Collaborate Disseminate
I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/
but I do not know how to use sqlmap with this type of sql injection.
I use the classic:
sqlmap -u site.com/ –tor –ch… Continue reading SQLmap error (what happen if i have no parameters)
I have a “password change” form that could be injectable. However, I can’t find a way to use SQLmap in this case.
Here is the legitimate POST request:
POST http://localhost/api/passwordchange
…
Cookie: …
Connection: … Continue reading Inject the same JSON payload twice – SQLmap
I’m starting with the use of sqlmap and I have the OWASP broken WebApp on VMWare.
I was trying to perform the –os-shell command to get access to OWASP VMware with this:
# sqlmap -r user.request -D mysql -T user –os-shell… Continue reading Problems with SQLmap on os-shell [on hold]
I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can’t really inject parameters into the URL like I would see everywhere else.
Here’s what I tried:
At the login p… Continue reading SQL Injection with an uninjectable URL
a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer?
In my case, I already have the confirmation of this parameter being vulnerable by s… Continue reading SQL injection possible with parameter that seems to only accept integers
I used manual payloads to check “SQL Injection”, but I can’t check, I using “Sqlmap” take a long time to check without result when I used “Burp Suite” to check with “list” Payloads, Give this result:
Request
GET
/app/search… Continue reading I need help to check "SQL Injection" worked or not?
I’m trying to catch SQL Injection attacks from DVWA with sqlmap, I’m using the most simple option it provides, but it’s strange that sometimes it works and other it doesn’t, showing a message similar to:
…parameter ‘X’ doe… Continue reading DVWA cant be injected with SQLMAP [id is not injectionable]
I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?1-2.FormSubmit, and so fo… Continue reading Possible to use sqlmap when URL changes after each request?
When scanning a website with Nessus I got a “time based blind SQL injection vulnerability”. I tried to rerun that vulnerability and putted a command of “wait for delay 00:00:21” and it worked! Although this vulnerability is i… Continue reading How to exploit post SQL vulnerability in "contenttxtd" parameter?
I’m using sqlmap to exploit databases in a DVWA-project.
However, after having exploited the database, I executed the following command to learn that the user is dvwa@%:
sqlmap -u “http://192.168.71.130/dvwa/vulnerabilitie… Continue reading How to make Sqlmap obtain administrator rights for database?