-
-
Notifications
You must be signed in to change notification settings - Fork 6.2k
Description
Is your feature request related to a problem? Please describe.
I have an sql injection of the form https://example.com/q=' union select null, 'ab-cd', null, null --
The backend does some additional processing to the query results,
so the value in the second column must be of the form \w{2}-\w{2}, otherwise the query fails.
Now sqlmap was able to detect that the query had a union based injection with 4 columns,
but was understandably unable to exploit it with null, integer or random character values.
I would like to be able to specify setting the 2nd column to always be a static value.
There is a similar unanswered question about this:
https://security.stackexchange.com/questions/268994/sqlmap-union-query-based-injection-fix-certain-column-values
Describe the solution you'd like
A way to specify static values for specific columns in union injection.
Eg: --union-values="[2]='ab-cd',[3]=*"
or: --union-values="[, 'ab-cd', *,]"
Describe alternatives you've considered
This can be done with regex and a combination of --eval, custom tamperscripts, --prefix and --suffix but that is both tedious to write and very prone to breaking.