0
  1. Is there any way to instruct sqlmap to perform normal injections without escaping and commenting? For example, it's confirmed that id=1111+or+(INJECTION_HERE)=1--+ is valid, so can I instruct sqlmap to use that as an injection point and extract the data?

  2. If id=(pg_sleep(10)) would result in a sleep, is there any tool or sqlmap to perform the injection without injecting a single quote where it would just immediately automate all possible queries to retrieve data

  3. Is it possible to specify a HTTP timeout as the true condition?

Update:

Using --time-sec even though, I've checked it in BurpSuite, a HTTP Timeout Occurs, but SQLMAP still does not detect a valid Injection. The reason might be because, --time-sec is used for Time-Based Injection, whereas the HTTP Timeout occurs when a valid SQL Query is submitted and the server is takes a long time to provide a response (Due to huge amount of data).

HTTP Request (request1.txt)

POST /bin/<redacted>/RedactedServlet HTTP/1.1
Content-Length: 57
Host: example.com
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="98", "Google Chrome";v="98"
DNT: 1
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
sec-ch-ua-platform: "Linux"
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Origin: https://example.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://example.com/example.html
Accept-Encoding: gzip, deflate
Accept-Language: en-MY,en-US;q=0.9,en;q=0.8
Cookie: JSESSIONID=<REDACTED>
Connection: close

id=111*

SQLMap Command: sqlmap -r request1.txt --proxy=http://127.0.0.1:4442 --force-ssl --time-sec=3 --suffix=" or 1=1-- "

1 Answer 1

0

How can I skip encoding?

As the documentation clearly states, the flag --skip-urlencode can be used to skip URL encoding.

How can I prevent sqlmap from injecting a single quote?

It will automatically try as many possible injection formats as it can - including direct WHERE-clause or direct sub-SELECT injection. This should be the default behavior.

Is it possible to specify a HTTP timeout as true condition?

The documentation states:

It is possible to set the seconds to delay the response when testing for time-based blind SQL injection, by providing the --time-sec option followed by an integer. By default it's value is set to 5 seconds.

This means that by default, if a response takes longer than 5 seconds, sqlmap considers the condition to be "true". A HTTP timeout is nothing else than your client saying that the server took too long to respond. Feel free to set the value to whatever is appropriate.

5
  • Updated the question regarding --time-sec, it still did'nt work even though a HTTP Timeout Occurs in BurpSuite. The reason might be because, --time-sec is used for Time-Based Injection, whereas the HTTP Timeout occurs when a valid SQL Query is submitted and the server is takes a long time to provide a response (Due to huge amount of data). Commented Aug 5, 2022 at 9:55
  • If you are running sqlmap through Burp, then try increasing Burp's timeout limit. A timeout is a client-side event, where the client says "The server is taking too long." Documentation on how to do that can be found here Commented Aug 5, 2022 at 10:26
  • Yeah, that's possible, but then again, i guess there's no way to indicate to sqlmap that says HTTP Timeout is a TRUE condition? Because, SQLMap did use the correct Injection query, but then, because of the page requiring a LONG time to respond, the timeout is reached, i would prefer if i don't have to change any BurpSuite or SQLMap settings, all i need is just to indicate to sqlmap that says HTTP Timeout == True. Commented Aug 8, 2022 at 3:24
  • Why are you not using --string= to check for the burp timeout page? That should be equivalent Commented Aug 8, 2022 at 13:53
  • So --string=""? I'll try that the next time i have the chance, since the engagement ended, thanks! Commented Aug 9, 2022 at 0:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .