I have this payload: AND SELECT SUBSTR(table_name,1,1) FROM information_schema.tables > 'A'

but a WAF restricts table_name and information_schema keywords and gives a not acceptable message.

Is there is a way to get around this and retrieve table names?

note : already tried table name bruteforcing.

  • Maybe you could try some of the WAF bypass features in SQLmap? Commented Mar 22 at 21:33
  • @multithr3at3d none of them works
    – ben39
    Commented Mar 23 at 12:16


You must log in to answer this question.

Browse other questions tagged .