Collaborate Disseminate
During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don’t have access to it) and all CMS login … Continue reading MSSQL Blind SQLi – What can I do
Using sqlmap i often get warnings about “target URL content is not stable” and also about parameters that “appear not to be dynamic”. What do those mean exactly? I can’t find more info on this. Thanks in advance.
Continue reading What is considered Stable URL content and what are Dynamic Parameters? (sqlmap)
I would like to use sqlmap and set parameters, that are concatenated inside the URL parts.
I know that a following URL is possible to track with defining of parameter by putting an asterisk behind the parameter value:
sqlma… Continue reading Using sqlmap and testing parameters inside SEF URL alias
How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this:
python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 –dbs
How can I test against WAF/IDs in th… Continue reading Bypass WAF/IDS with SQLMAP? [closed]
I have discovered the credentials of a website database.
I’ve tried to access the database from SQLMap (which claims that you can access the SQL database from external sources)
but in the meantime, I got 1045 error due to a… Continue reading Bypassing IP Restriction or finding accepted IPs for SQL Database
I want to perform SQL injection but I don’t know how to use the command. So far, I have tried this:
–data=”{‘user_id’:’6′,’user_with:5*’}” –prefix=” OR user_to = 5)” –suffix=”#” -vvv`
I use ‘ instead of ” in parameter because sqlmap… Continue reading Custom post data JSON payload format in sqlmap?
I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new to SQLi and have a lot to … Continue reading Change injection payload in SQLmap
I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new to SQLi and have a lot to … Continue reading Change injection payload in SQLmap
I have been pen testing our website and Vega pointed me to a sql injection in our login form. I tried to use burpsuite and sql map to test for the injection. I haven’t gotten anywhere though.
Here’s what vega says.
SQL In… Continue reading Vega says SQL injection, SQL Map doesn’t find anything
I’m busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point.
For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not detecting the injection point … Continue reading SQLMAP injection point