I have been trying to find SQL injection against a site in bug bounty. I tried a few parameters via SQLmap. One such query was shown to be injectible.
Parameter: query (GET) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: query=-8014' OR 6594=6594-- iygp&locale=en-US
The WAF used by the website is KONA (akamai). Sqlmap could not retrieve any data.
NOTE: whenever I inject it, it gives back a 403 error generated by the WAF.
HTTP/1.1 403 Forbidden Mime-Version: 1.0 Content-Type: text/html Content-Length: 294 Expires: Thu, 17 Jan 2019 12:04:34 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Thu, 17 Jan 2019 12:04:34 GMT Connection: close Cipher: ECDHE-RSA-AES256-GCM-SHA384 Source-Country: IN Strict-Transport-Security: max-age=157680000; preload <HTML><HEAD> <TITLE>Access Denied</TITLE> </HEAD><BODY> <H1>Access Denied</H1> You don't have permission to access "http:...;;" on this server.<P> Reference #18.e0a21ab8.1547726674.14c0c2e8 </BODY> </HTML>
So my questions are:
Is it a false positive?
If it isn't, should I not automate it and try and probe manually?