0

I have run sqlmap through burpsuite and to get the existing databases it ran this query

1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717671,JSON_ARRAYAGG(CONCAT_WS(0x6a716a6c6a68,schema_name)),0x7176707a71) FROM INFORMATION_SCHEMA.SCHEMATA-- -

The query sqlmap can be simplified to

1 UNION ALL SELECT NULL,NULL,schema_name FROM INFORMATION_SCHEMA.SCHEMATA-- -

Why run a more complicated query than necessary? And wouldn't the sqlmap produced query also work without the JSON_ARRAYAGG? Can someone shed some light on why sqlmap does it this way and not just asks it more directly.

1
  • What command line did you use to execute sqlmap? Is this something that I can replicate in docker, virtual machine or some testing environment? Can you run it again with -t traffic.log and share log?
    – fgeek
    May 6 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.