+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long (/showthread.php?tid=5936338)
Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long - antonio.carrillo78 - Feb 1, 2019
Hello guys,
I used sqlmap on a website, it's showing me the Database names but it retrieves empty data for tables names
Microsoft SQL Server 2012
DBms = mssql
WAF detected Generic Unkown
The weird part is that i tried for days on row and finally worked. It showed me the table names, colums, and even data inside the columns such as email, phone numebers, etc. But now it's not working.
The errors i got were:
- 414 uri too long
- something about unable to decode characters
It detects Generic <unknown> waf. Maybe I should use a --tamper ? Which one ?
![[Image: EVMTHZl.png]](https://i.imgur.com/EVMTHZl.png)
It seems strange that it worked before and now it doesn't
I tried tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
but didn't work
RE: Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long - Girl With One BallSack - Feb 2, 2019
i can help you look in your private inbox!
RE: Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long - smtp.hu - Feb 16, 2019
--random-agent will be help you
RE: Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long - Kalikou - Sep 5, 2019
(Feb 2, 2019 02:06 PM)Girl With One BallSack Wrote: i can help you look in your private inbox!
I have the same problem, can you help me
RE: Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long - whitedragonflyer - Sep 5, 2019
(Feb 1, 2019 04:15 AM)antonio.carrillo78 Wrote: Hello guys,
I used sqlmap on a website, it's showing me the Database names but it retrieves empty data for tables names
Microsoft SQL Server 2012
DBms = mssql
WAF detected Generic Unkown
The weird part is that i tried for days on row and finally worked. It showed me the table names, colums, and even data inside the columns such as email, phone numebers, etc. But now it's not working.
The errors i got were:
- 414 uri too long
- something about unable to decode characters
It detects Generic <unknown> waf. Maybe I should use a --tamper ? Which one ?
It seems strange that it worked before and now it doesn't
I tried tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
but didn't work
Most likely privilege or waf issue. Should use verbose to see what payload is really being tested. I recommend you to do it manually first in order to understand what tamper script to use. Don't get too dependent on sqlmap, use manual bypass and you will see light. If you can't do it manually then sqlmap won't be of much use to you. And you are using too many tamper scripts which is a bad thing. Basically your payload will become junk. PM me, I'll try to help you with what I know.
RE: Sqlmap retrieves empty data. MSSQL + Generic WAF + 414 uri too long - Fr33z3 - Sep 7, 2019
first of all way to many tamper scipts try using --tamper=modsecurityzeroversioned,charencode or the modsecurity tamper with a --hex or --no-cast switch that should help you too long error and yes --random-agent