+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [CRITICAL] all tested parameters do not appear to be injectable (/showthread.php?tid=6114940)
[CRITICAL] all tested parameters do not appear to be injectable - Hackware Wright - Oct 10, 2020
I cannot POST anything here! due to post limitation.
I have posted a thread on GITHUB which contains my complete problem I tried to paste that here but I just can't do it here..I have all kinds of links and screenshots that'll fully explain my issue .
After successfully creating Interception through Burp Suite I copied 'Request' to /tmp/user.request file
I have executed this -
sqlmap -r /tmp/user.request --dbs --banner --tamper=apostrophemask,apostrophenullencode --level=5 --risk=3
Everytime I execute this SQLMAP Injection whether it is by using "-r" or "-u" It keeps telling me false information , Sometimes it says the backend Database is PostgreSQL and sometimes it says it is MySQL . It even prompts me and asks me to decide that which one of those databses would be in that website. But the matter is that, I want it to tell me what kind of databses are their in that web app
So, Basically I am trying to implement SQLMAP injection on a web application but everytime I do it ...
It just tells me that
[WARNING] parameter '(parametername)' does not seem to be injectable.
TARGET INFORMATION :
POST / HTTP/1.1
Host: website name
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
...
...
...
Cookie: ASP.NET_SessionId=52c2u1vbvlgr5erosxknimil
Upgrade-Insecure-Requests: 1
Lemme know if anyone needs more information ...I can't explain in detail here because of post limitation.
RE: [CRITICAL] all tested parameters do not appear to be injectable - 3xploit - Oct 10, 2020
(Oct 10, 2020 06:58 AM)Hackware Wright Wrote: I cannot POST anything here! due to post limitation.
I have posted a thread on GITHUB which contains my complete problem I tried to paste that here but I just can't do it here..
So, Basically I am trying to implement SQLMAP on a web application but everytime I do it ..
It just tells me that
[WARNING] parameter '(parametername)' does not seem to be injectable.
That means that the target is not vulnerable to SQL injection.
RE: [CRITICAL] all tested parameters do not appear to be injectable - Hackware Wright - Oct 10, 2020
(Oct 10, 2020 07:05 AM)$moke Wrote: That means that the target is not vulnerable to SQL injection.
Yeah I think too! But when I was implementing burp suite and it is giving me all kinds of session ID's and cookie values..! Does that still mean that it's not vulnerable to SQL Injection
RE: [CRITICAL] all tested parameters do not appear to be injectable - NeverMore - Oct 10, 2020
(Oct 10, 2020 07:08 AM)Hackware Wright Wrote: Yeah I think too! But when I was implementing burp suite and it is giving me all kinds of session ID's and cookie values..! Does that still mean that it's not vulnerable to SQL Injection
scanners often give a false-positive result , so to make sure that its vulnerable or not , you need to made a manual tests like
put ' or " or \ and see if there is a change on page or not .
and do test for blind types too like in this article
https://owasp.org/www-community/attacks/SQL_Injection
RE: [CRITICAL] all tested parameters do not appear to be injectable - Hackware Wright - Oct 11, 2020
(Oct 10, 2020 04:14 PM)invo12 Wrote: scanners often give a false-positive result , so to make sure that its vulnerable or not , you need to made a manual tests like
put ' or " or \ and see if there is a change on page or not .
and do test for blind types too like in this article
OKAY ! Thanks I'll try that