client9 / client9/libinjection

MSSQL non-ascii code in SQL

Open
#101 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
1k
Forks
282
PR merge metrics
No merged PRs in 30d

Description

Hey Nick,

From recent Sqlmap test, saw lots of Url-encoded payloads contains non-printable Ascii code(%05, %09...).
If I convert those non-printable code all to space(%20), libinjection detects them correctly.
Would you please share insight on: if these Sqlmap generated payloads aforesaid valid MSSQL attack?
If so, how can I address them using Libinjection. Thank you.

Example: t%27%06WHERE%082322%3D2322%05AND%092403%3D2112

Jzy

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.