search

sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool
http://sqlmap.org
Other
31.94k stars 5.67k forks source link

different header injection way #1383

Closed cankaptan1976 closed 8 years ago

cankaptan1976 commented 9 years ago

Hi Dear,

I just got question we can just handle the --headers injection like that but if the situation is spesific like that

Content-Type: multipart/form-data; Content-Disposition: form-data; name="tx_powermail_pi1[field][e_mail]"

sqlmap@sqlmap.com*

If the injection is there and quite large to import these post data to sqlmap what should i do ?

Can you help me with these please.. Maybe i should try to use with burp ?

Thanks

stamparm commented 9 years ago

@cankaptan1976 really not sure what you are trying to do. You are talking about header injection, while the custom injection marker (*) is placed in the POST part (there are two blank lines below the ...[field][e_mail]")

If you are asking if sqlmap can chew the large POST data and handle it "gracefully", I would say yes in most situations. But, there are always "strange" situations where sqlmap most probably fails. I really need to know the specifics of your case.

stamparm commented 9 years ago

ping?