I was pentesting a website when I discovered that the URL included the
id parameter. Because of this, I knew that the
id parameter might be vulnerable to SQLi. I received a
200 response and found no sign that the injection was successful after I sent the following request to the server:
Example.com/php?id=-15 /*!u%6eion*/ /*!se%6cect*/ 1,2,3,
After fighting with this website and WAF for about an hour, I noticed the website was continuing to respond with a
200 to every single request. I also tried running
sqlmap, but the WAF blocked my connection.
So how can I know if this website is vulnerable to SQLi or not?
Can anyone please help me understand why my injection attempt was unsuccessful?