I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can manually construct a request that retrieves information from DB, now I want sqlmap to retrieve everything. Issue is, the underlying SQL query has to return very specific values in some of the columns, otherwise service just errors out and sqlmap during its scan will not come across appropriate values. How do I help it?


the vulnerable endpoint is at site/list?category=, exploitation looks like this:

site/list?category=' UNION ALL SELECT 1,'TAG',1.2,'USABLE','string1','string2' #

(no urlencoding for clarity)

out of 6 columns, the first one must be an integer, the second one must be a very specific string (otherwise request just errors out), the third one must be a decimal fraction, the fourth can be used to exfiltrate data, the fifth and the sixth are strings which are retrieved but not rendered in the response, hence useless. How would I tell sqlmap to use specific constants for all columns but one?

P.S. Boolean-based injection works on the same endpoint, but the speed of data exfiltration is really slow. I want to speed it up (and I also want to avoid writing my own exfiltration script).


You must log in to answer this question.

Browse other questions tagged .