reflective value(s) found and filtering out

[Illuminati00]

What means that?
Can i prevent this with any command?
--hex dont change thar error.

Screenshot: http://archiv.so/images/2013/02/04/cPWrs.png

[stamparm]

It means that there are "reflective" values inside the response containing (parts of) payload. This is very bad is some cases (especially in boolean-based injections). Thus the warning.

In your case that's not the issue (pretty sure). You'll need to either try with --hex or inspect what's going on inside the traffic file (e.g. -t traffic.txt)

[pan-long]

Hi I saw the same warning. Can you please point me to more details about why "reflective" values are bad?

[stamparm]

Imagine a page which is static, except with small part where it echoes/reflects the tested parameter value (same one where the sqlmap performs injection). In case that such "reflective" content is not detected and neutralized there is a considerable chance that response will appear as changing due to used SQLi payloads (e.g. AND 2>3). Hence, risk of false-positive (or false-negative in some cases) detection arises.

So, to sharpen the detection capabilities such reflective "junk" is removed.

p.s. Trivia: lots of detection engines are really bad at detection in such cases, except sqlmap

[pan-long]

@stamparm I see, thanks for the clear explanation!