Closed Gill1000 closed 2 months ago
you should definitely run everything with -v 5
OR -t traffic.txt
and inspect the server's responses. if you are expecting error-based SQLi, then you should get more than informative messages from the server if you try to send these kind of payloads
Need more payloads or how to add custom paylaods in xml files, I tried to add payload from ghauri https://github.com/r0oth3x49/ghauri/blob/main/ghauri/common/payloads.py
To be specific i m trying to solve burp Lab: Visible error-based SQL injection with Sqlmap, In all previous labs sqlmap did found injection successful, but not in this one, I m using --technique=E and --dbms=postgresql to save time. this was my original command
sqlmap -u "https://0a7a0024036043e082c59c7700cc0059.web-security-academy.net:443/filter?category=Pets" --cookie="TrackingId=VK0rw53WAfJ3M493; session=NzzWUBD47aOlV5WZllNOzeJmo8kHcVq7" --random-agent --ignore-code=400,401,403,500 -p "TrackingId" --threads 2 --dbs --batch --dbms=postgresql --technique=E
I even tried with Error based payload for Postgresql from ghauri (from line 1611-1653) by converting into xml format (did took some help from chatgpt but still thinks its something wrong). here is xml:
long story short, how to add effective payloads in xml's file I also did checked closed issues to get more info but coudnt found!! while creating custom payload xml, i did checked sqlmap xml's file for payload writing format
let me know if i m doing something wrong.
Thankyou in Advance!! @stamparm