Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

0
votes
0answers
26 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
0
votes
1answer
51 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
0
votes
0answers
44 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
1
vote
1answer
43 views

Is there any publicly available information about how sqlmap works?

I want to understand the deep theory behind sqlmap - the decision making of the programm - how is it done? Is there any public paper? (There is still an option to read and understand sqlmap code and ...
0
votes
1answer
126 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
1
vote
0answers
88 views

Custom payload SQLMap from OWASP Zap vulnerability report

I ran OWASP Zap over my site. In the vulnerability report I read that there is an SQL injection problem: Advanced SQL Injection- MySQL > 5.0.11 stacked queries (SELECT - comment) (see img for ...
1
vote
1answer
96 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
67 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
0
votes
1answer
85 views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
0
votes
0answers
97 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
1answer
359 views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
0
votes
1answer
76 views

Can sqlmap be used on telnet?

Is there a way to use sqlmap over telnet or do I have to manually create a web wrapper that will send the payload over a parameter and output the response?
1
vote
0answers
233 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
0
votes
0answers
126 views

Inject the same JSON payload twice - SQLmap

I have a "password change" form that could be injectable. However, I can't find a way to use SQLmap in this case. Here is the legitimate POST request: POST http://localhost/api/passwordchange ... ...
0
votes
2answers
665 views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
2
votes
0answers
151 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
0
votes
0answers
368 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
0
votes
1answer
331 views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
0
votes
0answers
258 views

Single and double URL encoding tamper scripts and sqlmap

I am trying to understand how sqlmap tamper scripts work, and when each one of them is able to bypass certain custom filters. In the following code after the POST parameter is filtered for strings ...
5
votes
1answer
348 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
1answer
744 views

How to make Sqlmap obtain administrator rights for database?

How to make sqlmap obtain administrator rights for database? I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command ...
6
votes
1answer
365 views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
0
votes
1answer
1k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
0
votes
0answers
263 views

Bypassing IP Restriction or finding accepted IPs for SQL Database

I have discovered the credentials of a website database. I've tried to access the database from SQLMap (which claims that you can access the SQL database from external sources) but in the meantime, ...
1
vote
1answer
615 views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
1
vote
0answers
758 views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
0
votes
0answers
484 views

Vega says SQL injection, SQL Map doesn't find anything

I have been pen testing our website and Vega pointed me to a sql injection in our login form. I tried to use burpsuite and sql map to test for the injection. I haven't gotten anywhere though. Here'...
1
vote
2answers
815 views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
1
vote
1answer
5k views

How to include multiple parameters in SQLmap post command

I'm running the command: sqlmap -r Path_Of_Myfile -p UserName It's running good. But I want to include password parameter as well. And I tried all combinations like UserName,Password / UserName&...
1
vote
0answers
364 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
2
votes
1answer
940 views

Using sqlmap --crawl without asking questions

I'm using sqlmap with --crawl option. Whenever a URL is found, it asks me whether to scan it GET http://127.0.0.1:80/demo/sqli.php?id=1 do you want to test this URL? [Y/n/q] How should I ask sqlmap ...
0
votes
0answers
535 views

How to retrieve column names along with the data when trying to fetch limited entries using sqlmap --sql-query

Dumping limited entries from a given table (eg. users) from postgreSQL database using sqlmap with --start and --stop is NOT working for me. So I tried to use --sql-query="select * from users limit 2" ...
0
votes
0answers
638 views

How to run sqlmap after login on site [duplicate]

I need to run sqlmap (for educational use) on a part of website, which is only accessible after login. How would you do that? When I try to paste the url in without logging in I just get redirect and ...
1
vote
0answers
893 views

How to test post login pages for sql injection using sqlmap

I have an application in which post login a page is vulnerable to sql injection. Post login from browser I captured the request via burp of that vulnerable page and feeded the data to sqlmap. But I'm ...
4
votes
1answer
449 views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
0
votes
0answers
185 views

sqlmap dbms error message

I am testing SQL injection on a website of a peer by using sqlmap. When I run it with parse-errorand v I get this back: [18:17:47] [WARNING] parsed DBMS error message: 'function(error) {' This does ...
1
vote
1answer
2k views

How can I use sqlmap to get only a certain number of records in SQL Server using a LIMIT and OFFSET?

I'm trying to dump using sqlmap, I have 3 columns: name, lastname, userid with 9000 entries in each. When I just --dump the table, it will start from 1 to 9000. I don't want all the 9000, how can I ...
1
vote
2answers
6k views

MariaDB SQL Injection vulnerability?

I'm testing for SQL Injection on a website. Basically, I'm trying it in the following url: http://example.org/webpage/* where in place of the * the payload should be injected. When I try to put in ...
0
votes
1answer
302 views

This is a Stack Trace or Sql Injection?

Yesterday I posted a question about whether I could do an SQL injection with the following error code: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
4
votes
1answer
4k views

what are the consequences of increasing the “--risk” option of sqlmap?

I use sqlmap to test the services of my company. I tried increasing the value of its "--level" option, but I do not find clear descriptions of the tests added with an increased "--risk" value. So, ...
1
vote
1answer
774 views

SQLMap Failure, Manual SQL Injection Success

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through ...
1
vote
2answers
1k views

How to make sqlmap exploit an SQLi vulnerability

I have found a simple boolean blind SQL vulnerability and want to let sqlmap do the iterating for me but it doesn't seem to work, I have the impression it tries to start at a point that I'm far beyond....
1
vote
1answer
894 views

How to get Sqlmap to detect insertion point with sleep payload?

I have a server which seems to be vulnerable to SQL injection with the following payload detected by BurpSuite: param=value,(select*from(select(sleep(10)))a) The application takes twice the time ...
0
votes
0answers
64 views

SQLMAP inaccurate data fetch

I am using sqlmap to fetch some data from database but unfortunately some data are not accurate. For example, the real data is "APPLE" but sqlmap fetches '@PPLE' or something like this. In some other ...
4
votes
1answer
2k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
1
vote
1answer
580 views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
2
votes
0answers
816 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
3
votes
2answers
1k views

Sqlmap: bypass website security filtering SQL reserved words

I'm using sqlmap to get a website's DB and found out that the site is time-based boolean vulnerable; but the target is showing SQL errors, which made me think that it would be an injection error. I ...
2
votes
1answer
5k views

sqlmap load https request using “-r REQUESTFILE Load HTTP request from a file”

I'm testing a site that automatically redirects http request to https. When I'm using Burp I set the target to use https and the request goes through without a problem. However when I use the same ...
1
vote
1answer
457 views

someone trying to SQLi server using sqlmap

Someone is trying to SQLi my domain using sqlmap. I'm getting a lot of errors from mysql. My server access log shows: - - HTTP/1.1" 200 10559 "-" "sqlmap/1.0.4.0#dev (http://sqlmap.org)" ...