Sqlmap doesnt detect DVWA

[iamalsaher]

I am running DVWA in an Ubuntu guest OS which is running inside VirtualBox inside a Kali Host OS

The network is in Bridged mode and my Ubuntu machine has the IP 192.168.1.8
When I run the query

root@iamalsaher:~# sqlmap -u "http://192.168.1.8/dvwa/vulnerabilities/sqli_blind/?id=hello&Submit=Submit" --cookie="security=low; PHPSESSID=qcfp2i1j7basdd05akerq3rp35" -p id

[*] starting at 22:00:04

[22:00:04] [INFO] testing connection to the target URL
[22:00:04] [CRITICAL] page not found (404)
it is not recommended to continue in this kind of cases. Do you want to quit and make sure that everything is set up properly? [Y/n] 

I get this as output but if I remove the submit parameter it doesn't give a 404 error

Can you please help

[stamparm]

[stamparm]

[iamalsaher]

Wait, Don't close, I am talking about sqli_blind not plain sqli

[stamparm]

It goes like this. That same page returns 404 in case of non-existent/invalid user id. You've used hello, while the proper user id should be something like 1, 2, etc.

Now, how to properly exploit this:

1. either use --level=5 --risk=3 with invalid user id (e.g. hello in your case) to force OR boolean-based SQLi payloads

OR

2. use proper user id, like:

[iamalsaher]

Thanks a lot man, thank you very much