Feature Request: Include script / endpoint prominently in output

[attritionorg]

Is your feature request related to a problem? Please describe.
The current SQLmap output includes the parameter being injected to. It does not appear to, by default at least, include the script or endpoint. e.g. /sqlmap.php or /randoendpoint

Describe the solution you'd like
Included in the line that highlights the parameter being injected, include the script or endpoint.

Describe alternatives you've considered
Banging my head against the wall.

Additional context
There are a -lot- of script kiddies using this to find vulnerabilities. They have taken to just including SQLmap output as proof of their discovery. Which is good, it gives more confidence it is a legit SQL injection so that is awesome. But them not including the script/endpoint in disclosure, and it not being in the output, makes it living hell trying to determine if this is a new vulnerability or the same one disclosed months/years prior.

Thank you for your consideration. I am happy to offer a $100 bounty to whoever tackles this in a satisfactory way! =)

[stamparm]

well, there is a way:

$ python sqlmap.py -u "http://testphp.vulnweb.com/artists.php?artist=1" --batch
        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.8.9#stable}
|_ -| . [']     | .'| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 15:24:16 /2024-09-24/

[15:24:16] [INFO] testing connection to the target URL
[15:24:17] [INFO] checking if the target is protected by some kind of WAF/IPS
[15:24:17] [INFO] testing if the target URL content is stable
[15:24:17] [INFO] target URL content is stable
[...]
GET parameter 'artist' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 56 HTTP(s) requests:
---
Parameter: artist (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: artist=1 AND 2564=2564

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: artist=1 AND (SELECT 8631 FROM (SELECT(SLEEP(5)))LYPB)

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: artist=-7713 UNION ALL SELECT NULL,NULL,CONCAT(0x716a6b7871,0x79555053534a4a7a416f6a637a636b4b6f514e704e4b6b6646626c6c4d4b5663586b6e7746505752,0x7171717871)-- -
---
[15:24:43] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.19.0, PHP 5.6.40
back-end DBMS: MySQL >= 5.0.12
[15:24:44] [INFO] fetched data logged to text files under '/home/stamparm/.local/share/sqlmap/output/testphp.vulnweb.com'

and then:

$ cd /home/stamparm/.local/share/sqlmap/output/testphp.vulnweb.com
$ ls -la
total 24
drwxrwxr-x 2 stamparm stamparm 4096 ruj  24 15:24 .
drwxrwxr-x 6 stamparm stamparm 4096 ruj  24 15:24 ..
-rw-rw-r-- 1 stamparm stamparm  777 ruj  24 15:24 log
-rw-r--r-- 1 stamparm stamparm 8192 ruj  24 15:24 session.sqlite
-rw-rw-r-- 1 stamparm stamparm  125 ruj  24 15:24 target.txt
$ cat target.txt
http://testphp.vulnweb.com/artists.php?artist=1 (GET)  # sqlmap.py -u http://testphp.vulnweb.com/artists.php?artist=1 --batch

[stamparm]

story is that people should give the proper sqlmap command, along with that output, so the other side could reproduce it. just giving the URI would not help much as there are complex cases where you have to get the complete picture (e.g. headers being sent, POST body, content type, etc.)

[stamparm]

anyhow, i feel your pain, but I won't put the complete command line into that "injection point" section as it would be just plain ugly. in all cases when I needed to prove the existence of SQLi with sqlmap, used command line was A MUST

[attritionorg]

Rather than adding that which isn't a pretty solution, where the output shows the vulnerable parameter is where I was thinking. Here's an example:

https://packetstormsecurity.com/files/173874/Online-Diagnostic-Lab-Management-1.0-SQL-Injection.html

We know the affected parameter, but there is no script mentioned by the researcher. This is where I feel SQLmap could make a lot of disclosure analyst's lives easier if it injected the endpoint being tested in the output, in that specific section of it.