Stack Overflow
Stack Overflow

Questions tagged [sqlmap]

sqlmap is an "Automatic SQL injection and database takeover tool". It can be used to detect flaws in any software with an underlying SQL database

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections

128 questions
0
votes
1 answer

Get bytes of encoded non-printable string

When I dump a table entries with sqlmap with --hex key, I get bytes of password hash correctly, but powershell represents these bytes as string. All non-printable characters are escaped and I get these bytes as…
Stanislav Breslavski
  • 1
  • 2
0
votes
1 answer

SQLMap remake in JavaScript? Possible?

I am trying to expand my JavaScript knowledge about web requests and they way it communicates with external applications. I am wondering if it is possible to make use of the xhr object in order to make a basic sqlmap alternative(*SQLmap is a tool…
Theof
  • 83
  • 1
  • 7
0
votes
0 answers

myBatis ORACLE - trying to load a temporary table and then run a select statement against it

The example below was greatly simplified to illustrate the problem I am facing. What I am trying to do is to load an ORACLE temporary table and then run a query against that table using myBatis. Its quite possible I am forgetting some basics of…
DaveB
  • 181
  • 3
  • 11
0
votes
1 answer

the meaning of the instruction

I found this code in sqlmap project https://github.com/sqlmapproject/sqlmap/blob/master/lib/core/datatype.py . I don't understand the meaning of calling the constructor AttribDict.__init__(self) class InjectionDict(AttribDict): def…
user3140467
  • 43
  • 10
0
votes
1 answer

How SQLMAP fetches tables, columns from the database?

I have understood that how SQLMAP checks for vulnerabilities but now i'm fascinated about how after getting the vulnerability SQLMAP fetches the databases, tables, columns. I tried to understand by looking on their github repo but still.
user3099030
  • 5
  • 3
0
votes
1 answer

sqlmap emulate Login Sequence for Webapplication

I hope this is the right place for my question Is it possible to submit a login sequence with sqlmap for a web application that not provides a real session cookie. In Webbrowser their is only a PHPSESSION ID and if i copy this to the --cookie…
Der Admin81
  • 425
  • 3
  • 9
  • 19
0
votes
1 answer

SQL injection on clean url

I would like to test my website for SQL injection using sqlmap. I'm using mod_rewrite and my URL looks like this: http://www.example.com/forum/&nav_page=1 (where nav_page is the parameter name and 1 is value) The problem I'm having is that I can't…
user3090543
  • 9
  • 1
  • 3
0
votes
1 answer

dyanamically change the database name in SqlMapConfig.xml file

I want to change the database name in SqlMapConfig.xml file from the application, does any one help me?
premashree
  • 11
  • 1
  • 4
0
votes
1 answer

sqlmap not retrieving information when using TOR

I'm doing a simple test using sqlmap and TOR, and while the command without using TOR retrieves all the names of the tables, when I add the options --tor --tor-port=9151 it returns empy names or cannot return any tables. I'm using Python 2.7,…
JTatie
  • 93
  • 2
  • 5
0
votes
1 answer

set a map to a parameterclass in iBatis

what's the difference between setting a map and setting an object to a parameterClass in iBatis? means, UPDATE city SET province_id = #province_id# WHERE id = #id# and
user2660234
  • 67
  • 2
  • 8
0
votes
1 answer

Sqlmap inline parameters

Hi ive just hear about an error in cakephp that allows sql inyection; https://twitter.com/cakephp/status/328610604778651649 I was trying to test my site using sqlmap, but i cant find how to specify the params. The url i am testing…
Tim
  • 585
  • 1
  • 5
  • 14
0
votes
1 answer

Comparing Date in Java String form with JDBC DATE type

I need to define a SQL xml in ibatis where a date is being compared. The date which is compared is a DATE jdbc object and the date received from java object is a string. How should I convert string to date or how should I compare the two ? Thanks
user1484793
  • 359
  • 3
  • 16
0
votes
1 answer

Block sqlmap injection request via Iptalbes/firewall

I was checking the security on my server RHEL-5. I was running sqlmap and its gone through smoothly via iptables firewall. I want to block the sqlmap injection via firewall. So If anybody will try the same it sud be block in firewall.
niraj vara
  • 25
  • 6
-1
votes
1 answer

Is this javascript vulnerable to SQL Injection?

I am using node-postgres library. const sql = ` SELECT * FROM "Employees" where employee_id = '${employee_id}' ; `; console.log(`Query formatted: ${sql}`); const result = await this.db.run(sql) // DB Run method looks like this async…
Ace McCloud
  • 798
  • 9
  • 27
-1
votes
1 answer

sql inject in sqlmap what can i do for this

I have a problem with this piece of code ate and had a few with me please help, what can i do for this problem enter image description here
zill
  • 1
1 2 3
…
8
9