## TL;DR
Sqlmap prints "is injectable" findings in several different banner phrasings depending on the technique and DBMS, so a single regex like `(\w+) parameter .* is .* injectable` silently drops findings. Parse the verbose log as blocks (technique header, then parameter lines), match against a list of known banner variants, and cross-check the count against sqlmap's own summary line at the end of the run.

```text
agent regex failed on sqlmap verbose log, dropping injectable parameters
```

## Use this when
- Your agent extracts injectable parameters from sqlmap verbose logs and the count is lower than sqlmap's reported total.
- The log shows technique banners but your parser recorded zero or partial findings.
- You run sqlmap with -v 3 or higher and post-process the text log.

## Not for this skill when
- Sqlmap itself reports no injectable parameters. A parser fix cannot create findings that are not in the log.
- The problem is sqlmap failing to connect or being blocked. That is a scan-setup issue, not a parsing issue.
- You are running sqlmap against a system you are not authorized to test. Stop.

## Steps
1. Confirm the gap: run `grep -c "injectable" sqlmap-verbose.log` and compare with your parser's count. Verify: the counts differ, which proves findings are being dropped.
2. Normalize the log first: strip ANSI color codes and collapse CRLF line endings. Verify: a scan for escape characters in the normalized file returns nothing.
3. Match banner variants, not one pattern. Cover at least: the generic UNION query phrasing, boolean-based blind, time-based blind, error-based, and stacked-queries phrasing. Verify: each variant in your list matches at least one line in the log.
4. Parse in blocks: a parameter finding starts at the technique header line and includes the parameter and DBMS lines that follow. Emit one finding per parameter plus technique pair. Verify: the total equals sqlmap's summary line at the end of the run.
5. Persist the extraction as JSON next to the log before the agent summarizes. Verify: rerunning the parser on the saved log reproduces the same count.

## Variant phrasings
### sqlmap log parser missing injectable parameters
Same failure family, shorter phrasing.
### agent dropping sqlmap injection points from verbose output
Symptom-level search.
### regex misses boolean-based blind injectable in sqlmap log
One specific banner variant.

Compatibility: sqlmap 1.8+, verbose levels -v 1 through -v 6. Banner phrasing shifts with DBMS fingerprint results.

## Why it happens
Sqlmap builds the banner text from the technique name and DBMS-specific descriptors, so the literal wording shifts across techniques. A regex written against one run's output misses the others. Verbose mode adds timing and payload lines that break line-anchored patterns, and colored output inserts invisible characters inside the matched text.

## Edge cases / pitfalls
- Trace-level logs interleave request and response dumps. Anchor on the technique header, not on proximity to the word "parameter".
- If the log is truncated mid-run, count against the partial output instead of expecting the final summary total.
- Re-parse the saved log. Never re-run the scan to fix a parser bug; re-running hammers the authorized target for no reason.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OdOdfmE78is5sM4xW4RkqA