There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain database. It's a PHP application and the interesting part, that I learned through some discussions with the developer who own that form, is that prepared statements are not being used to process the respective queries to handle the POST data coming through the form.
This made me suspicious and hopeful of finding a potential SQLi.
I am running SQLmap including a valid session and other form data. However, through a -v 5, I realized that SQLMap is actually getting a 302 redirect response for every single request. Through some further investigation, I realized that the form in question (say form3) is obtained after I follow the sequence
form1 --> form2 --> form3.
If I try accessing the form3 directly (even through the browser, post login of course), I am redirected back to form1. So I need to follow the above sequence strictly to be able to actually submit form3 data to be processed.
Is there a way I can automate this sequence in SQLmap? Or is there any way that I can test for the existence of a SQLi on form3 given the above scenario ?