1

I used ZAP proxy to determine that login was injectable with GET request as login" AND "1"="1 was injectable, but it returned the url to me in this format:

https://example.com/login%22%20AND%20%221%22=%221

I have checked, and it is injectable at that point, but I don't know what parameters to use to exploit it. My current setup, with redirects disabled (not shown), is not working. Here is the setup:

sqlmap -u "https://example.com/login%22%20AND%20%221%22=%221" --level=5 --risk=3 --fingerprint --common-tables --dbs --all --common-columns --technique=BEUSTQ --keep-alive --dependencies --hex --timeout=120 --time-sec=10

For some reason, even with between disabled, sqlmap is changing login" AND "1"="1 to #1*

Sanic Rider
  • 95
  • 1
  • 2
  • 6

1 Answers1

3

This URL is https://example.com/login" AND "1"="1. You can not use like that for this parameter.

SqlMap has an option that you can use * char:

URI injection point

There are special cases when injection point is within the URI itself. sqlmap does not perform any automatic test against URI paths, unless manually pointed to. You have to specify these injection points in the command line by appending an asterisk (*) after each URI point that you want sqlmap to test for and exploit a SQL injection.

This is particularly useful when, for instance, Apache web server's mod_rewrite module is in use or other similar technologies.

An example of valid command line would be:

$ python sqlmap.py "http://targeturl/param1/varlue1*/param2/value2"
Community
  • 1
s3yfullah
  • 41
  • 3
  • Tried appending an astrix, not working: `sqlmap -u "https://example.com/login%22%20AND%20%221%22=%221*" --level=5 --risk=3 --fingerprint --common-tables --dbs --all --common-columns --technique=BEUSTQ --keep-alive --dependencies --hex --timeout=120 --time-sec=10` – Sanic Rider Jan 19 '16 at 23:18
  • Please remove urlencoded data (%22%20AND%20%221%22=%221). "https://example.com/login*" – s3yfullah Jan 19 '16 at 23:21
  • But, I think, this url doesn't have any vulnerabilities. – s3yfullah Jan 19 '16 at 23:43
  • 1
    Please do not use images to quote text - instead copy paste the text and provide a link as reference. Thank you! – Anders May 19 '16 at 09:16