## TL;DR
Sqlmap found no query params, form fields, or parseable body to test. Name the parameter explicitly with `-p`, supply POST bodies with `--data`, mark REST path segments with `*`, and raise `--level` for header and cookie parameters.

```text
no parameter(s) found for testing
```

## Use this when
- Sqlmap exits early with `no parameter(s) found for testing`.
- You know the endpoint takes input (forms, JSON body, path IDs).
- The URL itself has no query string.

## Not for this skill when
- Sqlmap found parameters but calls them non-injectable. That is a different verdict.
- The endpoint genuinely takes no input. There is nothing to test.
- The input is out of scope. Do not go looking for parameters to test.

## Steps
1. Inventory the input surface: query string, form fields, JSON body, headers, cookies, path segments. Verify: you can name at least one parameter.
2. For POST forms: `sqlmap -u "YOUR_TARGET_HOST/login" --data="user=test&pass=test" -p user`. Verify: sqlmap lists the parameter as a candidate.
3. For JSON APIs: `--data='{"id":1}'` with the content type set correctly. Verify: sqlmap parses the body and offers the fields.
4. For REST paths like `/members/1`: mark the spot, `sqlmap -u "YOUR_TARGET_HOST/members/1*"`. Verify: sqlmap tests the marked segment.
5. For headers and cookies: `--level=2` or higher picks them up. Verify: sqlmap reports header/cookie parameters as candidates.

## Variant phrasings
### sqlmap no parameters found
Compact phrasing.
### sqlmap not finding POST parameters
The POST-specific search.
### sqlmap test JSON body parameter
The API-oriented search.

Compatibility: sqlmap 1.x. The `*` injection marker and `--data` handling are stable across versions.

## Why it happens
Sqlmap only auto-discovers classic query-string and form parameters at default level. Modern apps hide input in JSON bodies, path segments, headers, and cookies, which sqlmap will not test unless you point at them.

## Edge cases / pitfalls
- A parameter that exists but is never tested because you forgot `-p` is the most common miss on multi-param forms.
- Testing every header at high level is noisy. Scope to the headers the app actually consumes.
- The `*` marker in the wrong place tests the wrong thing. Double-check placement with `--verbose` output.
- File upload fields need different handling; `--data` alone will not exercise them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zlcolsBAuUgJXBxFgeACsQ