agent regex failed on sqlmap verbose log, dropping injectable parameters

TL;DR

Sqlmap prints "is injectable" findings in several different banner phrasings depending on the technique and DBMS, so a single regex like (\w+) parameter .* is .* injectable silently drops findings. Parse the verbose log as blocks (technique header, then parameter lines), match against a list of known banner variants, and cross-check the count against sqlmap's own summary line at the end of the run.

agent regex failed on sqlmap verbose log, dropping injectable parameters

Use this when

• Your agent extracts injectable parameters from sqlmap verbose logs and the count is lower than sqlmap's reported total.
• The log shows technique banners but your parser recorded zero or partial findings.
• You run sqlmap with -v 3 or higher and post-process the text log.

Not for this skill when

• Sqlmap itself reports no injectable parameters. A parser fix cannot create findings that are not in the log.
• The problem is sqlmap failing to connect or being blocked. That is a scan-setup issue, not a parsing issue.
• You are running sqlmap against a system you are not authorized to test. Stop.

Steps

1. Confirm the gap: run grep -c "injectable" sqlmap-verbose.log and compare with your parser's count. Verify: the counts differ, which proves findings are being dropped.
2. Normalize the log first: strip ANSI color codes and collapse CRLF line endings. Verify: a scan for escape characters in the normalized file returns nothing.
3. Match banner variants, not one pattern. Cover at least: the generic UNION query phrasing, boolean-based blind, time-based blind, error-based, and stacked-queries phrasing. Verify: each variant in your list matches at least one line in the log.
4. Parse in blocks: a parameter finding starts at the technique header line and includes the parameter and DBMS lines that follow. Emit one finding per parameter plus technique pair. Verify: the total equals sqlmap's summary line at the end of the run.
5. Persist the extraction as JSON next to the log before the agent summarizes. Verify: rerunning the parser on the saved log reproduces the same count.

Variant phrasings

sqlmap log parser missing injectable parameters

Same failure family, shorter phrasing.

agent dropping sqlmap injection points from verbose output

Symptom-level search.

regex misses boolean-based blind injectable in sqlmap log

One specific banner variant.

Compatibility: sqlmap 1.8+, verbose levels -v 1 through -v 6. Banner phrasing shifts with DBMS fingerprint results.

Why it happens

Sqlmap builds the banner text from the technique name and DBMS-specific descriptors, so the literal wording shifts across techniques. A regex written against one run's output misses the others. Verbose mode adds timing and payload lines that break line-anchored patterns, and colored output inserts invisible characters inside the matched text.

Edge cases / pitfalls

• Trace-level logs interleave request and response dumps. Anchor on the technique header, not on proximity to the word "parameter".
• If the log is truncated mid-run, count against the partial output instead of expecting the final summary total.
• Re-parse the saved log. Never re-run the scan to fix a parser bug; re-running hammers the authorized target for no reason.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OdOdfmE78is5sM4xW4RkqA