Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

-1
votes
0answers
66 views

Best way to do sql injection/man in the middle on a private LAN [closed]

I have a college project and the professor asked my group to perform a sql injection or man in the middle in a previously known LAN. We'll have to configure a Cisco router then use a Docker image to "...
0
votes
0answers
22 views

Sqlmap - Getting Strange Table Names

I am running sqlmap on folllowing target and getting some weird table names as output. I am not sure why i am getting this as output. The backend dbms is SQLite.Can someone help in that why i am ...
0
votes
1answer
25 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
1
vote
0answers
69 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
0
votes
0answers
27 views

SQLmap different response than burp

This is my GET request, inside a get_request.txt file: GET /sa4apc/restrict/menuApc.do?MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=C&s_ELIMINATI=1&s_ASSISTITO='giovanni&s_TIPO_SOGGETTO=...
0
votes
1answer
97 views

SQLmap after burp possible injection point

Burp states that a GET request have surely a SQL injection point. I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I ...
0
votes
1answer
43 views

SQLmap non authorized user, but the url works in browser

Through Burp Suite I get a possible SQL injection point using this request: POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1 Host: test-...
0
votes
1answer
138 views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
0
votes
0answers
38 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
0
votes
1answer
127 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
0
votes
0answers
69 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
1
vote
1answer
44 views

Is there any publicly available information about how sqlmap works?

I want to understand the deep theory behind sqlmap - the decision making of the programm - how is it done? Is there any public paper? (There is still an option to read and understand sqlmap code and ...
0
votes
1answer
244 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
1
vote
0answers
183 views

Custom payload SQLMap from OWASP Zap vulnerability report

I ran OWASP Zap over my site. In the vulnerability report I read that there is an SQL injection problem: Advanced SQL Injection- MySQL > 5.0.11 stacked queries (SELECT - comment) (see img for ...
1
vote
1answer
101 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
108 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
0
votes
1answer
164 views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
0
votes
0answers
117 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
1answer
705 views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
0
votes
1answer
78 views

Can sqlmap be used on telnet?

Is there a way to use sqlmap over telnet or do I have to manually create a web wrapper that will send the payload over a parameter and output the response?
1
vote
0answers
260 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
0
votes
0answers
172 views

Inject the same JSON payload twice - SQLmap

I have a "password change" form that could be injectable. However, I can't find a way to use SQLmap in this case. Here is the legitimate POST request: POST http://localhost/api/passwordchange ... ...
0
votes
2answers
804 views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
2
votes
0answers
171 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
1
vote
0answers
429 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
0
votes
1answer
491 views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
0
votes
0answers
315 views

Single and double URL encoding tamper scripts and sqlmap

I am trying to understand how sqlmap tamper scripts work, and when each one of them is able to bypass certain custom filters. In the following code after the POST parameter is filtered for strings ...
5
votes
1answer
405 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
1answer
953 views

How to make Sqlmap obtain administrator rights for database?

I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command to learn that the user is dvwa@%: sqlmap -u "http://192.168....
6
votes
1answer
423 views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
0
votes
0answers
272 views

Bypassing IP Restriction or finding accepted IPs for SQL Database

I have discovered the credentials of a website database. I've tried to access the database from SQLMap (which claims that you can access the SQL database from external sources) but in the meantime, ...
1
vote
1answer
736 views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
1
vote
0answers
901 views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
1
vote
2answers
1k views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
2
votes
1answer
7k views

How to include multiple parameters in sqlmap POST request

I'm using the following command to inject the Username parameter: sqlmap -r Path_Of_Myfile -p UserName It's running well. But there's also a second parameter of Password. How can I also attempt to ...
1
vote
0answers
397 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
2
votes
1answer
1k views

Using sqlmap --crawl without asking questions

I'm using sqlmap with --crawl option. Whenever a URL is found, it asks me whether to scan it GET http://127.0.0.1:80/demo/sqli.php?id=1 do you want to test this URL? [Y/n/q] How should I ask sqlmap ...
1
vote
1answer
1k views

How to test post login pages for sql injection using sqlmap

I have an application in which post login a page is vulnerable to SQL injection. Post login from the browser I captured the request via burp of that vulnerable page and fed the data to sqlmap. But I'm ...
4
votes
1answer
483 views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
0
votes
0answers
211 views

sqlmap dbms error message

I am testing SQL injection on a website of a peer by using sqlmap. When I run it with parse-errorand v I get this back: [18:17:47] [WARNING] parsed DBMS error message: 'function(error) {' This does ...
1
vote
1answer
2k views

How can I use sqlmap to get only a certain number of records in SQL Server using a LIMIT and OFFSET?

I'm trying to dump using sqlmap, I have 3 columns: name, lastname, userid with 9000 entries in each. When I just --dump the table, it will start from 1 to 9000. I don't want all the 9000, how can I ...
1
vote
2answers
7k views

MariaDB SQL Injection vulnerability?

I'm testing for SQL Injection on a website. Basically, I'm trying it in the following url: http://example.org/webpage/* where in place of the * the payload should be injected. When I try to put in ...
0
votes
1answer
321 views

This is a Stack Trace or Sql Injection?

Yesterday I posted a question about whether I could do an SQL injection with the following error code: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
4
votes
1answer
6k views

what are the consequences of increasing the “--risk” option of sqlmap?

I use sqlmap to test the services of my company. I tried increasing the value of its "--level" option, but I do not find clear descriptions of the tests added with an increased "--risk" value. So, ...
1
vote
1answer
867 views

SQLMap Failure, Manual SQL Injection Success

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through ...
1
vote
2answers
1k views

How to make sqlmap exploit an SQLi vulnerability

I have found a simple boolean blind SQL vulnerability and want to let sqlmap do the iterating for me but it doesn't seem to work, I have the impression it tries to start at a point that I'm far beyond....
1
vote
1answer
952 views

How to get Sqlmap to detect insertion point with sleep payload?

I have a server which seems to be vulnerable to SQL injection with the following payload detected by BurpSuite: param=value,(select*from(select(sleep(10)))a) The application takes twice the time ...
4
votes
1answer
2k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
1
vote
1answer
618 views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...