Re: [sqlmap-users] bugs

[Bernardo D. A. G. <ber...@gm...>]

Hi James,

On Thu, Aug 20, 2009 at 02:00,  <ja...@ev...> wrote:
> ...
> sqlmap version: 0.8-dev1
> Python version: 2.4.4
> Operating system: linux2
> Traceback (most recent call last):
>   File "./sqlhax", line 84, in main
>     start()
>   File "/nfs/sqlmap/lib/controller/controller.py", line 263,
> in start
>     action()
>   File "/nfs/sqlmap/lib/controller/action.py", line 140, in
> action
>     conf.dbmsHandler.osShell()
>   File "/nfs/sqlmap/plugins/generic/takeover.py", line 300,
> in osShell
>     self.initEnv()
>   File "/nfs/sqlmap/lib/takeover/abstraction.py", line 168,
> in initEnv
>     self.xpCmdshellInit(mandatory)
>   File "/nfs/sqlmap/lib/takeover/xp_cmdshell.py", line 181,
> in xpCmdshellInit
>     self.__xpCmdshellConfigure(1)
>   File "/nfs/sqlmap/lib/takeover/xp_cmdshell.py", line 106,
> in __xpCmdshellConfigure
>     if kb.dbmsVersion[0] in ( "2005", "2008" ):
> IndexError: list index out of range

This happens because for some reason, sqlmap was not able to identify
the version of MSSQL some lines before.
You can force the dbms version if you know it with the --dbms option.
Simply provide --dbms "mssql 200X".

> Also, for anyone on the list who is actually interested check out this
> cheat sheet, its pretty awesome.
>
> http://pentestmonkey.net/blog/mysql-sql-injection-cheat-sheet/

You can also have a look on my links on
http://delicious.com/inquis/sqlinjection.

Cheers,
-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F