title: SQLMAP with single URL application
body: <p>I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based on action and other parameters. </p>
  
  <p><strong>Database used as below</strong></p>
  
  <pre><code>[root@localhost ~]# mysql -q
  Welcome to the MariaDB monitor.  Commands end with ; or \g.
  Server version: 5.5.64-MariaDB MariaDB Server
  
  Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. 
  </code></pre>
  
  <p>One of the 'XMLHttpRequest' having SQL injection issue and '<strong>sorters</strong>' field is having this issue, for example if we add (') in 'ASC' field then page is showing 500 error. To reproduce it, I am using <strong>burp</strong> suite community edition to intercept the request and feed this to <strong>SQLMAP</strong> using file.</p>
  
  <p><strong>Request details</strong> </p>
  
  <pre><code>Name    Protocol    Method  Result  Content type    Received    Time    Initiator
  http://10.20.100.200/test/api/?aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q&amp;action=management&amp;which=overview&amp;_dc=1580104578032&amp;sort=account_name&amp;dir=ASC&amp;sorters=%5B%7B%22field%22%3A%22account_name%22%2C%22direction%22%3A%22ASC%22%7D%5D&amp;start=0&amp;limit=18    HTTP    GET 200 application/json    1.29 KB 677.42 ms   XMLHttpRequest
  
  Accept: */*
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US
  Connection: Keep-Alive
  Cookie: client_time=1580129655.074; check=1; aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q; bid=4memnc2vdi7pj7i56q5sopu5gbspba99; cid=daSGjWTD0bQ8ZLCNRG4tA1090ddBYYPatzexNHrf4qy4FwB4CcvymjISadYw9Quh
  Host: 10.20.100.200
  Referer: http://10.20.100.200/test/
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
  X-Requested-With: XMLHttpRequest
  Connection: close
  </code></pre>
  
  <p><strong>request.txt to feed SQLMAP (placed astrick (*) at ASC of sorters field )</strong></p>
  
  <pre><code>GET /api/?aid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q&amp;action=management&amp;which=overview&amp;_dc=1580104578032&amp;sort=account_name&amp;dir=ASC&amp;sorters=%5B%7B%22field%22%3A%22account_name%22%2C%22direction%22%3A%22ASC*%22%7D%5D&amp;start=0&amp;limit=18 HTTP/1.1
  Accept: */*
  X-Requested-With: XMLHttpRequest
  Referer: http://10.20.100.200/test/
  Accept-Language: en-US
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
  Host: 10.20.100.200
  Cookie: client_time=1580129655.074; check=1; uid=E5xr3iOOg8sI1o4Zl1URZ4ytFlAdVTy9AMEiVjC6HhMBVwCkQgee160WtRYidV8Q; sid=4memnc2vdi7pj7i56q5sopu5gbspba99; vid=daSGjWTD0bQ8ZLCNRG4tA1090ddBYYPatzexNHrf4qy4FwB4CcvymjISadYw9Quh
  </code></pre>
  
  <p><strong>SQLMAP command for SQL injection</strong> </p>
  
  <pre><code>sqlmap.py -r C:\Users\Documents\request.txt --dbs --tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,percentage,randomcase,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
  </code></pre>
  
  <p><strong>SQLMAP output</strong> </p>
  
  <pre><code>[00:34:56] [WARNING] URI parameter '#1*' does not appear to be dynamic
  [00:34:57] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
  [00:34:58] [INFO] testing for SQL injection on URI parameter '#1*'
  [00:34:58] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
  [00:35:06] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
  [00:35:06] [INFO] testing 'MySQL &gt;= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
  [00:35:08] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
  [00:35:11] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
  [00:35:13] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
  [00:35:16] [INFO] testing 'MySQL &gt;= 5.0 error-based - Parameter replace (FLOOR)'
  [00:35:16] [INFO] testing 'MySQL inline queries'
  [00:35:17] [INFO] testing 'PostgreSQL inline queries'
  [00:35:18] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
  [00:35:18] [INFO] testing 'PostgreSQL &gt; 8.1 stacked queries (comment)'
  [00:35:23] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
  [00:35:28] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
  [00:35:33] [INFO] testing 'MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP)'
  [00:35:39] [INFO] testing 'PostgreSQL &gt; 8.1 AND time-based blind'
  [00:35:46] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'
  [00:35:52] [INFO] testing 'Oracle AND time-based blind'
  it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y
  [00:37:07] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
  [00:37:20] [WARNING] URI parameter '#1*' does not seem to be injectable
  [00:37:20] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests
  [00:37:20] [WARNING]  HTTP error codes detected during run:
  403 (Forbidden) - 1 times, 400 (Bad Request) - 578 times, 414 (Request-URI Too Long) - 235 times
  </code></pre>