SQLMAP with single URL application

Question

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based on action and other parameters.

Database used as below

[root@localhost ~]# mysql -q
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Server version: 5.5.64-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. 

One of the 'XMLHttpRequest' having SQL injection issue and ' sorters ' field is having this issue, for example if we add (') in 'ASC' field then page is showing 500 error. To reproduce it, I am using burp suite community edition to intercept the request and feed this to SQLMAP using file.

Request details

Name    Protocol    Method  Result  Content type    Received    Time    Initiator
http://10.20.100.200/test/api/?aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q&action=management&which=overview&_dc=1580104578032&sort=account_name&dir=ASC&sorters=%5B%7B%22field%22%3A%22account_name%22%2C%22direction%22%3A%22ASC%22%7D%5D&start=0&limit=18    HTTP    GET 200 application/json    1.29 KB 677.42 ms   XMLHttpRequest

Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Connection: Keep-Alive
Cookie: client_time=1580129655.074; check=1; aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q; bid=4memnc2vdi7pj7i56q5sopu5gbspba99; cid=daSGjWTD0bQ8ZLCNRG4tA1090ddBYYPatzexNHrf4qy4FwB4CcvymjISadYw9Quh
Host: 10.20.100.200
Referer: http://10.20.100.200/test/
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
X-Requested-With: XMLHttpRequest
Connection: close

request.txt to feed SQLMAP (placed astrick (*) at ASC of sorters field )

GET /api/?aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q&action=management&which=overview&_dc=1580104578032&sort=account_name&dir=ASC&sorters=%5B%7B%22field%22%3A%22account_name%22%2C%22direction%22%3A%22ASC*%22%7D%5D&start=0&limit=18 HTTP/1.1
Accept: */*
X-Requested-With: XMLHttpRequest
Referer: http://10.20.100.200/test/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: 10.20.100.200
Cookie: client_time=1580129655.074; check=1; uid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q; sid=4memnc2vdi7pj7i56q5sopu5gbspba99; vid=daSGjWTD0bQ8ZLCNRG4tA1090ddBYYPatzexNHrf4qy4FwB4CcvymjISadYw9Quh

SQLMAP command for SQL injection

sqlmap.py -r C:\Users\Documents\request.txt --dbs --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,percentage,randomcase,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

SQLMAP output

[00:34:56] [WARNING] URI parameter '#1*' does not appear to be dynamic
[00:34:57] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
[00:34:58] [INFO] testing for SQL injection on URI parameter '#1*'
[00:34:58] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[00:35:06] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[00:35:06] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[00:35:08] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[00:35:11] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[00:35:13] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[00:35:16] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[00:35:16] [INFO] testing 'MySQL inline queries'
[00:35:17] [INFO] testing 'PostgreSQL inline queries'
[00:35:18] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[00:35:18] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[00:35:23] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[00:35:28] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[00:35:33] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[00:35:39] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[00:35:46] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'
[00:35:52] [INFO] testing 'Oracle AND time-based blind'
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y
[00:37:07] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[00:37:20] [WARNING] URI parameter '#1*' does not seem to be injectable
[00:37:20] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests
[00:37:20] [WARNING]  HTTP error codes detected during run:
403 (Forbidden) - 1 times, 400 (Bad Request) - 578 times, 414 (Request-URI Too Long) - 235 times

Answer 1

Here issue was SQLMAP replacing the aid so that SQLMAP requests were not validating by server.

We need to tell SQLMAP to exclude such params and also we can tell SQLMAP to try the required params by placing the wild character ( * ) ie dir=ASC*. In this case, SQLMAP will try to inject the code for param 'dir'

For example

GET /api/?aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q&action=management&which=overview&_dc=1580104578032&sort=account_name&dir=ASC*&start=0&limit=18 HTTP/1.1