Hey Everyone, New to the list but have been using sqlmap for a while now. I recently participated in a CTF with an interesting blind, filter bypass sql injection. Lots of restrictions. I set a challenge for myself to solve it using sqlmap and managed to get it working with some effort. Of the changes I had to make to get it to work included modifications to queries.xml as well as specific arguments, but most of what I'm going to request here is about payloads.xml.
In trying to solve the challenge, I realized I needed to make sqlmap laser focus on a single test. This was both for false negative reduction, number of queries sent, and time limit. I did this myself by removing every other test from payloads.xml but it brought to mind the idea of being able to specify a test via command line arguments. You can specify pretty much everything else on the command line, so the added granularity would be nice. My philosophy on sql injection is that testing for it should be done manually, then once found, get a tool like sqlmap to work with it and perform all the time consuming brute forcing work for you. With that in mind it makes sense to be able to specify a test/payload combination that you have found and you know is working. Thanks for your consideration. Excellent work on the tool. - Yori ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ sqlmap-users mailing list sqlmap-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/sqlmap-users
