5

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?1-2.FormSubmit, and so forth.

Is it possible to use sqlmap on this login, eventhough the URL changes after each request?

Anders
  • 64,406
  • 24
  • 178
  • 215
user7981924
  • 53
  • 3
  • Not sure exactly but is this what you are looking for? https://www.packtpub.com/mapt/book/networking_and_servers/9781785284588/5/ch05lvl1sec47/sqlmap-and-url-rewriting – toom Apr 18 '18 at 08:15
  • Hm don't think so, because this is used to insert the * to point where sqlmap should inject to (as far as I can see, since I can only view a limited part of the page). But I dont want to sqlinject into the `/login?0-1.FormSubmit` url, since I want to inject into the provided post parameters. I need a way to increase the two integers in the URL for each request sqlmap does. Understandable? – user7981924 Apr 18 '18 at 14:05

1 Answers1

6

Tools are seldom written generic enough to handle obscure test-cases. It might be tempting to blame the tool for its shortcomings, but more often the problem is obscure/non-generic, and should be solved by other means.

You can solve this problem by creating a small webapp that acts as a proxy between the target application and your tool.

The tool accept the vulnerable input as a parameter, and forward it to the application as required.

Here is an untested python/flask code to illustrate how this can be done:

from flask import Flask, request
import requests

i = 0

app = Flask(__name__)
@app.route("/")
def app_proxy():
        sqli = request.args.get("sqli",None)
        data = {"somekey":"someval","vulnerableparam":sqli}
        resp = requests.post("http://target.com/login?%s-%s.FormSubmit"%(i,i+1),data=data)
        i += 1
        return resp.text, resp.status_code

app.run(host="127.0.0.1",port=8008)

After you have started the flask-app, you should be able to use sqlmap against http://127.0.0.1:8008/?sqli=value

Dog eat cat world
  • 5,759
  • 1
  • 27
  • 46