Hot answers tagged

20 votes
Accepted

How to include multiple parameters in sqlmap POST request

You can just comma-separate the parameters you want to test. In a GET request: $ sqlmap -u "http://example.com/?a=1&b=2&c=3" -p "a,b" In a POST request: $ sqlmap -u "http://example.com/" --...
user avatar
  • 43.8k
8 votes
Accepted

sqlmap load https request using "-r REQUESTFILE Load HTTP request from a file"

Found two possible solutions from https://github.com/sqlmapproject/sqlmap/wiki/Usage. --force-ssl: C:\Users\Oscar\Desktop\sqlmap-master>python sqlmap.py -r testsite.txt --level=5 risk=3 --force-...
user avatar
  • 677
8 votes
Accepted

What are the consequences of increasing the "--risk" option of sqlmap?

--level By default sqlmap will test all GET and POST parameters specified, however in some cases you might want to test additional entry points such as HTTP headers. It is possible to specify it with ...
user avatar
6 votes
Accepted

run sqlmap with http post request with encoding data

Sqlmap supports multiple ways to process parameters with custom code. You can use --eval to base64-encode a single parameter, like so: --eval "import base64; paramname = base64.b64encode(paramname)" ...
user avatar
  • 43.8k
6 votes
Accepted

Using sqlmap --crawl without asking questions

Try this out: --answers="follow=Y" --batch From SQLmap wiki: Act in non-interactive mode Switch: --batch If you want sqlmap to run as a batch tool, without any user's interaction when ...
user avatar
6 votes
Accepted

Possible to use sqlmap when URL changes after each request?

Tools are seldom written generic enough to handle obscure test-cases. It might be tempting to blame the tool for its shortcomings, but more often the problem is obscure/non-generic, and should be ...
user avatar
6 votes
Accepted

How limit request rate of sqlmap?

From the SQLMap man pages: --delay=DELAY Delay in seconds between each HTTP request
user avatar
  • 2,329
6 votes
Accepted

Understanding SQLMAP payload

I assume that it is a MySQL database. 1749 (is greater that 0) and nQtm (valid alias - "variable name" for derived table) were chosen randomly by sqlmap. The problem with sleep(N) is that ...
user avatar
5 votes
Accepted

Is sqlmap scan detectable?

SQLMap works by sending a lot of different requests to the server. It is pretty easy to see the scan if you look at your server logs manually. If you want to do it programatically, just look for SQL ...
user avatar
  • 123k
5 votes

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

Using SQLMap will be helpuf, since it scan for most well-known vulnerabilities and will save you some time and efford. But, the greatest threat is a hackers' imagination and ability to exploit ...
user avatar
4 votes
Accepted

SQLMAP unable to upload the stager file with 404 error

Run the SQLMap with higher verbose level, like -v3 or -v6. -v3 will show the requests SQLMap makes and you should be able to determine (or update your question) with more specific info on what ...
user avatar
  • 226
4 votes

Using update with SQLMAP error

Now, this is... ekhm... not the best place to ask SQL syntax questions. The UPDATE operation does not have a FROM keyword in SQL. In other words a SELECT operation looks as follows: SELECT username ...
user avatar
  • 5,667
4 votes

SQLMap Cookie Injectioin with Working Manual SQLi

First of MariaDB is supported through MySQL engine in SQLmap so the parameter you have there --dbms "MariaDB" is wrong. There are different reasons that each of your three commands are not ...
user avatar
  • 141
3 votes

How do I exploit with vunerability in special format with sqlmap?

This URL is https://example.com/login" AND "1"="1. You can not use like that for this parameter. SqlMap has an option that you can use * char: URI injection point There are ...
user avatar
3 votes
Accepted

SQLmap POST parameter 'txtLoginID' is not injectable

To be sure of your syntax, you can intercept a regular request of your post by burp for example. You save it in a file and you can inform sqlmap to use this request for testing an injection. For that ...
user avatar
  • 595
3 votes

Presence of table "sqlmapoutput" in PostgreSQL database

This is the result of someone running sqlmap on the database. (Specifically here) Either this is An honest pentester: In this case, delete the table and fix whatever vulnerability they discovered. ...
user avatar
  • 2,333
3 votes
Accepted

Can SQL test by using SqlMap tool harm a website?

You could corrupt or destroy all the data on the system. Never try this on a live system. Clone one or build one in order to test.
user avatar
  • 61.4k
3 votes
Accepted

sqlmap HTTP 405 error on a vulnerable POST parameter

My preferred method of using SQLmap is to submit a request using a browser which is proxied through Burp, copy the request from Burp into a text file, then call sqlmap with the -r parameter pointing ...
user avatar
  • 27.2k
3 votes

SQLMap: How to dump tables that begin with a specific letter?

$ python sqlmap.py -u "http://192.168.136.131/sqlmap/firebird/get_int.php?id=1"\ --dump -T users [...] Database: Firebird_masterdb Table: USERS [4 entries] +----+--------+------------+ | ID | NAME |...
user avatar
3 votes

Oracle Sql Injection Reverse Shell

You can try this two ways of executing code on Oracle DBMS. The first is with Java code: http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql -- Usage example: -- $ sqlplus "/ as sysdba" -- [...] ...
user avatar
3 votes
Accepted

How sqlmap works to get all database info

There seems to be something wrong with the request you posted. Since the vulnerable parameter is the "cat" parameter the "&" in your request separates the payload from the vulnerable parameter ...
user avatar
  • 3,633
3 votes

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind)

Boolean based sql injection is useful when the server doesnt return any information to you which is often the case. If you can determine that the response is different based on whether the sql ...
user avatar
  • 582
3 votes

How to make sqlmap exploit an SQLi vulnerability

Since you mentioned that you found a boolean based blind SQli, you will require a sqlmap input such as the one below: #sqlmap -u "http://host/path?param=123" --technique=B --level=5 --risk=3 --random-...
user avatar
3 votes

MariaDB SQL Injection vulnerability?

I could be wrong, but I'm fairly certain that your main problem is that you are attempting to do mysql injection wrong. As a general rule of thumb, if a payload can trigger an SQL syntax error then ...
user avatar
3 votes
Accepted

How to make Sqlmap obtain administrator rights for database?

1) If you are inserting into a SELECT/UPDATE/DELETE query you can only issue INSERT statements if stacked queries are available (you have to close the original query and start a new SQL statement). ...
user avatar
  • 1,730
3 votes
Accepted

Can sqlmap be used on telnet?

SQLmap has no native support for Telnet, and it's not clear that it would handle typical telnet (or similar protocol) responses in a useful way: it makes use of (among other things) the status code ...
user avatar
  • 27.2k
3 votes
Accepted

SQL injection with an auto-incrementing parameter

You can use the --eval parameter of SQLMap, in theory: -data='{"id": 1}' --eval "f = open('cnt.txt','r+'); id = int(f.readline()); f.seek(0,0); f.write(str(id+1)); f.close()" See http://aetherlab....
user avatar
  • 27.2k
3 votes

Is there any way to find all the endpoints for any website for sql injection?

There are quite a few tools out there that can help find vulnerabilities, such as SQL injection points - none of these will find all of them. Blackbox testing - This is described by Vipul in his ...
user avatar
  • 436
2 votes
Accepted

sqlmap cannot find a dispatched vulnerability

This appears to be some type of what is known as Second Order SQL Injection. Even if Thread 1 writes to a queue instead of to a DB, as the injection does not happen as a direct result of it, sqlmap ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible