[antonio.carrillo78]

Hello guys,

I used sqlmap on a website, it's showing me the Database names but it retrieves empty data for tables names

Microsoft SQL Server 2012
DBms = mssql
WAF detected Generic Unkown

The weird part is that i tried for days on row and finally worked. It showed me the table names, colums, and even data inside the columns such as email, phone numebers, etc. But now it's not working.

The errors i got were:
- 414 uri too long
- something about unable to decode characters

It detects Generic <unknown> waf. Maybe I should use a --tamper ? Which one ?

---

It seems strange that it worked before and now it doesn't

---

I tried tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

but didn't work

[Girl With One BallSack]

i can help you look in your private inbox!

[smtp.hu]

--random-agent will be help you

[Kalikou]

i can help you look in your private inbox!

I have the same problem, can you help me

[whitedragonflyer]

Hello guys,

I used sqlmap on a website, it's showing me the Database names but it retrieves empty data for tables names

Microsoft SQL Server 2012
DBms = mssql
WAF detected Generic Unkown

The weird part is that i tried for days on row and finally worked. It showed me the table names, colums, and even data inside the columns such as email, phone numebers, etc. But now it's not working.

The errors i got were:
- 414 uri too long
- something about unable to decode characters

It detects Generic <unknown> waf. Maybe I should use a --tamper ? Which one ?

---

It seems strange that it worked before and now it doesn't

---

I tried tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

but didn't work

Most likely privilege or waf issue. Should use verbose to see what payload is really being tested. I recommend you to do it manually first in order to understand what tamper script to use. Don't get too dependent on sqlmap, use manual bypass and you will see light. If you can't do it manually then sqlmap won't be of much use to you. And you are using too many tamper scripts which is a bad thing. Basically your payload will become junk. PM me, I'll try to help you with what I know.

[Fr33z3]

first of all way to many tamper scipts try using --tamper=modsecurityzeroversioned,charencode or the modsecurity tamper with a --hex or --no-cast switch that should help you too long error and yes --random-agent