{"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1166","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1166/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1166/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1166/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/1166","id":58031499,"number":1166,"title":"Difficulty exploiting sql injection found in path fragment (suffix.html) -","user":{"login":"Snipercatz","id":8577656,"avatar_url":"https://avatars.githubusercontent.com/u/8577656?v=3","gravatar_id":"","url":"https://api.github.com/users/Snipercatz","html_url":"https://github.com/Snipercatz","followers_url":"https://api.github.com/users/Snipercatz/followers","following_url":"https://api.github.com/users/Snipercatz/following{/other_user}","gists_url":"https://api.github.com/users/Snipercatz/gists{/gist_id}","starred_url":"https://api.github.com/users/Snipercatz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Snipercatz/subscriptions","organizations_url":"https://api.github.com/users/Snipercatz/orgs","repos_url":"https://api.github.com/users/Snipercatz/repos","events_url":"https://api.github.com/users/Snipercatz/events{/privacy}","received_events_url":"https://api.github.com/users/Snipercatz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-18T06:14:29Z","updated_at":"2015-02-18T12:15:17Z","closed_at":null,"body":"I am unable to exploit a sql vulnerability found in a path fragment (suffix.html) -\r\n\r\nHere is my HTTP Request:\r\nGET /hunts/10-1*.html HTTP/1.1\r\nReferer: https://www.target.com:443/\r\nCookie: PHPSESSID=69n8o52arlt60mf9apiusbbl04\r\nHost: www.target.com\r\nConnection: Keep-alive\r\nAccept-Encoding: gzip,deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36\r\nAccept: */*\r\n\r\nHTML Response: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\"'' at line 1\r\nSQL:\r\nselect * from `mwb_posts` where `urlslug`='10-1'\"'\r\n\r\nWhen executing on sqlmap I've received some interesting results regarding the DBMS.  Sqlmap had identified the DBMS as MySql on one scan, and Firebird on the next.  Regardless, it was unable to successfully exploit the vulnerability.  I ran sqlmap using --level 5 --risk 3.  I've purged the output and ran again but am still unsuccessful.  Sqlmap identified that a WAF might be in place, and prompted sqlmap to identify it but am assuming one wasn't found; sqlmap didn't give me any results about it.  I tried using the switch --check-waf as well but received the message that it was deprecated. Any suggestions?\r\n\r\nMy sqlmap is up to date; I am running sqlmap on Windows 8.1\r\n\r\n\r\nThx\r\n"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/74854865","html_url":"https://github.com/sqlmapproject/sqlmap/issues/1166#issuecomment-74854865","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1166","id":74854865,"user":{"login":"stamparm","id":921555,"avatar_url":"https://avatars.githubusercontent.com/u/921555?v=3","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"created_at":"2015-02-18T12:15:17Z","updated_at":"2015-02-18T12:15:17Z","body":"And what's the content of request.txt file?"}}