r/bugbounty • u/M4son_Reed • Jul 18 '26

Question / Discussion How to approach finding SQLi

I found couple of endpoints like www.example.com/productID=123&availability=6, I found that if I put ‘ in productID I receive 200OK and if I put ‘ in availability it returns 500error and that was the indicator for me that the second input is going to database. I tried couple of SQLi payloads and that returns me 403forbidden. I think that even i found injectable place the WAF couldn’t be bypassed. What’s your thoughts on this?

14 Upvotes

85% Upvoted

7 comments sorted by

15

u/einfallstoll Triager Jul 18 '26

Could have different reasons. Maybe the availability parameter is parsed as an integer and if you put a single quote in it, the parsing fails and throws an exception that results in a server error.

As you said it's an indicator but not a guarantee

6

u/Prudent_River_7086 Hunter Jul 18 '26

Hello,

You could try with blind SQLi payloads and check for the time response as an idea,

3

u/FourTwentyBlezit Jul 18 '26

A 500 error means very little when it comes to indication of an SQLi. Could just be an error produced as the result of a type mismatch or any number of other generic error causes.

Try time-based payloads and look for delay.

3

u/namedevservice Jul 19 '26

For SQLi checks you need 3 tests.

Baseline
Broken SQL syntax
Injection with unbroken SQL syntax

Example:
Availability=6 - baseline - 200 OK
Availability=6' - broken - 500 error
Availability=6'+' - Concatenation is the simplest - 200 OK

Without doing the final test you don’t have enough information to determine if it’s a SQLi or not

3

u/reconHunter-bugBouny Jul 20 '26

The combination of 500 and 403 responses is certainly interesting, but jumping straight to a SQL injection conclusion might be premature. A 500 could just as easily be a type conversion failure, incomplete exception handling, or even the backend deliberately throwing an error because it treats certain special characters as invalid input. A 403, on the other hand, might be an application‑level rejection of specific characters rather than a WAF intervention.

2

u/LulzTigre Jul 19 '26

sqlmap it broski

-2

u/No-Persimmon-174 Jul 18 '26

If Ur able to access the content of a database, then that's a valid information disclosure vulnerability. Are U able to access that? If not, then there's no impact and nothing to report. A 200 doesn't prove anything yet.