Repository navigation
SQLMap fails to use http basic auth credentials correctly #4320
Description
Describe the bug
When I am running SQLMap against a DVWA instance with basic auth enabled, SQLMap fails due to unauthorized requests. [CRITICAL] not authorized, try to provide right HTTP authentication type and valid credentials (401)
I double checked the basic auth credentials and they are correct.
I tried to debug this issue by intercepting SQLMap`s requests and found that every request is sent twice, one with the basic auth credentials and one without. (see the screenshot)
To Reproduce
- Run 'sqlmap --auth-type="Basic" --auth-cred="htaccess:htaccess" --batch --time-sec=20 --output-dir=./output --level=2 --risk=3 --method=get --answer="keep=Y,skip=N,follow=N,select=q,detect=Y,extending=Y,sure=Y" --url="http://127.0.0.1:80/vulnerabilities/sqli/?id=1&Submit=Submit"'
Expected behavior
I would expect SQLMap to send requests with the basic auth credentials only. Furthermore, I would expect SQLMap not to close with a not authorized error.
Screenshots
Running environment:
- sqlmap version 1.4.4#stable and 1.4.8#stable
- Ubuntu package manager (apt) and Arch Linux package manager (pacman)
- Ubuntu and Arch Linux
- Python version 3.8.5
Target details:
- DVWA with basic auth enabled
Activity
mkauschi commentedon Aug 31, 2020
It seems like the issue was introduced between version >1.3.10#stable and version 1.4.4#stable. With version 1.3.10#stable the issue does not appear. Maybe this information helps.
stamparm commentedon Aug 31, 2020
mkauschi commentedon Aug 31, 2020
It seems like you are not having this issue with your test application. Do you see a possibility to debug this further? When I am scanning the same test application with version 1.3.10 I do not experience this issue. After updating SQLMap to version 1.4.4 or later the scan stops due to a HTTP 401 code.
stamparm commentedon Aug 31, 2020
This page of yours does not use Basic authentication
mkauschi commentedon Aug 31, 2020
Okay, I will continue investigating the issue tomorrow and drop a message if I could figure out what the problem is/was. I am just wondering why version 1.3.10 works nicely and version 1.4.4 does not.
stamparm commentedon Aug 31, 2020
i believe that you've messed up something.
just do the regular "Submit" inside the firefox, go to "Network" tab inside web developer tool, "Copy as curl" and inside the shell replace curl with sqlmap
stamparm commentedon Aug 31, 2020
"Cookies" are the key here. There is no Basic authorization
This is your same page in my shell:
mkauschi commentedon Sep 1, 2020
Hi Miroslav,
I have to reopen this bug report because I dug more into SQLMaps code and found the issue. It was introduced from version 1.3.5 to version 1.3.6. The issue is in the class lib/request/connect.py (see screenshot).
For some reason the Basic authentication header is of type bytes now. SQLMap iterates over every field in the header and deletes it first. Then it checks if the instance is of type
strand adds it again. Because the Basic authentication header is of typebyteit is skipped and therefore removed from the headers.