SQLMAP injection json format data method

When the injection point is in json format data, SQLMAP may be silly, resulting in no injection point.

 

Using -p to specify parameters is not easy to specify fields in json format,

 

At this time, you need to manually modify the injected json data so that SQLMAP can find the injection parameters:

 

The json input that caused SQLMAP to be silly is similar to the following:

 

{"name":["string"]}

 

Modifying it to the following two forms can make SQLMAP find the injection point (rather than skip directly):

 

// 方式1，加*
{"name":["string*"]}    //这个是从国外论坛看到的

// 方式2，删掉中括号
{"name":"string"}