Requesting a capture SQL injection with sqlmap
To simplify the process of using the sqlmap
command, it is possible to use a captured request from Burp Suite and execute sqlmap
with all the parameters and configurations defined within. In this recipe, we will discuss how to use sqlmap
to test the parameters associated with a provided request capture.
Getting ready
To use sqlmap
to perform SQL injection against a target, you will need to have a remote system that is running one or more web applications that are vulnerable to SQL injection. In the examples provided, an instance of Metasploitable2 is used to perform this task. Metasploitable2 has several preinstalled vulnerable web applications running on the TCP port 80
. For more information on setting up Metasploitable2, refer to the Installing Metasploitable2 recipe in Chapter 1, Getting Started.
How to do it…
The following steps will guide you to capture SQL injection with the help of sqlmap
command:
- To use a request capture with
sqlmap
, it must...