topic Re: sol injection in Report Server

sol injection

deep666 — Tue, 12 Dec 2017 18:34:10 GMT

I tried to exploit a vulnerability that was found with a program that find vulnerable but sqlmap says this message though it's vulnerable to be cause and how I can go over

[WARNING] The GET parameter 'query' does not seem to be injectable
[18:18:41] [CRITICAL] all tested parameters appear to be not injectable. Try to increase '-level' / '- risk' values to perform more tests. Also, you can try to rerun by providing either a valid value for option '--string' (or '--regexp'). If you suspect that there is some kind of protection mechanism involved (eg WAF), maybe you could try again with a '--tamper' option (eg '--tamper = space2comment')

Re: sol injection

markp — Wed, 13 Dec 2017 22:39:40 GMT

going from what you have posted it seem that sqlmap is telling you that the tests it ran cant find a way to inject.

Have you tried using the parameters in the logs?

Re: sol injection

deep666 — Thu, 14 Dec 2017 11:08:07 GMT

i have used parameters from the documentation and vain the parameter is vulnerable as it is found with owasp zap but can not pass those waf protectors with code can use to be able to pass for filtering