I have target after manual testing, I have found the target response to sleep time but the response after 3 multiply the number I put.
for example
when I put the payload:
'select (sleep (1))'
the read response will be 3
when i put the payload:
'select (sleep (2))'
the read response will be 6
what is the option for that in sqlmap ?
i want sqlmap to automated that
Related
What is a good way to save / write / log (request, response) pairs on both ends (client-facing, server-facing) of mitmproxy? That is, all 4 of:
c->p: original request from the client
p->c: final response to the client, possibly rewritten by the proxy
p->s: request forwarded to the server and possibly rewritten by the proxy
s->p: original response from the server
c->p p->s
original forwarded rewritten
request request
---------------------> -------------->
client proxy server
<--------------------- <--------------
p->c s->p
forwarded rewritten original
response response
As far as I can see, the -w flag (of mitmdump) only saves single (request, response) pairs, so either the original or the forwarded request / response are not saved (and possibly neither of those, only some intermediate stage, before / after other addons that modify request / response).
Thanks for help.
I've got a working local website that takes in HTML form data.
The fields are:
Temperature
Humidity
The server successfully receives the data and spits out a graph updated with the new entries.
Using a browser tool, I was able to capture the actual POST request as follows:
http://127.0.0.1:5000/add_data
Temperature=25.4&Humidity=52.2
Content-Length:30
Now, I want to migrate from using the human interface browser with manual entries to an ESP01 device using AT commands.
According to the ESP AT-commands documentation, a POST request is performed using the following command:
AT+HTTPCPOST=
Find the link below for the full description of the command.
I cannot seem to get this POST request working. The ESP01 device immediately returns an "ERROR" message without any delay, as though it did not even try to send the request, that the syntax might be wrong.
Among many variations, the following is my best attempt:
AT+HTTPCPOST="http://MYIPADDR:5000/add_data",30,2,"Temperature: 25.4","Humidity: 52.2"
With MYIPADDR above replaced with my IP address.
How do I translate a post request into ESP01 AT command format, and are there any prerequisites needed to be in place to perform such a request?
I did connect the ESP01 device to the WiFi network.
Here's the link to the POST AT command description:
https://docs.espressif.com/projects/esp-at/en/release-v2.2.0.0_esp8266/AT_Command_Set/HTTP_AT_Commands.html#cmd-httpcpost
The documentation says:
AT+HTTPCPOST=url,length[,<http_req_header_cnt>][,<http_req_header>..<http_req_header>]
Response:
OK
The symbol > indicates that AT is ready for receiving serial data, and you can enter the data now. When the requirement of message length
determined by the parameter is met, the transmission starts.
...
Parameters
: HTTP URL. : HTTP data length to POST. The maximum
length is equal to the system allocable heap size.
<http_req_header_cnt>: the number of <http_req_header> parameters.
[<http_req_header>]: you can send more than one request header to the
server.
You're sending:
AT+HTTPCPOST="http://MYIPADDR:5000/add_data",30,2,"Temperature: 25.4","Humidity: 52.2"
The length is 30. The problem is that everything after the length is HTTP header fields; you need to send the variables in the body. So the command is:
AT+HTTPCPOST="http://MYIPADDR:5000/add_data",30
followed on the next line by after the ESP-01 send the > character:
Temperature=25.4&Humidity=52.2
Because you passed 30 as the body length, the ESP-01 will read exactly 30 characters after the end of the AT command and send that data as the post body. If the size of that data changes (for instance, maybe the temperature is 2.2, so one digit less), you'll need to send the new length rather than 30.
I see multiple tutorials about Postman/Newman test scripts, however they mostly looks like single requests.
What is the best way to chain Postman test request based on previous results, so eg:
PUT upload request
Test for e.g. status code. If 200, do POST start-processing the just uploaded file, else stop
If 200, then do GET to query
If 200, check JSON against fixed expected JSON output.
Newman seems to run an entire collection independently. I only want to run request 1, which then fires request 2 and request 3 based on output of previous request in that same collection.
You can configure this in the Tests section in Postman by using
if (condition) {
postman.setNextRequest("NAME OF YOUR REQUEST")
}
I am passing the request as in my feature file and i am trying to do assert from request to response.
I have tried must contains queries but i am not sure if i am doing it correct, could you please help.
**Background:**
* configure headers = read('classpath:merchantServiceheaders.js')
Given url MservUrl
And path '/spapis/rest/sp-ms-engine/sp/ms/v1/engine/scanandredact'
Scenario Outline: ACH Low Value Payment Rips Services Summary
]
}***
What i would like to do is assert what i have in my request to what i will get back in response.
Since i am passing subject in request the same subject should be present in response
Possible in 0.9.3: https://github.com/intuit/karate#scenario-outline-enhancements
First change the Examples: column header to data!
And request data
When method post
Then status 200
And match response contains data
In 0.9.2 and earlier, with the Examples: column header as data
* def data = <data>
And request data
When method post
Then status 200
And match response contains data
Is it possible to make a batch request with one (or more) of the batched requests using field expansion?
For instance, say I'd like information about me, my listen data. These are the three batch requests I wrap up:
{'method': 'GET', 'relative_url': 'me'}
{'method': 'GET', 'relative_url': 'me/music.listens'}
{'method': 'GET', 'relative_url': 'me/friends?fields=name,first_name,last_name,music.listens.limit(1)'}
But when I make the batch request, the first two responses come back with the data I expect and the third response comes back with data in this format (not the data I requested):
{'access_token': '<access token here>'}
I read all about batch requests here:
https://developers.facebook.com/docs/graph-api/making-multiple-requests/
and about field expansions here:
https://developers.facebook.com/docs/graph-api/using-graph-api/
Am I missing something?
You could even combine this into one query:
/me?fields=name,first_name,last_name,music.listens,friends.fields(name,first_name,last_name,music.listens.limit(1))
I noticed that you have a surplus "u" in your request definition
{'method': 'GET', 'relative_url': u'me'}
maybe you should fix this. Anyway, as I said, you dont need the Batch API to combine the requests.