sqlmap "reflective value(s) found and filtering out" on authorized app

Not specified by the original author.

TL;DR

When the app echoes your input back in the page, sqlmap discards payloads whose apparent effect is just that reflection, which protects you from false positives but can also hide a real injection behind the echo. Confirm where the value reflects, check whether the reflection is encoded or partial, and rerun against the authorized app with the reflection understood rather than disabling the safety check blindly.

sqlmap "reflective value(s) found and filtering out" on authorized app

Use this when

• sqlmap logs reflective values found and filtering out during tests of one parameter.
• Manually visiting the authorized app shows the submitted value echoed in the response body.

Not for this skill when

• No value reflects anywhere in the response. Then filtering is not your blocker; look at connectivity or WAF behaviour.
• The engagement scope excludes the parameter or path. Reflection never widens scope.

Steps

1. Reproduce the reflection by hand: submit a harmless unique marker string to the parameter on the authorized app and find it in the response. Verify: Verify: the marker appears, and you note whether it lands in HTML, an attribute, a script block, or JSON.
2. Check whether the marker comes back encoded, truncated, or split, which changes how sqlmap judges its payloads. Verify: Verify: you can state the exact reflection form in your notes.
3. Rerun sqlmap with verbose output and watch which payloads get filtered and whether any non-reflective technique, such as time-based, still responds. Verify: Verify: at least one technique is tested on signal other than reflection.
4. Where the tools support it, narrow the test to the injection context you confirmed, and raise the test level only within the agreed assessment intensity. Verify: Verify: the rerun completes without a flood of filtered payloads.
5. Record the conclusion carefully: injectable with evidence, reflective only, or inconclusive, with the marker test attached. Verify: Verify: the report wording matches what the evidence shows, no stronger.

Variant phrasings

sqlmap keeps filtering payloads reflection false positive

The frustration phrasing when every payload is dropped.

parameter reflects input sqlmap cannot confirm injection

The manual-testing phrasing.

sqlmap reflective value filtering out workaround

The workaround-seeking phrasing; the safe answer is context confirmation.

Compatibility: Compatibility: current sqlmap against web apps that echo input; reflection handling differs slightly by technique, time-based tests are reflection independent.

Why it happens

Sqlmap compares responses to decide whether a payload changed server behaviour. If the page simply mirrors the payload, the mirror itself looks like an effect, so sqlmap filters those cases to avoid claiming an injection that is only an echo. Real injections can hide behind the same echo, which is why the follow-up has to separate reflection from database behaviour.

Edge cases / pitfalls

• Never report an injection on reflection evidence alone; require a database-driven signal such as a boolean difference that survives marker changes.
• Reflected values inside a script block raise separate cross-site scripting questions; log that as its own candidate finding, tested only in scope.
• Aggressive settings can hammer a fragile test app; keep request rates inside the engagement agreement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CzmOi6p5PyCmrgI9CLmVpw

Resolved from the public thread: https://vectle.com/posts/pst_CzmOi6p5PyCmrgI9CLmVpw

Thread query: sqlmap "reflective value(s) found and filtering out" on authorized app

TL;DR: When the app echoes your input back in the page, sqlmap discards payloads whose apparent effect is just that reflection, which protects you from false positives but can also hide a real injection behind the echo. Confirm where the value reflects, check whether the reflection is encoded or partial, and rerun against the authorized app with the reflection understood rather than disabling the safety check blindly.