Testing clean urls with sqlmap

Question

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean?

I know how to test my sites that have urls like: http://mysite.com/?id=1

But what about my sites that have clean urls, like: http://mysite.com/1

Answer 1

You should use * in your URI, creating URI injection point(s). So instead of using:

sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2"

use:

sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*"

See sqlmap wiki for more usage options. From that page:

URI injection point

There are special cases when injection point is within the URI itself. sqlmap does not perform any automatic test against URI paths, unless manually pointed to. You have to specify these injection points in the command line by appending an asterisk (*) after each URI point that you want sqlmap to test for and exploit a SQL injection.

This is particularly useful when, for instance, Apache web server's mod_rewrite module is in use or other similar technologies.

An example of valid command line would be:

$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"

Answer 2

If I understand your question, I believe sqlmap is not designed to deal with this situation (where the web server does not follow web standards for how to represent request parameters). So, I can think of a few options:

1. Turn off URL rewriting. Temporarily turn off request parameter rewriting on your web server (if there's an easy way to do that), to let you run sqlmap.

2. Try POST requests. You showed us that your web server encodes request parameters for GET requests in a non-standard fashion. How does it encode request parameters for POST requests? If it conveys web server encodes request parameters in a more standard fashion, and if every request is accessible via both GET and POST (a misconfiguration, but a common one), you may be test your server by sending POST requests instead of GET requests. See the --data option to sqlmap.

3. Use some other tool. Look for some other tool, since sqlmap doesn't seem designed for this particular case.

4. Modify sqlmap. sqlmap is open source. You could dive into the source code and extend it to support the use case you have in mind. (You might want to look at the code that handles the -p option to sqlmap.) Heck, it is free; you have to expect that if you have an unusual situation, it might not already handle it, and you might have to do a little bit of work on your own. If you follow this route, give back to the community by donating your code to the sqlmap maintainers.

Answer 3

You run into this often due to search engine optimization (SEO).

For example, instead of the following:

http://www.com/index.phpoption=com_blahbla&Item=2&ItemId=5

You see:

http://www.website.com/index,51,blabla

or

http://website.com/guestbook/page2

In this type of scenario, one must examine the applicable source code.

A determination must be made about:

1. Which component is currently active;
2. Which parameter is applicable; and
3. What their current values are.

On a Joomla based website the following code would be assessed:

<input type="hidden" name="option" value="com_blabla" />
<input type "hidden" name="ItemId" Value="5" />
<input type="hidden" name="Item" Value="2" /> 
<input type="hidden" Name="entry" Value="451" />
<input type="hidden" Name="view" Value="entries" />

Once this determination is made, the URL can be reconstructed to its original form and, if vulnerable, successfully exploited.

http://www.website.com/index.phpoption=com_blabla&Itemid=5&ItemId=2&Entry=451&View=Entries

Answer 4

There's no need to reconstruct the URL. SQLMAP accepts the following variations:

www.target1.com/vuln1.php?q=foobar www.target2.com/vuln2.asp?id=1 www.target3.com/vuln3/id/1*

Source: https://github.com/sqlmapproject/sqlmap/wiki/Usage