{"action":"closed","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2096","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2096/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2096/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2096/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/2096","id":170809956,"number":2096,"title":"Using SQLMap on Cloudflare protected site with known exploitable query?","user":{"login":"boynedmaster","id":3190756,"avatar_url":"https://avatars.githubusercontent.com/u/3190756?v=3","gravatar_id":"","url":"https://api.github.com/users/boynedmaster","html_url":"https://github.com/boynedmaster","followers_url":"https://api.github.com/users/boynedmaster/followers","following_url":"https://api.github.com/users/boynedmaster/following{/other_user}","gists_url":"https://api.github.com/users/boynedmaster/gists{/gist_id}","starred_url":"https://api.github.com/users/boynedmaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boynedmaster/subscriptions","organizations_url":"https://api.github.com/users/boynedmaster/orgs","repos_url":"https://api.github.com/users/boynedmaster/repos","events_url":"https://api.github.com/users/boynedmaster/events{/privacy}","received_events_url":"https://api.github.com/users/boynedmaster/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-12T06:54:46Z","updated_at":"2016-08-12T07:00:51Z","closed_at":"2016-08-12T07:00:51Z","body":"I have no idea how to title this.\r\n\r\nOn a Cloudflare protected site, I found a blind SQL injection by running this:\r\n\r\n`?ID=27%27%20and%20SLEEP(10)--+`\r\n\r\nThis makes the site stall for 10 seconds, and doesn't give an error. I know for a fact the targeted URL can be exploited by a time based SQL injection.\r\n\r\nHowever, this would be a pain in the ass to do manually to do the sort of things SQLMap does (like grab entries with time based blinds).\r\n\r\nI can't run SQLMap with it because Cloudflare 403s. Is there any way I can tell SQLMap about this vulnerability and have it do its magic without tripping Cloudflare?"}}
{"actor":{"display_login":"stamparm"}}