A technique I find quite useful on web applications that are weakly-typed
is manipulating the data within JSON to be more susceptible to fuzzing for
SQLi.
For instance {"id":0} can be made {"id":"0"} as long as the application
isn't caring what the type of the ID is (rails, python, perl, etc...).
Generally I do this manually, does sqlmap support this type of
manipulation? If not, would a tamper script be the solution to automating
this?
Thanks!
--
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT
organizations don't have a clear picture of how application performance
affects their revenue. With AppDynamics, you get 100% visibility into your
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349351&iu=/4140/ostg.clktrk
_______________________________________________
sqlmap-users mailing list
sqlmap-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/sqlmap-users
