Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Making it simple (no security at all), when we want to detect whether or not a GET parameter is vulnerable to SQLi, we could just type a ' as the value (?id=') and check if there is any error. (No blind SQL)

But in the case that the parameter is sent using a POST method, how can I detect if it is vulnerable? And then how to exploit it? I think that using a proxy and intercept the query will be the solution, but is there any other way?

share|improve this question

2 Answers 2

One of the easiest ways to do both (detect & exploit) is to download sqlmap and use the -r option.

Capture the POST request using any proxy tool, paste it into a file, then do:

# sqlmap -r <text_file_with_raw_POST_request>

(add --force-ssl switch if needed)

From: https://github.com/sqlmapproject/sqlmap/wiki/Usage

share|improve this answer

You can either use a proxy or a tool like Firebug to modify POST parameters before sending them. Personally I prefer to use a proxy like ZAP or Burp as they have some nice tools which allow you to automate the attack and load lists of payloads to test.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.11.22.2040\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Information Security Stack Exchange works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\""], "copyright__copyright__copyright": ["hare|improve this answer\n\nYou can either use a proxy or a tool like Firebug to modify POST parameters before sending them. Personally I prefer to use a proxy like ZAP or Burp as they have some nice tools which allow you to automate the attack and load lists of payloads to test.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}