Merge pull request #2174 from HackTricks-wiki/research_update_src_pentesting-web_sql-injection_sqlmap_second-order-injection-sqlmap_20260427_033819

Research Update Enhanced src/pentesting-web/sql-injection/sq...

Author: carlospolop

src/pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.md

@@ -78,7 +78,68 @@ sqlmap --tamper tamper.py -r login.txt -p email --second-req second.txt --proxy
 # -a : Dump all
 ```
 
-{{#include ../../../banners/hacktricks-training.md}}
+## Useful switches in real second-order flows
+
+Second-order automation usually fails because the **payload storage request works**, but the **execution request is noisy, stateful, or protected**. When that happens, the following flags are usually more useful than adding more payloads:
+
+```bash
+sqlmap -r login.txt -p email \
+  --second-req second.txt \
+  --csrf-token csrf \
+  --csrf-url https://target.tld/profile \
+  --csrf-method POST \
+  --live-cookies cookies.txt \
+  --safe-req keepalive.txt \
+  --safe-freq 1 \
+  --string "Welcome back" \
+  --text-only
+```
+
+- `--csrf-token`, `--csrf-url`, `--csrf-method`: Useful when the store or trigger request needs a fresh anti-CSRF token on every attempt.
+- `--live-cookies`: Reload cookies before each request. Useful when a browser/Burp macro is refreshing session state in the background.
+- `--safe-req` and `--safe-freq`: Keep the workflow alive when the application logs you out or invalidates the session after a few failed probes.
+- `--string`, `--not-string`, `--regexp`, `--code`, `--text-only`: Useful when the second-order response contains banners, ads, timestamps, or user-generated junk that makes diffing unstable.
+
+## When `--tamper` is not enough
 
+`tamper.py` is still the easiest way to **register a payload, log out, log in again, and trigger execution**. However, on modern targets it is often cleaner to move some of the logic to **request/response hooks**:
+
+- `--preprocess`: Modify the full HTTP request before it is sent. Useful when a second-order flow needs an extra nonce, an extra parameter, or header normalization.
+- `--postprocess`: Clean the HTTP response before sqlmap compares it. Useful when the second-order sink is wrapped in dynamic HTML and only a small fragment is stable.
+
+Example request/response hooks:
+
+```python
+#!/usr/bin/env python
+def preprocess(req):
+    if req.data:
+        req.data += b"&preview=1"
+```
 
+```python
+#!/usr/bin/env python
+import re
+def postprocess(page, headers=None, code=None):
+    page = re.sub(br"<span>Generated at .*?</span>", b"", page or b"")
+    return page, headers, code
+```
+
+## Important limitations
+
+- Do **not assume** that `--second-req` will replay the same payload inside a `*` placeholder in the second request. If the trigger request also needs the injected value (or a derived version of it), a custom `tamper`, `--preprocess`, or a local proxy is usually required.
+- Do **not rely on** `--eval` for the second request. Official usage documents `--eval` for the primary request flow; if the second request also needs per-attempt mutations, handle them inside your helper scripts instead.
+
+This pattern is especially useful when the payload is stored in places such as:
+
+- Filenames or image metadata that are queried later
+- Registration/profile fields later consumed by admin panels
+- Sorting/filtering preferences saved server-side and replayed later
+- Workflow state that is only executed after a preview, export, or moderation action
+
+## References
+
+- [sqlmap official usage wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage)
+- [Second Order SQLi: Automating with sqlmap](https://jlajara.gitlab.io/Second_order_sqli)
+
+{{#include ../../../banners/hacktricks-training.md}}