Arbitrary injection point on POST data is not working about sqlipy HOT 7 CLOSED

Hmm, I will look into it. The sqlmap API server might be encoding the data and then passing it on to sqlmap that way. I don't believe SQLiPy is encoding anything.

from sqlipy.

@riramar I've fixed this issue (not related to sqlmap's #2568) here with latest commit (sqlmapproject/sqlmap@7dbbf3e)

from sqlipy.

This issue isn't quite clear to me. Does this only occur when using sqlipy? Are you saying that sqlipy encodes the values that it sends to the sqlmapapi server? I don’t develop sqlmap itself, just the integration between Burp and sqlmap, so I can only fix issues related directly to sqlipy.

from sqlipy.

I'm not sure exactly which component is performing the URL encoding.
I'm assuming this workflow:

Burp > sqlipy > sqlmapapi > MyProxy > target

Looking to the requests on MyProxy I can see the request JSON payload with the special chars URL encoded.
If I do the exactly same scan but from command line:

Shell > sqlmap > MyProxy > target

From MyProxy in this case the URL encoding is not performed.

from sqlipy.

One more comment, in the workflow below without any injection point (* or %INJECT HERE%) the URL encoding is not performed.

Burp > sqlipy > sqlmapapi > MyProxy > target

from sqlipy.

I've opened an issue on sqlmap github and it seems to be fixed now. :)

from sqlipy.

Thanks a lot @stamparm !!!

from sqlipy.