I have a pretty simple HTML page that submits a username
and password
to the server via POST
method:
<doctype html>
<head>
<title>SQLMap dynamic parameters</title>
</head>
<body>
<form id="sqliForm" action="sqli.php" method="POST">
<input id="username" type="text" name="username">
<input id="password" type="password" name="password">
<input type="submit" value="Submit">
</form>
</body>
</html>
My goal is to perform an automated test which SQLMap provides against the sqli.php
. I guess, as simple as it could be. However, there's a JavaScript piece on the client side too that appends a pseudo-random string to the username
and password
fields upon clicking the "Submit" button, which turns the field names into smth. like usernamePgZd4H
and password3vOklA
, seemingly different every time. The JS code has been understood so that I can predict the correct name of the fields upon submission though.
Needless to say, SQLMap fails here and picks out only the field names that are currently inside HTML code (i.e. username=&password=
when passing the --forms
option to sqlmap.py
). I've embarked on a good old technique of Manual Staring and found out that there's an --eval
option to SQLMap which might have helped me: I could generate a correct username but it's value is what I want to test and not specify myself like in the example provided by the manual:
python sqlmap.py -u "http://www.target.com/vuln.php?id=1&hash=c4ca4238a0b923820dcc509a6f75849b" --eval="import hashlib;hash=hashlib.md5(id).hexdigest()"
Is there any way I could leverage SQLMap's powers here (or maybe even another tool in combination with it)?
P.S.: Here's a sample PHP script that, hopefully, illustrates the problem a bit better than words. You can see that the server compares SHA1 hashes of the UNIX timestamp within the last 3 seconds and whatever came from the client-side. Hardly ever a badass barrier for a determined attacker but looks like prevents automated attempts. The JavaScript at the bottom of the file changes the field names upon form submission.
P.P.S.: My other thought was that I could write a BASH script and feed the resulting "correct" username and password field names to SQLMap but then again, that would be true just for the first requst (?)