Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Line-Break-Separated Parameters in HTTP Request Bodies #5816

Open
AgarGrief opened this issue Nov 25, 2024 · 0 comments
Open

Support for Line-Break-Separated Parameters in HTTP Request Bodies #5816

AgarGrief opened this issue Nov 25, 2024 · 0 comments

Comments

@AgarGrief
Copy link

I am working with an older system where request bodies use line breaks (\n) instead of standard URL-encoded formatting (&) to separate parameters. This format appears to be incompatible with SQLMap, as it cannot parse and identify parameters for injection.

POST /Consulta,SE2.ashx?_method=search&_session=r HTTP/1.1
Host: sampledomain.com
Cookie: session_id=ABC123DEF456; user_token=XYZ789JKL012; site_preferences=default_theme
Content-Length: 153
Sec-Ch-Ua-Platform: "MacOS"
Accept-Language: en-GB,en;q=0.9
Sec-Ch-Ua: "BrowserX";v="15", "EngineY";v="10"
Content-Type: text/plain;charset=UTF-8
Sec-Ch-Ua-Mobile: ?0
User-Agent: BrowserX/15.0 (MacOS; x64) EngineY/10.0
Accept: application/json
Origin: https://sampledomain.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://sampledomain.com/resource/page
Accept-Encoding: gzip, deflate
Priority: u=1, i
Connection: keep-alive

action_type=1
request_id=12345
start_date=25/11/2024
end_date=05/12/2024
account_to=
account_from=
identifier=
statuses=["active","pending","completed"]
page_number=1
limit=20

python3 sqlmap.py -r a.txt --dbms mssql -p request_id
[CRITICAL] all testable parameters you provided are not present within the given request data

Feature Request:

It would be immensely helpful if SQLMap could:

Detect and parse parameters in request bodies separated by line breaks.
Allow injection testing on such parameters without requiring a transformation to URL-encoded format.
This feature would make SQLMap compatible with legacy systems that do not adhere to modern HTTP conventions. If it's possible to implement this compatibility, it would be greatly appreciated. Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant