Collaborate Disseminate
This is the first time I’m using sqlmap against SQLite.
When I run:
sqlmap -u www.site.com:80/index.php?vulnParametr=p –dump-all –keep-alive –dbms=sqlite
It gives me this:
What is that? Is SQLite using some sort of e… Continue reading Weird table names in SQLite database
Right now I’m tinkering with the Hackxor VM (a pentesting training enviroment) and I’m trying to use sqlmap to exploit a vulnerability which I can exploit manually.
The vulnerability is in the cookie header ‘userid’ paramet… Continue reading Sqlmap doesn’t exploit verified SQL injection
Right now I’m tinkering with the Hackxor VM (a pentesting training enviroment) and I’m trying to use sqlmap to exploit a vulnerability which I can exploit manually.
The vulnerability is in the cookie header ‘userid’ paramet… Continue reading Sqlmap doesn’t exploit verified SQL injection
For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the name of a user and a submit button, the … Continue reading sqlmap HTTP 405 error on a vulnerable POST parameter
I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter “T”:
sqlmap.py -u www.website -D database -T tables (…)
Continue reading SQLMap: How to dump tables that begin with a specific letter?
I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie), b) a user SSL certific… Continue reading SQLmap injection not working, manually it works fine
I have tried SQL injection with sqlmap using the command below:
sqlmap -u http://localhost/abc.php?id=1 -D datab –sql-shell
Following query works in the SQL shell well:
SELECT * FROM admin
But when I try to drop the table or try to inse… Continue reading Insert query in sqlmap causes error
I am working on a black box web application pentesting project for a client and while testing found an error-based SQL injection. I went on to exploit it using SQLMAP, I retrieved the Database names, Tables names, and Column names but when… Continue reading SQLMAP : Unable to dump any data
I was poking around with the “reset password” page of a website (security testing and bug hunting is allowed on it.)
When you put in your email address, it uses HTML character reference encoding to encode your address. For e… Continue reading Is it possible to bypass HTML character reference encoding to inject SQL in this context?