I'm currently pentesting my friends website. I found an SQL injection with acunetix' help:
- URL encoded GET input for was set to 1#####
Error message found:
supplied argument is not a valid MySQL result
So I tried running a normal sqlmap:
./sqlmap.py -u "http://www.example.com/ajax.php?div=content&for=1*&page=1&sort=4&show=1&what=topic" --threads=25
Output:
[11:16:31] [WARNING] URI parameter '#1*' is not injectable [11:16:31] [CRITICAL] all tested parameters appear to be not injectable. Try to increase '--level'/'--risk' values to perform more tests. Also, you can try to rerun by providing either a valid value for option '--string' (or '--regexp'). If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could retry with an option '--tamper' (e.g. '--tamper=space2comment')
So I need a way to include those #'s (for=1%00%c0%a7%c0%a2)
Tried --string
and --suffix
but didn't do the job. Maybe there's a tamper for this?