Re: [sqlmap-users] Basic injection not working... Help.

[Bernardo D. A. G. <ber...@gm...>]

Hi Tristan,

First of all, are you allowed to test that url? If you are, could you
please try manually be injecting AND 3=3 to the news_id parameter
first and AND 3=4 later and see if the result is as expected.

During the detection phase, sqlmap tries to identify injectable
parameters only via AND, never via OR, for a few reasons highlighted
some months back on this mailing list. This is the reason why, for the
moment, sqlmap does not detect zone_id as an injectable parameter.

Also, try to provide to sqlmap a string (--string option) or a regular
expression (Python compliant) to match on, refer to the user's manual
for details.

Cheers,
Bernardo


On Thu, Sep 17, 2009 at 17:04, Tristan Foureur
<tri...@gm...> wrote:
> ...
> It says that both news_id and zone_id aren't injectables ! I tried using the
> -p parameter like that : -p zone_id but it doesn't change anything.
>
> I don't think that sqlmap can't detect such basic injections, so could you
> tell me what is the proper parameters to detect something simple like that,
> and then how to exploit it ?

-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F