Hi
I still have problems with sqlmap, I have a VM with dvwa application with security parameter=low
From BB I writed this command
sqlmap -u '
http://192.168.56.102/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit' --cookie='Cookie=security=low; PHPSESSID=g123shj27qt27pf5prctrk0t32' --dbs
and receved this output
[*] starting at 15:28:31
[15:28:31] [INFO] testing connection to the target url
[15:28:31] [INFO] heuristics detected web page charset 'None'
sqlmap got a 302 redirect to 'http://192.168.56.102:80/dvwa/login.php'. Do you want to follow? [Y/n] y
[15:42:25] [INFO] testing if the url is stable, wait a few seconds
you provided a HTTP Cookie header value. The target url provided its own cookies within the HTTP Set-Cookie header which intersect with yours. Do you want to merge them in futher requests? [Y/n] y
[15:42:28] [WARNING] GET parameter 'id' does not appear dynamic
[15:42:28] [WARNING] reflective value(s) found and filtering out
[15:42:28] [WARNING] heuristic test shows that GET parameter 'id' might not be injectable
[15:42:28] [INFO] testing for SQL injection on GET parameter 'id'
[15:42:28] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:42:28] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:42:28] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:42:28] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:42:28] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:42:28] [INFO] testing 'MySQL inline queries'
[15:42:28] [INFO] testing 'PostgreSQL inline queries'
[15:42:28] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:42:28] [INFO] testing 'Oracle inline queries'
[15:42:28] [INFO] testing 'SQLite inline queries'
[15:42:28] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:42:28] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:42:28] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:42:28] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:42:28] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:42:29] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:42:29] [INFO] testing 'Oracle AND time-based blind'
[15:42:29] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:42:29] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:42:29] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[15:42:30] [WARNING] GET parameter 'id' is not injectable
[15:42:30] [WARNING] GET parameter 'Submit' does not appear dynamic
[15:42:30] [WARNING] heuristic test shows that GET parameter 'Submit' might not be injectable
[15:42:30] [INFO] testing for SQL injection on GET parameter 'Submit'
[15:42:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:42:30] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:42:30] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:42:30] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:42:30] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:42:30] [INFO] testing 'MySQL inline queries'
[15:42:30] [INFO] testing 'PostgreSQL inline queries'
[15:42:30] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:42:30] [INFO] testing 'Oracle inline queries'
[15:42:30] [INFO] testing 'SQLite inline queries'
[15:42:30] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:42:31] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:42:31] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:42:31] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:42:31] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:42:31] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:42:31] [INFO] testing 'Oracle AND time-based blind'
[15:42:31] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:42:31] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:42:32] [WARNING] GET parameter 'Submit' is not injectable
[15:42:32] [CRITICAL] all tested parameters appear to be not injectable. Try to increase '--level'/'--risk' values to perform more tests. Also, you can try to rerun by providing either a valid value for option '--string' (or '--regexp')
But the id parameter id injectable, why I receved that not injectable?
I tried with --lever 5 but nothing....
Where's my mistake?
TKS
