sqlmap can't find the vulnerability

sqlmap can't find the vulnerability - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: sqlmap can't find the vulnerability (/showthread.php?tid=5716151)

sqlmap can't find the vulnerability - Freshyx - Sep 12, 2017

Hello,

I found an SQLi manually and tried it with sqlmapp too, however sqlmap couldn't find a vulnerability. It is mariaDB error-based, however the error is hidden in the source code.

Example:

Code 
An unexpected database error occurred. Please try again later.

[b]<!--[/b] Mysqli prepare error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '''' LIMIT 1' at line 1 -->

The comment is not displayed unless you look into the source code with the browser and I don't know if sqlmap recognizes that.

The vulnerability is very easy to find because I got this error with simply putting a

Code 
'

behind the GET parameter.

My sqlmap syntax:

Code 
sqlmap.py -u "http://URL/product[/quote].php?value=test" --dbms="mariadb" --level=5 --risk=3

Hopefully someone can help me!

* - Error22 - Oct 16, 2017

i think you need to use hackbar sql maunal way its help you

* - kmhacker - Oct 16, 2017

just post website link i am help you. sqlmap good for blind sql injection u can use maunal sql injection way use firefox browser and hackbar

RE: sqlmap can't find the vulnerability - jinja69 - Nov 16, 2017

sqlmap is sck bro try manual