Re: [sqlmap-users] Sqlmap - Injection String

[Bernardo D. A. G. <ber...@gm...>]

Hi Kerem,

On Tue, Dec 22, 2009 at 19:40, Kerem Gunes <ker...@gm...> wrote:
> ...
> my valid injection: http:// www.thesite.com/page.asp?p1=string)') union
> select 1,name COLLATE Latin1_General_CI_AS,3,4,5,6,7 from dbo.sysobjects --
> ...

sqlmap tests for boolean-based blind SQL injection in the detection
phase. If, for any reason, the parameter is affected only by UNION
based SQL injection then sqlmap will not detect it and you won't be
able to use the tool any further. This is a design weakness in sqlmap.
In the mid term I will rewrite from scratch the detection engine[1].

[1] http://sourceforge.net/mailarchive/forum.php?thread_name=ffa...@ma...&forum_name=sqlmap-users

Cheers,
-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F