The soap body is like blow :
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<actions xmlns="http://....com">
<data>
{"name":"test","age" : "10"}
</data>
</actions>
</soap:Body>
</soap:Envelope>
How can I inject via parameter like name or age using sqlmap?
If not, can I use HttpRequest(in Java) or something like that to do what sqlmap do ?
First,By intercepting the HTTP request with a proxy, then add * with the value, finaly it maybe like this
Save the whole HTTP request to a text file(test.txt in my following example) ,try sqlmap -r test.txt