[Hackware Wright]

I cannot POST anything here! due to post limitation.

I have posted a thread on GITHUB which contains my complete problem I tried to paste that here but I just can't do it here..I have all kinds of links and screenshots that'll fully explain my issue .

After successfully creating Interception through Burp Suite I copied 'Request' to /tmp/user.request file

I have executed this -

sqlmap -r /tmp/user.request --dbs --banner --tamper=apostrophemask,apostrophenullencode --level=5 --risk=3

Everytime I execute this SQLMAP Injection whether it is by using "-r" or "-u" It keeps telling me false information , Sometimes it says the backend Database is PostgreSQL and sometimes it says it is MySQL . It even prompts me and asks me to decide that which one of those databses would be in that website. But the matter is that, I want it to tell me what kind of databses are their in that web app

So, Basically I am trying to implement SQLMAP injection on a web application but everytime I do it ...

It just tells me that
[WARNING] parameter '(parametername)' does not seem to be injectable.

TARGET INFORMATION :
POST / HTTP/1.1
Host: website name
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
...
...
...
Cookie: ASP.NET_SessionId=52c2u1vbvlgr5erosxknimil
Upgrade-Insecure-Requests: 1


Lemme know if anyone needs more information ...I can't explain in detail here because of post limitation.

[3xploit]

I cannot POST anything here! due to post limitation.

I have posted a thread on GITHUB which contains my complete problem I tried to paste that here but I just can't do it here..

So, Basically I am trying to implement SQLMAP on a web application but everytime I do it ..
It just tells me that

[WARNING] parameter '(parametername)' does not seem to be injectable.

That means that the target is not vulnerable to SQL injection.

[Hackware Wright]

That means that the target is not vulnerable to SQL injection.

Yeah I think too! But when I was implementing burp suite and it is giving me all kinds of session ID's and cookie values..! Does that still mean that it's not vulnerable to SQL Injection

[NeverMore]

Yeah I think too! But when I was implementing burp suite and it is giving me all kinds of session ID's and cookie values..! Does that still mean that it's not vulnerable to SQL Injection

scanners often give a false-positive result , so to make sure that its vulnerable or not , you need to made a manual tests like
put ' or " or \ and see if there is a change on page or not .
and do test for blind types too like in this article

https://owasp.org/www-community/attacks/SQL_Injection

[Hackware Wright]

scanners often give a false-positive result , so to make sure that its vulnerable or not , you need to made a manual tests like
put ' or " or \ and see if there is a change on page or not .
and do test for blind types too like in this article

OKAY ! Thanks I'll try that