Skip to content

Suggest web server document root in combination with --file-read #3928

Description

@Techbrunch

Is your feature request related to a problem? Please describe.

When it has been identified that the FILE privilege is available you often want to start reading files of the web application but you don't always know the web server document root.

If you don't know it you will need to bruteforce it which requires running sqlmap for each potential root path.

python sqlmap.py -r req -p id --technique U --file-read=/var/www/index.php
python sqlmap.py -r req -p id --technique U --file-read=/var/www/html/index.php
python sqlmap.py -r req -p id --technique U --file-read=/var/www/htdocs/index.php
...

Describe the solution you'd like

It would be nice to have an option for some kind of path prefix when trying to read file similar to when trying to run --os-shell.

do you want sqlmap to further try to provoke the full path disclosure? [Y/n]
[16:57:59] [WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('/var/www/, /var/www/html, /var/www/htdocs, /usr/local/apache2/htdocs, /usr/local/www/data, /var/apache2/htdocs, /var/www/nginx-default, /srv/www/htdocs') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search

Another solution would be to have an option to find the web root. You could pass it the path of a known file of the web application. sqlmap would then try to read the file by bruteforcing the web server root.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions