Re: [sqlmap-users] Fwd: A simple injection case failing

2013-06-10 Thread Miroslav Stampar
Hi again. Now I've understood what you are trying to point out. Could you please tell how do you expect sqlmap to help you here? Input/output trimming is a death to automatization. Kind regards, Miroslav Stampar On Mon, Jun 10, 2013 at 11:07 PM, Stephen Shkardoon wrote: > Hi, > > I understand

Re: [sqlmap-users] Fwd: A simple injection case failing

2013-06-10 Thread Stephen Shkardoon
Hi, I understand why those examples made it seem like the *output* was being trimmed, I am quite sure that is not the case. To demonstrate once again, consider the input to parameter one: -4230' UNION SELECT NULL,2,':jug:KleqKYCxqt:hor:' -- The output of this input is: [{"id":2,"title":":jug:Kle

Re: [sqlmap-users] Fwd: A simple injection case failing

2013-06-10 Thread Miroslav Stampar
Hi. At start I'll repeat that if you look into a traffic file you'll see that you are getting trimmed output: :jug:KleqKYCxq instead of expected: :jug:KleqKYCxqt*:hor:* If you combine that with your last message you could come to the conclusion that output could be trimmed based on non-alphanum

[sqlmap-users] Fwd: A simple injection case failing

2013-06-10 Thread Stephen Shkardoon
Hi, Sorry, I think I was unclear in the last email. I'll try explain it more clearly. The result isn't being trimmed to 14 characters, instead, the input parameter is being trimmed (and for some reason internally, the SQL is still being constructed to be valid. This is a blackbox test so I'm not