I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection.

I use the classic:

sqlmap -u site.com/ --tor --check-tor --tor-port=9050 --tor-type=SOCKS5 --user-agent="Googlebot (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" --dbms=MySQL --dbs

In this cases I don't have a parameter like id=1, I only have a site with SQL errors but not parameters in the link

But returns me:

all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests. Please retry with the switch '--text-only' (along with --technique=BU) as this case looks like a perfect candidate (low textual content along with inability of comparison engine to detect at least one dynamic parameter). As heuristic test turned out positive you are strongly advised to continue on with the tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment')

Then, I use the same but with --no-text and --technique=BU like the error says, but nothing happened.

How do I have to use sqlmap in this case?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.