sql-injectionsqlmap

Add known tables names to SQLmap Time-Based session


I am analyzing a database that has 90 tables using the "Time-Based Comparison" technique. When I was listing the names of the tables, I was already at number 40 and my PC turned off without saving the progress in the session, when I started the process again, it started from table 27, fortunately I had written down the names of the tables in a notepad, but I don't know how to add them to the session.

I tried to modify the session.sqlite file but I can't find information on how I should fill in the id column.

I tried including the name of the tables in a text file and using the --common-tables parameter, but they are not added to the session, when starting the "Time-Based" search process again, it continues to start from the table 27.

How can I add to the session the names of the tables that I already know, but were not saved? I want to avoid having to compare character by character again, it takes a lot of time.


Solution

  • The ID column corresponds to the hash of the query that SQLMap makes to the server.

    To add the names of the tables that I already know, what I did was use the same function that SQLMap uses to generate the hash of the queries, and add the hash with the value directly to the session.sqlite database.