Questions tagged [sqlmap]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Filter by
Sorted by
Tagged with
1
vote
1answer
521 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
576 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
1
vote
1answer
3k views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
1
vote
1answer
6k views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
0
votes
1answer
160 views

Can sqlmap be used on telnet?

Is there a way to use sqlmap over telnet or do I have to manually create a web wrapper that will send the payload over a parameter and output the response?
0
votes
2answers
2k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
2
votes
0answers
275 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
1
vote
0answers
1k views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
2
votes
1answer
5k views

How limit request rate of sqlmap?

How can we restrict the rate of requests made from sqlmap to the foreign server in order to prevent detection from waf?
5
votes
1answer
1k views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
1answer
7k views

How to make Sqlmap obtain administrator rights for database?

I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command to learn that the user is dvwa@%: sqlmap -u "http://192.168....
6
votes
1answer
1k views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
0
votes
1answer
3k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
1
vote
1answer
3k views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
2
votes
0answers
3k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
2
votes
2answers
5k views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
10
votes
1answer
38k views

How to include multiple parameters in sqlmap POST request

I'm using the following command to inject the Username parameter: sqlmap -r Path_Of_Myfile -p UserName It's running well. But there's also a second parameter of Password. How can I also attempt to ...
1
vote
0answers
744 views

effective way to bypass Sucuri WAF on Sqlmap? [closed]

i'm struggling to bypass a website WAF that uses Sucuri WAF, i saw some tutorials online, and tried to mix them with some pre-defined sqlmap tampers, such as "randomcaso, charencode", but i wasn't ...
4
votes
1answer
6k views

Using sqlmap --crawl without asking questions

I'm using sqlmap with --crawl option. Whenever a URL is found, it asks me whether to scan it GET http://127.0.0.1:80/demo/sqli.php?id=1 do you want to test this URL? [Y/n/q] How should I ask sqlmap ...
1
vote
1answer
3k views

How to test post login pages for sql injection using sqlmap

I have an application in which post login a page is vulnerable to SQL injection. Post login from the browser I captured the request via burp of that vulnerable page and fed the data to sqlmap. But I'm ...
4
votes
1answer
1k views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
3
votes
1answer
6k views

How can I use sqlmap to get only a certain number of records in SQL Server using a LIMIT and OFFSET?

I'm trying to dump using sqlmap, I have 3 columns: name, lastname, userid with 9000 entries in each. When I just --dump the table, it will start from 1 to 9000. I don't want all the 9000, how can I ...
1
vote
2answers
12k views

MariaDB SQL Injection vulnerability?

I'm testing for SQL Injection on a website. Basically, I'm trying it in the following url: http://example.org/webpage/* where in place of the * the payload should be injected. When I try to put in ...
0
votes
1answer
597 views

This is a Stack Trace or Sql Injection?

Yesterday I posted a question about whether I could do an SQL injection with the following error code: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
8
votes
2answers
21k views

What are the consequences of increasing the "--risk" option of sqlmap?

I use sqlmap to test the services of my company. I tried increasing the value of its --level option, but I do not find clear descriptions of the tests added with an increased --risk value. So, what do ...
2
votes
1answer
2k views

SQLMap Failure, Manual SQL Injection Success

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through ...
2
votes
2answers
3k views

How to make sqlmap exploit an SQLi vulnerability

I have found a simple boolean blind SQL vulnerability and want to let sqlmap do the iterating for me but it doesn't seem to work, I have the impression it tries to start at a point that I'm far beyond....
1
vote
1answer
2k views

How to get Sqlmap to detect insertion point with sleep payload?

