10
You can just comma-separate the parameters you want to test.
In a GET request:
$ sqlmap -u "http://example.com/?a=1&b=2&c=3" -p "a,b"
In a POST request:
$ sqlmap -u "http://example.com/" --data "a=1&b=2&c=3" -p "a,b" --method POST
...
[13:37:54] [WARNING] heuristic (basic) test shows that POST parameter 'a' might not be injectable
...
[13:...
6
I assume that it is a MySQL database.
1749 (is greater that 0) and nQtm (valid alias - "variable name" for derived table) were chosen randomly by sqlmap. The problem with sleep(N) is that SQL database evaluates it to 0 and hence post=1 AND 0 will be evaluated to zero (FALSE : 1 AND 0 = 0) too. Value 1749 gets interpreted by SQL database as TRUE (similar ...
5
Using SQLMap will be helpuf, since it scan for most well-known vulnerabilities and will save you some time and efford. But, the greatest threat is a hackers' imagination and ability to exploit something more complex and unusual than SQLMap can find. For me, the best way to check for sql injection vulnerabilities - and even more types of vulnerabilities - is ...
5
From the SQLMap man pages:
--delay=DELAY Delay in seconds between each HTTP request
4
Run the SQLMap with higher verbose level, like -v3 or -v6.
-v3 will show the requests SQLMap makes and you should be able to determine (or update your question) with more specific info on what generates the HTTP 404 response.
-v6 will (obviously) be even more chatty if -v3 won't show enough.
Based on that we can move on.
4
SQLMap works by sending a lot of different requests to the server. It is pretty easy to see the scan if you look at your server logs manually.
If you want to do it programatically, just look for SQL verbs in your logs in the input fields where they don't make sense (select, from, where, order by).
4
Now, this is... ekhm... not the best place to ask SQL syntax questions.
The UPDATE operation does not have a FROM keyword in SQL. In other words a SELECT operation looks as follows:
SELECT username FROM user_table WHERE user_id = 1;
But the UPDATE operation is:
UPDATE user_table SET username = 'myuser' WHERE user_id = 1;
(which turns to be quite ...
4
Sqlmap supports multiple ways to process parameters with custom code. You can use --eval to base64-encode a single parameter, like so:
--eval "import base64; paramname = base64.b64encode(paramname)"
Also, you can use the --tamper parameter to load a custom python script that modifies the payload.
Unfortunately it's not straightforward to tamper with the ...
4
Level
By default sqlmap will test all GET and POST parameters specified, however in some cases you might want to test additional entry points such as HTTP headers. It is possible to specify it with specific options, but the most straight forward technique is to use the --level option. There is 5 levels available in sqlmap (default being level 1). Level 2 ...
4
Try this out:
--answers="follow=Y" --batch
From SQLmap wiki:
Act in non-interactive mode Switch: --batch
If you want sqlmap to run as a batch tool, without any user's
interaction when sqlmap requires it, you can force that by using
switch --batch. This will leave sqlmap to go with a default behaviour
whenever user's input would be required.
...
4
Tools are seldom written generic enough to handle obscure test-cases. It might be tempting to blame the tool for its shortcomings, but more often the problem is obscure/non-generic, and should be solved by other means.
You can solve this problem by creating a small webapp that acts as a proxy between the target application and your tool.
The tool accept ...
3
To be sure of your syntax, you can intercept a regular request of your post by burp for example. You save it in a file and you can inform sqlmap to use this request for testing an injection.
For that the option in sqlmap is -r.
Target:
At least one of these options has to be provided to set the target(s)
-d DIRECT Direct connection to the ...
3
This URL is https://example.com/login" AND "1"="1. You can not use like that for this parameter.
SqlMap has an option that you can use * char:
URI injection point
There are special cases when injection point is within the URI itself. sqlmap does not perform any automatic test against URI paths, unless manually pointed to. You have to specify these ...
3
This is the result of someone running sqlmap on the database. (Specifically here) Either this is
An honest pentester:
In this case, delete the table and fix whatever vulnerability they discovered.
Some other actor:
Consider all data comprimised. Search for whatever hole caused this and fix it, and if you have users force them all to reset their passwords....
3
You could corrupt or destroy all the data on the system.
Never try this on a live system. Clone one or build one in order to test.
3
My preferred method of using SQLmap is to submit a request using a browser which is proxied through Burp, copy the request from Burp into a text file, then call sqlmap with the -r parameter pointing to the text file.
