Re: [sqlmap-users] sqlmap error message

[Bernardo D. A. G. <ber...@gm...>]

Hi Jeroen,

On Tue, Dec 22, 2009 at 08:30, Jeroen van Beek <je...@de...> wrote:
> ...
>  File "lib\request\connect.pyc", line 197, in getPage
> UnboundLocalError: local variable 'warnMsg' referenced before assignment

This bug should be fixed on sqlmap development version on subversion repository.

> ...
> The problem might (I'm not sure) have something to do with the sessionID
> since it was expired when I checked it the next morning.

It might be, but more likely a connection issue with the application.

> I also mentioned that a number of functions is not (yet) implemented for
> Oracle databases. I used to do lots of Oracle pentests in the past and
> wrote lots of tools including support for command execution on Oracle
> (with Java enabled)

Oracle is missing the file system and takeover functionalities. It's a
bit tricky when the dbms is back-end to a web application due to
Oracle design to not handle semicolon, thus some Oracle packages can
still be abused via web application to privilege escalate, etc.

> and password crackers
> <http://www.thc.org/thc-orakelcrackert11g>
> <http://www.thc.org/thc-orakel>. Please let me know if help is
> appreciated.

I know this cracker, good work!
As I wrote in a previous email[1] to this mailing list, any help is welcome!

[1] http://sourceforge.net/mailarchive/forum.php?thr...@ma...&forum_name=sqlmap-users

Cheers,
-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F