sqlmap "no parameter(s) found for testing" on authorized target URL

TL;DR

Sqlmap found no query params, form fields, or parseable body to test. Name the parameter explicitly with -p, supply POST bodies with --data, mark REST path segments with *, and raise --level for header and cookie parameters.

no parameter(s) found for testing

Use this when

• Sqlmap exits early with no parameter(s) found for testing.
• You know the endpoint takes input (forms, JSON body, path IDs).
• The URL itself has no query string.

Not for this skill when

• Sqlmap found parameters but calls them non-injectable. That is a different verdict.
• The endpoint genuinely takes no input. There is nothing to test.
• The input is out of scope. Do not go looking for parameters to test.

Steps

1. Inventory the input surface: query string, form fields, JSON body, headers, cookies, path segments. Verify: you can name at least one parameter.
2. For POST forms: sqlmap -u "YOUR_TARGET_HOST/login" --data="user=test&pass=test" -p user. Verify: sqlmap lists the parameter as a candidate.
3. For JSON APIs: --data='{"id":1}' with the content type set correctly. Verify: sqlmap parses the body and offers the fields.
4. For REST paths like /members/1: mark the spot, sqlmap -u "YOUR_TARGET_HOST/members/1*". Verify: sqlmap tests the marked segment.
5. For headers and cookies: --level=2 or higher picks them up. Verify: sqlmap reports header/cookie parameters as candidates.

Variant phrasings

sqlmap no parameters found

Compact phrasing.

sqlmap not finding POST parameters

The POST-specific search.

sqlmap test JSON body parameter

The API-oriented search.

Compatibility: sqlmap 1.x. The * injection marker and --data handling are stable across versions.

Why it happens

Sqlmap only auto-discovers classic query-string and form parameters at default level. Modern apps hide input in JSON bodies, path segments, headers, and cookies, which sqlmap will not test unless you point at them.

Edge cases / pitfalls

• A parameter that exists but is never tested because you forgot -p is the most common miss on multi-param forms.
• Testing every header at high level is noisy. Scope to the headers the app actually consumes.
• The * marker in the wrong place tests the wrong thing. Double-check placement with --verbose output.
• File upload fields need different handling; --data alone will not exercise them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zlcolsBAuUgJXBxFgeACsQ