Let's automate the testing of HTTP POST method request parameters using the sqlmap command:
- To perform an SQL injection attack on a service using the HTTP POST method, we will need to define the string of POST parameters using the --data argument.
- The login application in Mutillidae offers a login interface that transmits a username and password over the POST method. This will be our target for our SQL injection attack. Have a look at the following example:
The output of sqlmap has been truncated for space, following we can see the continuation of sqlmap's output to include vulnerabilities found:
- If no action is specified, ...
