Skip to content

Specify column value for union based injection #5508

@KartikSoneji

Description

@KartikSoneji

Is your feature request related to a problem? Please describe.
I have an sql injection of the form https://example.com/q=' union select null, 'ab-cd', null, null --
The backend does some additional processing to the query results,
so the value in the second column must be of the form \w{2}-\w{2}, otherwise the query fails.

Now sqlmap was able to detect that the query had a union based injection with 4 columns,
but was understandably unable to exploit it with null, integer or random character values.

I would like to be able to specify setting the 2nd column to always be a static value.
There is a similar unanswered question about this:
https://security.stackexchange.com/questions/268994/sqlmap-union-query-based-injection-fix-certain-column-values

Describe the solution you'd like
A way to specify static values for specific columns in union injection.
Eg: --union-values="[2]='ab-cd',[3]=*"
or: --union-values="[, 'ab-cd', *,]"

Describe alternatives you've considered
This can be done with regex and a combination of --eval, custom tamperscripts, --prefix and --suffix but that is both tedious to write and very prone to breaking.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions