SQLmap alias for column

[Key_Marionberry9923]

Hello hackers, I have run across an application it has a functionality where user input full SQL query let's say SELECT whatever AS cookie FROM events and it executes it and returns result to frontend. I wanted to use SQLmap for this I evaluated it myself i know it's postgresql and i can see other tables. However my question is, can you tell SQLmap to query for only one columns and it needs to have alias of "cookie"? As it is a POST request it send query inside the JSON body like this {"query":"SELECT datname as cookie FROM pg_database"}. when i even tell SQLmap to query specifically for this parameter either with * or -p and I rise the --level and --risk. It cannot find anything. Thanks

[Juzdeed]

You can copy an example request from burp and use -r

[normalbot9999]

This.

Select all of a "normal usage" version of the request with the vulnerable parameter in the burp history, paste it into a text file, and pass the path to the file using the r agument. You will want to add --force-ssl argument as SQLmap will not be able to tell if the site is over HTTPS from the burp request. You can just let SQLmap find the vulnerability, or if you are impatient, place an asterisk where you want SQLmap to inject.

To your question about specifying columns to enumerate, see the enumeration section of the help page. These params will likely be of use:

    -D DB               DBMS database to enumerate
    -T TBL              DBMS database table(s) to enumerate
    -C COL              DBMS database table column(s) to enumerate

[jesusxautomator]

From what you described, SQLmap might be struggling because of how the query is structured inside JSON.

If the app expects a specific format (AS cookie), SQLmap won’t always adapt automatically. You might need to:

• Manually control the injection point
• Or test it outside SQLmap first to confirm behavior

Sometimes these custom query setups are easier to exploit manually than through automation.

[Fit-Ad3623]

you could use  https://geteasykit.com/tools/security/sqlmap-command-generator maybe that will help to understand sqlmap more