Automating SQL Injection with Burp, Sqlmap and GDS Burp API
I came across GDS Burp API which seems like a very useful tool for parsing Burp Proxy logs. The GDS Burp API exposes a Python object interface to requests/responses recorded by Burp. The below link provides a very good introduction to the API.
I wrote a simple script to use the API to parse the Burp proxy logs and send it to SQLMap to automate testing SQL injection for all GET and POST parameters and skip all urls without any parameters.
1. Clone the GDSSecurity burpee repository git clone https://github.com/GDSSecurity/burpee.git
2. Download burpSQL.py from https://github.com/milo2012/burpSQL into the burpee folder
3. Next, we will have to configure logging in Burpsuite
4. Change the proxy settings of your browser to 127.0.0.1:8080
5. Crawl the website with Owasp Ajax Crawling tool or spider with Burpsuite or the manual way.
Below are the command line options for burpSQL
6. The above is pretty self explanatory. If your Burp proxy log is cluttered with urls from multiple domains, you can filtered the SQL injection testing to specific domains using the –domain switch.
Drop me a message if you have any suggestions or comments. Thank you !