Sqlmap doesn't exploit verified SQL injection

Question

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually.

The vulnerability is in the cookie header 'userid' parameter. The application implements some SQLi filter to block spaces and some SQL keywords so you have to convolute a bit the payload.

I can successfuly exploit the vulnerability injecting the following payload in the mentioned 'userid' parameter with an HTTP proxy:

71934/**/unUNIONion/**/seSELECTlect/**/*/**/from/**/users

Then I tried to replicate the injection with sqlmap to no success with the following command:

sqlmap -u "http://cloaknet:8080/proxypanel.jsp" --cookie="JSESSIONID=CA97BAFA78E01D237B86278E9DFE12C3; userid=71934" -p "userid" --level 5 --tamper "nonrecursivereplacement.py,space2comment.py" --sql-query="71934 UNION SELECT * from users"

I expected sqlmap to inject only the given query and return a successful exploit, but sqlmap tries a lot of queries and at the end returns the 'userid' parameter not being vulnerable.

What am I doing wrong?

You can capture the request generated by sqlmap in Burp and examine it. — void_in, Nov 27 '16 at 09:41
Yes, put your post or parameters into a file and use sqlmap -r to launch it instead of -u. Did you tried this? — OscarAkaElvis, Dec 27 '16 at 11:24

score 1 · Answer 1 · edited Mar 17 '17 at 13:14

1

I actually ran into a similar issue. I though my syntax was correct and I still don't know where I went wrong but I was able to use the -r flag and feed sqlmap a captured HTTP header as a parameter. Once I did this sqlmap identified the field as vulnerable (which I already knew it was) and acted as I initially thought it would.

SQLmap POST parameter 'txtLoginID' is not injectable

Hope this helps!

edited Mar 17 '17 at 13:14

Community

1

answered Mar 02 '16 at 03:10

Grady Negronida

53
1
1
7

I'm afraid that trick isn't working here. But thanks for the advice. – Hidden Mar 08 '16 at 08:50
Did you also try raising the risk and level? – Grady Negronida Mar 08 '16 at 16:44

score 1 · Answer 2 · answered Feb 22 '17 at 00:31

It needs to work this way

sqlmap -u "http://cloaknet:8080/proxypanel.jsp" --cookie="JSESSIONID=CA97BAFA78E01D237B86278E9DFE12C3; userid=71934" --level 5 --risk 3 -p "userid" --tamper=nonrecursivereplacement,space2comment --sql-query="71934 UNION SELECT * from users"

Sqlmap doesn't exploit verified SQL injection

2 Answers2