I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and saved it in a file, say myFile. Now on SQLMap I ran the following command:
sqlmap -r /root/Desktop/myFile -p htmlbevt_id
I get the following error message:
unable to connect to the target URL or proxy. sqlmap is going to retry the request
Am I missing something?
Am I required to login to the application before I run the above query? If so, how do I make SQL recognize the login? I mean is it that I need to login to the application from the browser and then run the above query (in which case I am not certain how exactly would SQLMap get to know that I am already logged into the application), or is there a different way to do this ?
Through some further googling i learned that --cookie needs to be used to replay the session authentication in SQLmap. Also since the request is a POST, some forums suggest the usage of --data as well, which I did. None of this has however been useful so far. I tried -v 6 to debug and see what was going wrong. And SQLmap reports "not a valid WebScarab log data". Not sure if this is the cause of the error.
Ok, a lot of the problem was solved. So now with the help of CO2 extension for Burp I was able to replay the entire traffic of the multipart POST request, along with all the session cookies, through SQLMap.
But now there is a different problem that I am facing. While I check for the application in the browser the session is still alive. But while scanning the SQLi injectable suspected parameter with SQLMap (I set verbose level to 3) I found that the server was returning a HTTP 400 session time out. What could be going wrong and is there a way to keep the session maintained while SQLMap does the scanning ?