+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: SQLMAP-Gettin Blocked (/showthread.php?tid=6111896)
SQLMAP-Gettin Blocked - cloudz4me - Sep 26, 2020
any suggestion not getting blocked again?
sqlmap.py -u "http://website.com" --no-cast --batch --level 5 --risk 3 --technique E --dbs -risk 3 -level 5 -tamper space2comment,randomcase,between -drop-set-cookie
https://prnt.sc/uolhph
RE: SQLMAP-Gettin Blocked - INBA - Sep 26, 2020
install and use it with --tor , probable the IP get blocked
RE: SQLMAP-Gettin Blocked - cloudz4me - Sep 27, 2020
(Sep 26, 2020 11:59 PM)INBA Wrote: install and use it with --tor , probable the IP get blocked
ok thanks but theirs another problem a captcha before login.
RE: SQLMAP-Gettin Blocked - INBA - Sep 27, 2020
try optain the host real IP with different methode and put in sqlmap the direct link (with the IP)
RE: SQLMAP-Gettin Blocked - SUDOCODES - Sep 27, 2020
you will most likely get a captcha if you use a service like tor because all tor exist nodes are know.
Rather use socks proxy or a VPN, you have better chances of it not asking for a captcha.
RE: SQLMAP-Gettin Blocked - cloudz4me - Sep 27, 2020
(Sep 27, 2020 09:08 AM)SUDOCODES Wrote: you will most likely get a captcha if you use a service like tor because all tor exist nodes are know.
Rather use socks proxy or a VPN, you have better chances of it not asking for a captcha.
captcha makes this difficult it wont intercept even burpsuite.
http://prntscr.com/uot5qy
anyone how to bypass this captcha?
RE: SQLMAP-Gettin Blocked - linkinpork - Oct 6, 2020
(Sep 26, 2020 10:24 PM)cloudz4me Wrote: any suggestion not getting blocked again?
Hope I'm not too late for the party.
You need to make your requests as normal as possible. Start with a "normal" user agent like Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/79.0, then make sure your requests are delayed in such a way that you seem like you're just browsing the website normally.
The --risk argument also sends more "abnormal" requests, and in my experience ends up giving me more false positives.
Finally in my work it's very rare I find an SQLi vector in the URL. Best you intercept and inject in the POST data.
Have fun.
RE: SQLMAP-Gettin Blocked - cloudz4me - Oct 6, 2020
(Oct 6, 2020 12:36 AM)linkinpork Wrote: Hope I'm not too late for the party.
You need to make your requests as normal as possible. Start with a "normal" user agent like Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/79.0, then make sure your requests are delayed in such a way that you seem like you're just browsing the website normally.
The --risk argument also sends more "abnormal" requests, and in my experience ends up giving me more false positives.
Finally in my work it's very rare I find an SQLi vector in the URL. Best you intercept and inject in the POST data.
Have fun.
thanks sent you some pm
RE: SQLMAP-Gettin Blocked - niqscann - Oct 11, 2020
i think nothing to do with that.
catchpa bypass is hard.
i even tried with browser than copied made a file to work with sqlmap , exactly same infos as browser and again catchpa appeared