I have a server which seems to be vulnerable to SQL injection with the following payload detected by BurpSuite: param=value,(select*from(select(sleep(10)))a) The application takes twice the time ...
4
votes
1answer
6k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
1
vote
1answer
894 views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
2
votes
0answers
1k views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
2
votes
2answers
2k views

Sqlmap: bypass website security filtering SQL reserved words

I'm using sqlmap to get a website's DB and found out that the site is time-based boolean vulnerable; but the target is showing SQL errors, which made me think that it would be an injection error. I ...
6
votes
1answer
22k views

sqlmap load https request using "-r REQUESTFILE Load HTTP request from a file"

I'm testing a site that automatically redirects http request to https. When I'm using Burp I set the target to use https and the request goes through without a problem. However when I use the same ...
1
vote
1answer
827 views

someone trying to SQLi server using sqlmap

Someone is trying to SQLi my domain using sqlmap. I'm getting a lot of errors from mysql. My server access log shows: - - HTTP/1.1" 200 10559 "-" "sqlmap/1.0.4.0#dev (http://sqlmap.org)" ...
3
votes
1answer
13k views

run sqlmap with http post request with encoding data

I have a target that http post request from that encoded As follows: data request post first url encoded and then base64 encoded. example request post from mentioned target As follows: POST /test/...
1
vote
4answers
19k views

sqlmap injection point in POST data

I am currently doing a blackbox test on a web application for training purposes. It's a personal project. In addition to my manual testing process, I used an automated scanner for detecting obvious ...
2
votes
2answers
1k views

Can the server crash while testing with the sqlmap tool?

When I was pentesting a cpanel web app I've got some passwords but while reading the tables the server went offline. I can exclude that my ip wasn't blocked because I tried to access the server ...
1
vote
2answers
1k views

using the CO2-Extension within Burp for sql injection

I am using the free version of Burp Suite and the CO2-Extension for sql injection attacks. Using the extension offers you two possible attacking ways: Either you copy the command which is ...
0
votes
4answers
5k views

Sqlmap dumping all tables without data

Is it possible to see all columns of all tables of a database without the data using sqlmap I don't want to use -D database -T table manually for all the tables
1
vote
0answers
6k views

SQLMAP - POST JSON data as body

Hi I'm trying to do a SQL injection in a login form. With BurpSuite I intercept the request: POST /xxxx/web/Login HTTP/1.1 Host: 10.0.0.70:42020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10....
0
votes
1answer
2k views

Timed out in sqlmap

I detect a sqli vulnerability in a target url using sqlmap. Now when I try this I always get "connection timed out to the target URL": ./sqlmap.py -u targetURL --dbs How can I solve it?
2
votes
0answers
564 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
1
vote
0answers
518 views

How to use SQLMap/Burp to perform SQL injection on a form that is behind another form

I have a form that takes in an IP address and loads that page (Acts as a Web Application Proxy). The page that gets loaded has an SQL injection vulnerability. How can I use SQLMap or BURP to exploit ...
1
vote
1answer
7k views

Using sqlmap to find password hashes

I'm learning SQL-injection (and SQL in the first place) by playing a CTF. I'm using sqlmap and have for my target IP so far found: Uses: MySQL, PHP 2 databases: information_schema users 1 table in ...
1
vote
1answer
13k views

Sqlmap tested parameters might not be injectable

When I try to inject something, after testing all parameters with --level=3 --risk=3, this shows up. Please tell me what to do, and where I'm wrong. This is the full command: sqlmap -u "www....
1
vote
0answers
431 views

sqlmap automatically trims response

When i try to dump a database with --dump-all I first get [WARNING] large response detected. This could take a while then [WARNING] too large response detected. Automatically trimming it How ...
1
vote
0answers
67 views

what is this injection query looks like? [closed]

what might be the mysql query if mysql injected it with '# only for username and password blank logged in as admin how to get mysql info using this injection ?
0
votes
2answers
954 views

Using sqlmap for SQL injection vulnerabilities in Vaadin

I implemented a small website for penetration testing purposes using the Vaadin framework. I have a MySQL database running in the background as well as a Jetty server. The website is vulnerable ...
1
vote
1answer
3k views

Scrambled database name / unable to retrieve the number of databases with SQLMap

I have the results for sqlmap: ./sqlmap.py -u "http://REDACTED/browse?destination_id=12" --identify-waf --random-agent -v 3 --dbs GET parameter 'destination_id' is vulnerable. Do you want to keep ...
0
votes
2answers
285 views

Is there a way to specify PHP escape method when using SQLmap?

I'm helping a collegue of mine to test if his website is completely SQLi-proof. It looks promising, but i'm trying to make sure, and by chance I know he's using pg_escape_string to sanitize his POST ...