fix(sqlmap): fast confirm-first GET pass — reliably confirms error/UNION SQLi (was level=3/risk=2 timeout)#13
Merged
Conversation
…evel=3/risk=2, timed out) run_sqlmap_targeted's GET-candidate pass hardcoded `--level=3 --risk=2` with no `--technique`, so on a slow target one `sqlmap -m` batch tested every payload family (incl. time-based) across all header/param permutations and burned the whole phase budget confirming NOTHING — reproduced on testaspnet.vulnweb.com/ReadNews.aspx?id= (900s → 0 findings). The POST/OpenAPI path already had the v7.1.10 fix (`--technique=BEU --smart`); the GET path never got it, and `--sqlmap-lean/-level/-risk/ -tamper` only reach the --request-file path (silent no-op here). New `_build_get_sqlmap_command` defaults the GET pass to fast confirm-first `--level=1 --risk=1 --technique=BEU --smart` (mirrors the POST precedent); `deep=True` restores an exhaustive BEUS sweep. `--technique` excludes T(ime) so a slow/blocking WAF timeout can never be misread as SQLi (same FP posture scanner.sh's time-based tier enforces). Relabelled scanner.sh summary.txt "Verified SQLi PoCs" → "(scanner time-based)" since that counter is only the time-based tier (error/UNION is confirmed by the sqlmap phase → reporter Method 1f). Validated end-to-end through the tool: 60s → `id` vulnerable (MSSQL 2014) → [CRITICAL] sqli_sqlmap_confirmed in the report. 4 new TDD tests; suite 2171 pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deferred follow-ups from the testaspnet.vulnweb.com tool-test: sqlmap phase sequencing behind lightpanda (P26), escalate-on-hit + thread tuning flags (P27), phase-status reads the wrong sqlmap output file (P28), https-only pre-recon fingerprint + inverted log (P29). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Found via testing the tool on the Acunetix authorized test site
testaspnet.vulnweb.com: the tool reported 0 SQLi on a trivially error/UNION-injectable site.Root cause:
run_sqlmap_targeted's GET-candidate pass hardcoded--level=3 --risk=2with no--technique— on a slow target onesqlmap -mbatch burned the whole 900s phase budget confirming nothing. The POST path already had the v7.1.10--technique=BEU --smartfix; the GET path never got it, and--sqlmap-lean/-level/-risk/-tamperonly reach the--request-filepath (silent no-op here).Fix: new
_build_get_sqlmap_command— fast confirm-first--level=1 --risk=1 --technique=BEU --smart(mirrors the POST precedent);deep=Truerestores an exhaustive BEUS sweep.--techniqueexcludes T(ime) so a slow/blocking WAF timeout is never misread as SQLi. Relabelledscanner.shsummary "Verified SQLi PoCs" → "(scanner time-based)".Validated end-to-end through the tool: 60s →
idvulnerable (MSSQL 2014) →[CRITICAL] sqli_sqlmap_confirmedin the report (vs 900s → nothing before).Reviewed by codex + grok (agy timed out). Larger follow-ups (phase sequencing behind lightpanda, escalate-on-hit, flag threading) filed as backlog P26-P29.
Test plan
TestGetCandidateSqlmapCommand); full non-whitebox suite 2171 passed / 1 skipped / 30 subtests, zero regressions.load_findings.🤖 Generated with Claude Code