[Freshyx]

Hello,

I found an SQLi manually and tried it with sqlmapp too, however sqlmap couldn't find a vulnerability. It is mariaDB error-based, however the error is hidden in the source code.

Example:

Code

An unexpected database error occurred. Please try again later.
[b]<!--[/b] Mysqli prepare error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '''' LIMIT 1' at line 1 -->

The comment is not displayed unless you look into the source code with the browser and I don't know if sqlmap recognizes that.

The vulnerability is very easy to find because I got this error with simply putting a

Code

'

behind the GET parameter.

My sqlmap syntax:

Code

sqlmap.py -u "http://URL/product[/quote].php?value=test" --dbms="mariadb" --level=5 --risk=3

Hopefully someone can help me!

[Error22]

i think you need to use hackbar sql maunal way its help you

[kmhacker]

just post website link i am help you. sqlmap good for blind sql injection u can use maunal sql injection way use firefox browser and hackbar

[jinja69]

sqlmap is sck bro try manual