I use it, I just get a response of:

[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [INFO] testing if the target URL content is stable
[13:39:12] [INFO] target URL content is stable
[13:39:12] [CRITICAL] no parameter(s) found for testing in the provided data (e.g. GET parameter 'id' in 'www.site.com/index.php?id=1'). You are advised to rerun with '--forms --crawl=2'

[*] ending @ 13:39:12 /2020-07-29/

I'm using the websites I find in the tutorials (like: https://www.binarytides.com/sqlmap-hacking-tutorial/). But I always get this message. If not, it keeps asking me for stuff and then doesn't work.

Here's the command I use: python sqlmap.py -u "www.example.com"

  • 1
    Just to clarify - are you trying to run the example queries as they are provided exactly? As the example website given is site.com in that tutorial, and that would need to be replaced by an actual website for the tool to work. – Dave Jul 29 at 22:22
  • I am using websites from other tutorials, but they don't work. Like: techpanda.org – Mr. Cow Jul 29 at 22:29
  • These are not the droids you are looking for... – Conor Mancone Jul 29 at 22:58
  • The "site" in the link you provided is not an actual site... You are supposed to replace site.com with an actual site... And you need to provide parameters, just like the error message says. If you are doing all these things, then you need to edit your question to include these details. Including, all the "other stuff" it is asking you for. – schroeder Jul 30 at 9:02
  • You need to learn SQL first before you go around running SQL injection tools. Not to mention running tools like this against random websites is highly illegal – john doe Jul 31 at 21:06
1

You should be testing it on a vulnerable parameter.

[13:39:12] [CRITICAL] no parameter(s) found for testing in the provided data (e.g. GET parameter 'id' in 'www.site.com/index.php?id=1'). You are advised to rerun with '--forms --crawl=2'

You should also make sure that the website you are testing is running a SQL DB and accepts data.

| improve this answer | |
  • Sorry, didn't know how much hate I would get. I wanted to get into Ethical Hacking, so I got sqlmap. I'll stay away from this now. I am so sorry. – Mr. Cow Aug 1 at 15:53
0

For legal reasons you should only attempt to hack websites you have explicit permission to test. Random websites on the internet doesn't meet that criteria unless you're doing a bugbounty (in which case sqlmap is probably the wrong approach). A better option would be to install a web application designed for learning security, such as the Damn Vulnerable Web Application on your local machine or a VM and then run sqlmap against it.

| improve this answer | |
  • Sorry, didn't know how much hate I would get. I wanted to get into Ethical Hacking, so I got sqlmap. I'll stay away from this now. I am so sorry. – Mr. Cow Aug 1 at 15:53
  • I would say getting some comments on a website is better than a criminal conviction or possibly jail time for trying to learn. Ethical hacking is a good career IMHO, but you need to be aware of the laws you operate under. – wireghoul Aug 3 at 8:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.