Collaborate Disseminate
pretty much on every resource I go, it says the sqlmap’s verbose value -v can be from 1 to 6 and default is 1, I try to look anywhere to see the difference between those values, but I can not find any specific information,
Can anyone tell… Continue reading sqlmap verbose level
I am working in a private company as VAPT Auditor. I am currently testing one of our project website which contains common features like login, sign up, etc. I mostly do manual testing using BurpSuite and etc but sometimes I also use autom… Continue reading How spamming entries in website database using the same IP address is possible?
My problem is that I have made my own tampered payload that should convert the actual payload to hex format.
You can see from the log that the tampered payload is correct, but in the post data "pinNumber" it has been tampered aga… Continue reading sqlmap tampered payload doesn’t insert correctly
I want grab some data from response of request and put it in next request post data how to do that? I know that there is postprocess | preprocess features but how they work and how to edit response by these feature?
I tried to work with po… Continue reading Extract data from request response and use it in next request in SQLmap
I used:
sqlmap -p –level 4 -u "https://the-host-web-commons/security/login.action?failed=true" –dbs –forms –crawl=2
While this tool only found some basic issues, how can I fill in the data in the results as shown below:
[1/… Continue reading How to fill in POST data on sqlmap? [closed]
A rather specific question, but I’m trying to SQL inject a vulnerable web app to enumerate data. I have permission to do this.
The gist of it is there are some params, lets say 4 of them being sent to the app in a post request. 2 of them a… Continue reading SQLi – how to dump data without knowing table & field names?
I am dumping a column of large table with almost 200000+ entries. I am running sqlmap for weeks to dump that column. But the problem is sometimes sqlmap extracts corrupt codes like @@ as shown in the image.
Now my question is there any way… Continue reading How dump only corrupt data in sqlmap [closed]
I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data.
I am pasting extracted material here.
[00:12:27] [INFO] the back-end DBMS is MySQL
b… Continue reading Sql injection extract random bits instead of actual data
I am testing a publicly available site https://example.com/ebill/login.php where I fill the form with account number, like 34413271 and a cookie is assigned for later urls to use, then the above URL redirects to https://example.com/ebill/a… Continue reading How to use sqlmap while website uses multiple redirects
I was running some sql injection tests in SQLmap, and every time, the tool stopped testing the parameters to ask a Y/n questions, it immediately returned it as ‘command not found’ to both the two possible answers I pass (Y and N) not givin… Continue reading SQLmap is returning "command not found" after every y/n prompt [closed]