Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Filter by
Sorted by
Tagged with
1
vote
1answer
619 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
1answer
1k views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
-1
votes
0answers
33 views

Set injection method to Boolean blind rather than time based [closed]

So I've managed to break into the database and I'm given the following vulnerabilities Parameter: postids (GET) Type: boolean-based blind Title: Boolean-based blind - Parameter replace (original ...
2
votes
0answers
63 views

how to get shell from blind sql injection? [closed]

I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things. I can read the databases and tables. tried to find a way to get a shell from SQL ...
0
votes
1answer
563 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
3
votes
1answer
504 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've tried to be very specific in my sqlmap ...
0
votes
2answers
1k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
10
votes
2answers
327 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
1
vote
2answers
104 views

Is there any way to find all the endpoints for any website for sql injection? [closed]

I'm wondering, if it's possible to discover all the endpoints for any product which is prone to SQL injection. I want all the endpoints where I can apply SQL injection on my site.
0
votes
1answer
477 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
1
vote
0answers
80 views

how to create random request time delay in sqlmap?

How can i configure sql-map to try payloads at random time delay? as an example time between first and second request can be 0.10s and second and third might 0.25 and so on. i know there is --delay ...
0
votes
0answers
145 views

How to send file with SQLMap

Note: this is a challenge in a past CTF. There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
3
votes
3answers
14k views

SQLMap: How to dump tables that begin with a specific letter?

I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T": sqlmap.py -u www.website -D database -T tables (...)
0
votes
0answers
133 views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
5
votes
1answer
2k views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie)...
0
votes
0answers
170 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
1answer
440 views

Dump specific rows from database using sqlmap

I'm trying to dump using sqlmap, I have 3 columns: userid, email, password with 2900000 entries in each. When I just --dump the table, it will start from 1 to 2900000. I don't want all the 2900000, ...
1
vote
1answer
126 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
0
votes
0answers
43 views

Sqlmap - Getting Strange Table Names

I am running sqlmap on folllowing target and getting some weird table names as output. I am not sure why i am getting this as output. The backend dbms is SQLite.Can someone help in that why i am ...
0
votes
1answer
3k views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
1
vote
1answer
1k views

How to test post login pages for sql injection using sqlmap

I have an application in which post login a page is vulnerable to SQL injection. Post login from the browser I captured the request via burp of that vulnerable page and fed the data to sqlmap. But I'm ...
0
votes
1answer
2k views

How to make Sqlmap obtain administrator rights for database?

I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command to learn that the user is dvwa@%: sqlmap -u "http://192.168....
3
votes
1answer
14k views

How to include multiple parameters in sqlmap POST request

I'm using the following command to inject the Username parameter: sqlmap -r Path_Of_Myfile -p UserName It's running well. But there's also a second parameter of Password. How can I also attempt to ...
0
votes
1answer
217 views

SQLmap non authorized user, but the url works in browser

Through Burp Suite I get a possible SQL injection point using this request: POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1 Host: test-...
0
votes
0answers
95 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
0
votes
0answers
270 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
0
votes
1answer
2k views

Timed out in sqlmap

I detect a sqli vulnerability in a target url using sqlmap. Now when I try this I always get "connection timed out to the target URL": ./sqlmap.py -u targetURL --dbs How can I solve it?
1
vote
1answer
1k views

Is it possible to bypass HTML character reference encoding to inject SQL in this context?

I was poking around with the "reset password" page of a website (security testing and bug hunting is allowed on it.) When you put in your email address, it uses HTML character reference encoding to ...
1
vote
1answer
84 views

Is there any publicly available information about how sqlmap works?

I want to understand the deep theory behind sqlmap - the decision making of the programm - how is it done? Is there any public paper? (There is still an option to read and understand sqlmap code and ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
1
vote
1answer
163 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
246 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
0
votes
1answer
801 views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
1
vote
0answers
641 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
5
votes
1answer
530 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
1answer
2k views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
0
votes
1answer
123 views

Can sqlmap be used on telnet?

Is there a way to use sqlmap over telnet or do I have to manually create a web wrapper that will send the payload over a parameter and output the response?
1
vote
0answers
312 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
2
votes
0answers
222 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
6
votes
1answer
578 views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
1
vote
1answer
1k views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
1
vote
2answers
2k views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
1
vote
1answer
5k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASP BWA document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. root kali:~# sqlmap -u "http://x.x.x.x/WackoPicko/...
1
vote
0answers
2k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
1
vote
0answers
560 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
3
votes
1answer
2k views

Using sqlmap --crawl without asking questions

I'm using sqlmap with --crawl option. Whenever a URL is found, it asks me whether to scan it GET http://127.0.0.1:80/demo/sqli.php?id=1 do you want to test this URL? [Y/n/q] How should I ask sqlmap ...
4
votes
1answer
619 views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
1
vote
1answer
3k views

How can I use sqlmap to get only a certain number of records in SQL Server using a LIMIT and OFFSET?

I'm trying to dump using sqlmap, I have 3 columns: name, lastname, userid with 9000 entries in each. When I just --dump the table, it will start from 1 to 9000. I don't want all the 9000, how can I ...
6
votes
2answers
2k views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
4
votes
1answer
3k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...