Web applications frequently accept arguments within a supplied URL. These parameters are generally transmitted back to the web server in the HTTP GET method requests. If any of these parameter values are then included in a query statement to a backend database, an SQL injection vulnerability could exist. In this recipe, we will discuss how to use the sqlmap command to automate the testing of the HTTP GET method request parameters.
GET method SQL injection with sqlmap
Getting ready
To use sqlmap to perform SQL injection against a target, you will need to have a remote system that is running one or more web applications that are vulnerable to SQL injection. In the examples provided, an instance of Metasploitable2 is used to perform this task. Metasploitable2 has several...