This ensures that the submission is going to the correct location, with the required headers and cookies.
In this case, I suspect that you ...
3
You can try this two ways of executing code on Oracle DBMS.
The first is with Java code: http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql
-- Usage example:
-- $ sqlplus "/ as sysdba"
-- [...]
-- SQL> @raptor_oraexec.sql
-- [...]
-- SQL> exec javawritefile('/tmp/mytest', '/bin/ls -l > /tmp/aaa');
-- SQL> exec javawritefile('/tmp/mytest', '...
3
There seems to be something wrong with the request you posted.
Since the vulnerable parameter is the "cat" parameter the "&" in your request separates the payload from the vulnerable parameter thus resulting in no information being revealed.
Let us do it right:
A request for:
http://testphp.vulnweb.com/listproducts.php?cat=1%20AND%201=1%20UNION%20ALL%...
3
Found two possible solutions from https://github.com/sqlmapproject/sqlmap/wiki/Usage.
--force-ssl:
C:\Users\Oscar\Desktop\sqlmap-master>python sqlmap.py -r testsite.txt --level=5 risk=3 --force-ssl -p id
Host:
GET /user?id=1 HTTP/1.1
Host: www.testsite.com:443
3
Boolean based sql injection is useful when the server doesnt return any information to you which is often the case. If you can determine that the response is different based on whether the sql statement returns true or false, there are ways to get the information your after even if the server doesnt return it to you.
For example, if a password field is ...
3
Since you mentioned that you found a boolean based blind SQli, you will require a sqlmap input such as the one below:
#sqlmap -u "http://host/path?param=123" --technique=B --level=5 --risk=3 --random-agent --dbms=MSSQL
--technique switch will force only Blind SQLi Attacks
--random-agent will ensure you use a legit user agent, most of the vulnerabilties ...
3
I could be wrong, but I'm fairly certain that your main problem is that you are attempting to do mysql injection wrong. As a general rule of thumb, if a payload can trigger an SQL syntax error then your attempts at preventing SQL Injection are not really working. For instance, if you were using prepared queries, there is no way for the payload to result in ...
3
1) If you are inserting into a SELECT/UPDATE/DELETE query you can only issue INSERT statements if stacked queries are available (you have to close the original query and start a new SQL statement). This is a limitation of the SQL language.
2) Privilege escalation would require a vulnerability in the database server or one of the stored procedures. Check ...
3
SQLmap has no native support for Telnet, and it's not clear that it would handle typical telnet (or similar protocol) responses in a useful way: it makes use of (among other things) the status code for responses, path components of the URL and encoding of HTTP parameters in request bodies. None of these would apply to a telnet connection.
You can use SQLmap ...
3
You can use the --eval parameter of SQLMap, in theory:
-data='{"id": 1}' --eval "f = open('cnt.txt','r+'); id = int(f.readline()); f.seek(0,0); f.write(str(id+1)); f.close()"
See http://aetherlab.net/2014/07/advanced-sqlmap-features-eval/ for the full details - basically, SQLMap can modify JSON data, and run Python code. The Python code reads a file called ...
3
There are quite a few tools out there that can help find vulnerabilities, such as SQL injection points - none of these will find all of them.
Blackbox testing - This is described by Vipul in his answer and involves testing / fuzzing the interfaces exposed in the application (UIs, Services...). These are closer to how an attacker might look at the system, ...
2
This appears to be some type of what is known as Second Order SQL Injection.
Even if Thread 1 writes to a queue instead of to a DB, as the injection does not happen as a direct result of it, sqlmap cannot be used to exploit the vulnerability.
Sqlmap looks for error messages in responses or differences in timing (for blind SQL injection) to determine ...
2
Either you haven't gone through the SQLmap docs yet or you haven't read the clarity for question which you need to post in the stackexchange docs. Either way, I am going to drop you of the basics since:
The fakesite you are referring to, doesn't matter if it's fake as long as there is a Input Validation vulnerability.
The fakesite 'ref' is called as a ...
2
This is simply not possible. The reason for that is that the MySQL module of PHP does not allow one to append complete queries. So this won't work:
http://victim.com/index.php?id=1'; UPDATE anytable SET anyattribute='anyvalue' --
You also can't use UNION to append a UPDATE, DELETE or INSERT Query because it only allows one to join SELECT statements.
You ...
Only top voted, non community-wiki answers of a minimum length are eligible
