1

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible.

Parameter: query (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: query=-8014' OR 6594=6594-- iygp&locale=en-US

The waf used by the website is KONA(akmai).Sqlmap could not retrieve any data. NOTE:-whenever i inject it.It gives back a 403 error generated by waf.

HTTP/1.1 403 Forbidden
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 294
Expires: Thu, 17 Jan 2019 12:04:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 17 Jan 2019 12:04:34 GMT
Connection: close
Cipher: ECDHE-RSA-AES256-GCM-SHA384
Source-Country: IN
Strict-Transport-Security: max-age=157680000; preload

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access "http&#58...;;" on this server.<P>
Reference&#32;&#35;18&#46;e0a21ab8&#46;1547726674&#46;14c0c2e8
</BODY>
</HTML>

so my questions are:-

1.Is it a false positive?

2.If it isnt should i not automate it and try and probe manually?

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

0

There is a potential for automated tools to provide false positives in case of blind SQL injection even if there is a slight difference in responses. This may also be the case where WAF's are involved.

I would normally consider that anyone putting their site up for a bug bounty program have done their homework and secured their site reasonably to make it resilient to automated tools. If you get even a slight indication that the site may be vulnerable through automated tools, this must be followed by manual investigation to see if the site is actually vulnerable and what will be the impact if the vulnerability can be exploited.

The following SQLi resources may be useful for further manual investigation: http://pentestmonkey.net/category/cheat-sheet/sql-injection
https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/

Also, be wary of extracting data from the database once you know the SQL injection is exploitable and may result in data extraction. If the website stored sensitive information, the site owner might not want you to exploit the vulnerability to extract any potentially sensitive data. Always good to review the terms & conditions of the Bug Bounty program before hand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.