3

I have a pretty simple HTML page that submits a username and password to the server via POST method:

<doctype html>
<head>
    <title>SQLMap dynamic parameters</title>
</head>
<body>
    <form id="sqliForm" action="sqli.php" method="POST">
        <input id="username" type="text" name="username">
        <input id="password" type="password" name="password">

        <input type="submit" value="Submit">
    </form>
</body>
</html>

My goal is to perform an automated test which SQLMap provides against the sqli.php. I guess, as simple as it could be. However, there's a JavaScript piece on the client side too that appends a pseudo-random string to the username and password fields upon clicking the "Submit" button, which turns the field names into smth. like usernamePgZd4H and password3vOklA, seemingly different every time. The JS code has been understood so that I can predict the correct name of the fields upon submission though.

Needless to say, SQLMap fails here and picks out only the field names that are currently inside HTML code (i.e. username=&password= when passing the --forms option to sqlmap.py). I've embarked on a good old technique of Manual Staring and found out that there's an --eval option to SQLMap which might have helped me: I could generate a correct username but it's value is what I want to test and not specify myself like in the example provided by the manual:

python sqlmap.py -u "http://www.target.com/vuln.php?id=1&hash=c4ca4238a0b923820dcc509a6f75849b" --eval="import hashlib;hash=hashlib.md5(id).hexdigest()"

Is there any way I could leverage SQLMap's powers here (or maybe even another tool in combination with it)?

P.S.: Here's a sample PHP script that, hopefully, illustrates the problem a bit better than words. You can see that the server compares SHA1 hashes of the UNIX timestamp within the last 3 seconds and whatever came from the client-side. Hardly ever a badass barrier for a determined attacker but looks like prevents automated attempts. The JavaScript at the bottom of the file changes the field names upon form submission.

P.P.S.: My other thought was that I could write a BASH script and feed the resulting "correct" username and password field names to SQLMap but then again, that would be true just for the first requst (?)

Improve this question
7
  • 2
    Why exactly are you appending random strings to your field names?
    – user10211
    Aug 18, 2013 at 9:55
  • Everything depends on what the server does with the provided parameters. Can you post the server-side code or the client side JS and the SQLMap command you are trying?
    – buherator
    Aug 18, 2013 at 13:34
  • @TerryChia This is what a foreign server provides to me. I believe, a technique that's used to deter attackers. In fact, I faced two versions of the same: one with and one without the client-side code. I have piled up my own version with JavaScript for simplicity.
    – JSmyth
    Aug 18, 2013 at 16:23
  • @buherator Sure, pls. see git.io/dynamic.params
    – JSmyth
    Aug 18, 2013 at 16:24
  • 1
    You may have to use a custom burp intruder module.
    – rook
    Aug 18, 2013 at 16:51

1 Answer 1

Reset to default
2

The best way of dealing with this is to write a custom sqlmap tamper script.

You can find examples in the tamper folder. In the script you'll want to make a request to whatever page is generating the random form parameter (or appending to a parameter's value); or if you can truly predict it every time, just have the tamper script generate it itself.

So your script would look something like this (if I am understanding the problem correctly):

def tamper(payload, **kwargs):
    username = get_username()
    password = get_password()
    return payload + "&%s=user1&%s=password" % (username, password)

If you then call sqlmap with --tamper yourtampername it will run that script before every request. It will be a little bit hacky, but your tamper can also introduce new parameters into the request.

Now, if you also want to test those dynamically generated values for injection, things might get a little tricky. Play around with it though and see if you can get it to do what you want.

Improve this answer
3
  • I like the idea and actually have piled something up here for the sample script I provided in the question. I had to pass --skip-urlencode to sqlmap, otherwise the payload is interpreted as a value rather than part of POST data. On top of that, I still have to provide dummy test parameters either with --forms or --data option. That ultimately adds additional data to POST which may happen to be undesirable in general case. For the sample PHP script above having a username as a test parameter would fork things up.
    – JSmyth
    Aug 20, 2013 at 12:36
  • And sqlmap would test only against those params from the CLI and not those in the tamper script. So in my case this attempt should clearly trigger SQLi but, alas, sqlmap remains silent. There just might be something wrong on my side too. Looking more into that.
    – JSmyth
    Aug 20, 2013 at 12:38
  • Update: the reason why tamper script was failing is that it would omit Content-Type:application/x-www-form-urlencoded header when passing the --skip-urlencode option, hence the empty $_POST. Even if I add --headers option that wouldn't change anything. I'm at loss here. Time for a pull request at sqlmap's repo...
    – JSmyth
    Aug 22, 2013 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .