Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

0
votes
0answers
35 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
1answer
44 views

Dump specific rows from database using sqlmap

I'm trying to dump using sqlmap, I have 3 columns: userid, email, password with 2900000 entries in each. When I just --dump the table, it will start from 1 to 2900000. I don't want all the 2900000, ...
2
votes
0answers
182 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

EDIT 4/12/19: Added reproduction steps. I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've ...
1
vote
1answer
63 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
0
votes
0answers
34 views

Sqlmap - Getting Strange Table Names

I am running sqlmap on folllowing target and getting some weird table names as output. I am not sure why i am getting this as output. The backend dbms is SQLite.Can someone help in that why i am ...
0
votes
1answer
210 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
1
vote
0answers
176 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
0
votes
1answer
145 views

SQLmap after burp possible injection point

Burp states that a GET request have surely a SQL injection point. I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I ...
0
votes
1answer
91 views

SQLmap non authorized user, but the url works in browser

Through Burp Suite I get a possible SQL injection point using this request: POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1 Host: test-...
0
votes
1answer
648 views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
0
votes
0answers
46 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
0
votes
1answer
286 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
0
votes
0answers
113 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
1
vote
1answer
48 views

Is there any publicly available information about how sqlmap works?

I want to understand the deep theory behind sqlmap - the decision making of the programm - how is it done? Is there any public paper? (There is still an option to read and understand sqlmap code and ...
0
votes
1answer
352 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
1
vote
1answer
117 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
164 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
0
votes
1answer
339 views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
0
votes
0answers
133 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
1answer
1k views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
0
votes
1answer
79 views

Can sqlmap be used on telnet?

Is there a way to use sqlmap over telnet or do I have to manually create a web wrapper that will send the payload over a parameter and output the response?
1
vote
0answers
278 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
0
votes
2answers
971 views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
2
votes
0answers
186 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
1
vote
0answers
527 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
1
vote
1answer
734 views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
5
votes
1answer
451 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
1answer
1k views

How to make Sqlmap obtain administrator rights for database?

I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command to learn that the user is dvwa@%: sqlmap -u "http://192.168....
6
votes
1answer
470 views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
1
vote
1answer
851 views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
1
vote
0answers
1k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
1
vote
2answers
1k views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
3
votes
1answer
9k views

How to include multiple parameters in sqlmap POST request

I'm using the following command to inject the Username parameter: sqlmap -r Path_Of_Myfile -p UserName It's running well. But there's also a second parameter of Password. How can I also attempt to ...
1
vote
0answers
440 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
2
votes
1answer
2k views

Using sqlmap --crawl without asking questions

I'm using sqlmap with --crawl option. Whenever a URL is found, it asks me whether to scan it GET http://127.0.0.1:80/demo/sqli.php?id=1 do you want to test this URL? [Y/n/q] How should I ask sqlmap ...
1
vote
1answer
1k views

How to test post login pages for sql injection using sqlmap

I have an application in which post login a page is vulnerable to SQL injection. Post login from the browser I captured the request via burp of that vulnerable page and fed the data to sqlmap. But I'm ...
4
votes
1answer
527 views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
1
vote
1answer
3k views

How can I use sqlmap to get only a certain number of records in SQL Server using a LIMIT and OFFSET?

I'm trying to dump using sqlmap, I have 3 columns: name, lastname, userid with 9000 entries in each. When I just --dump the table, it will start from 1 to 9000. I don't want all the 9000, how can I ...
1
vote
2answers
8k views

MariaDB SQL Injection vulnerability?

I'm testing for SQL Injection on a website. Basically, I'm trying it in the following url: http://example.org/webpage/* where in place of the * the payload should be injected. When I try to put in ...
0
votes
1answer
340 views

This is a Stack Trace or Sql Injection?

Yesterday I posted a question about whether I could do an SQL injection with the following error code: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
5
votes
1answer
7k views

what are the consequences of increasing the “--risk” option of sqlmap?

I use sqlmap to test the services of my company. I tried increasing the value of its "--level" option, but I do not find clear descriptions of the tests added with an increased "--risk" value. So, ...
1
vote
1answer
943 views

SQLMap Failure, Manual SQL Injection Success

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through ...
1
vote
2answers
2k views

How to make sqlmap exploit an SQLi vulnerability

I have found a simple boolean blind SQL vulnerability and want to let sqlmap do the iterating for me but it doesn't seem to work, I have the impression it tries to start at a point that I'm far beyond....
1
vote
1answer
998 views

How to get Sqlmap to detect insertion point with sleep payload?

I have a server which seems to be vulnerable to SQL injection with the following payload detected by BurpSuite: param=value,(select*from(select(sleep(10)))a) The application takes twice the time ...
4
votes
1answer
3k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
1
vote
1answer
643 views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
2
votes
0answers
885 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
3
votes
2answers
1k views

Sqlmap: bypass website security filtering SQL reserved words

I'm using sqlmap to get a website's DB and found out that the site is time-based boolean vulnerable; but the target is showing SQL errors, which made me think that it would be an injection error. I ...
2
votes
1answer
7k views

sqlmap load https request using “-r REQUESTFILE Load HTTP request from a file”

I'm testing a site that automatically redirects http request to https. When I'm using Burp I set the target to use https and the request goes through without a problem. However when I use the same ...