Sqlmap questions

[OneHappyTaco]

I am starting to back into web application hacking. I was wondering if you could answer some quick questions.

Do you need to search through each page of an entire website to find a sql injection exploit? Or do you just try injectin the first page?


Any extensions of the URL that could help me locate vulnerable websites?

Thanks.

[Apetrick]

Well with sqli all you need to do is find one injection point for sqlmap to use, try finding a file with a .php extension and a parameter like .php?X=<something> next you will need to see if you can cause an error in that by sending a wrong input like .php?X=1' which usually will cause an error that is displayed on the page that is visible. If that works then you can put that entire link into sqlmap but not with false statement but with the actuall page that doesnt cause an error because sqlmap will add everything it needs in the --wizard. I personally prefer doing the injection manually in the browser instead of using sqlmap unless i dont have time, its a pretty basic concept and all you need to know is how to cause an error and how to craft sql statements.

[OneHappyTaco]

I figured it out eventually. But one more thing , whenever I run --os-shell after a few seconds of finding info it tells me to find the path to the web server document root, any idea what that is?

[Apetrick]

well when you first load the website does it direct to a /index.php i think thats what its talking about but im not sure.

[OneHappyTaco]

the end of the url becomes: /product.php?id=1

[Apetrick]

When you first go to the site or when you go to the product page?

[OneHappyTaco]

no there is no extension. It tells me "please list the web server document root, i.e. /var/www

[Apetrick]

i would just use the sqlmap wizard

Code: [Select]

./sqlmap.py --wizardall you do is enter through a few prompts and itll automate it

[OneHappyTaco]

Thats not for the --os-shell though. Do you know a way to find the websites document root? Should I wget it?

[Apetrick]

I have no idea why you need the --os-shell flag and no clue on what it means by the document root. ive never had a problem with it finding injections with just the wizard.