Category Archives: sqlmap

I have several databases in each one, several tables, I am trying to extract the first row from each table from several databases using sqlmap.

Continue reading how to dump all first row of table in several database using SQLmap? [duplicate]→

New Sqlmap user, so please be patient 🙂
I’ve started looking at the tool and I’m curious about its use. For instance, the login page of OWASP’s Juice shop is vulnerable to sql injection (‘ OR 1=1– and you’ll be automatically logged in as… Continue reading Using sqlmap for detecting SQLi on Juice shop’s login page→

Part of a box I’m doing, I can successfully pass basic SQL query ‘or’1’=’1 with no errors,
{"search":"’or’1’=’1"}

Output:
HTTP/1.0 200 OK

Trying to error the query
{"search":"’"}

Output: (success… Continue reading How to configure SQLMap to attack JSON parameter?→

I’m solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with –cookie=COOKIE* (Notice * that’s the marker to tell sqlmap about the inject… Continue reading Can sqlmap be used to extract data if the attack is blind?→

I have run sqlmap through burpsuite and to get the existing databases it ran this query
1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717671,JSON_ARRAYAGG(CONCAT_WS(0x6a716a6c6a68,schema_name)),0x7176707a71) FROM INFORMATION_SCHEMA.SCHEMATA– … Continue reading sqlmap: why use concat and JSON_ARRAYAGG→

I’m currently trying to beat the advanced sql injection challenge in OWASPs WebGoat.
I found this solution here.
Everything from that solution worked fine with sqlmap. But when i tried to extract the columns from the Challenge_users table … Continue reading sqlmap doesn’t find "password" column→