Support for HTTP Authentication SQLi

[CmdFreak]

Can you Support HTTP Authentication SQLi?

Example:
go on: [REDACTED BY SQLMAP DEVS]

Type this as Username:
' or extractvalue(1,concat(0x2e,(SELECT CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database() LIMIT 1 OFFSET 0))) -- /**/

Type NO Password.

Then look at the sourcecode (STRG + U)

Can you support this kind of SQLi ?

[stamparm]

You can't put live sites here. Closing this down.

p.s. there is a standard way how to approach this type of SQLi. Use Burp to intercept one valid request toward that site (using your browser) and use it with sqlmap (-r request.txt)

[CmdFreak]

I have used a request, but it wont work.
http://wi.to/images/2013/02/26/fz4wB.png

whats wrong at my syntax?

[stamparm]

Something is wrong with it. Could you please paste it here or send it
privately to miroslav@sqlmap.org
On Feb 26, 2013 12:19 AM, "CmdFreak" notifications@github.com wrote:

I have used a request, but it wont work.
http://wi.to/images/2013/02/26/fz4wB.png

whats wrong at my syntax?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/404#issuecomment-14082751.

[CmdFreak]

Mail is out

[stamparm]

Your request looks like this:

GET / HTTP/1.1
Host: foobar
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Authorization: Basic ............

sqlmap can't do anything with it. There are no usable parameters here to be tested. Neither custom injection marks, neither POST parameters, neither GET parameters,... nothing.

[stamparm]

Looking into it you would like sqlmap to automatically Base64 decode Authorization header, inject into it and Base64 encode it. This is Issue #25.