Re: [sqlmap-users] bug: -g with -p fails

[Bernardo D. A. G. <ber...@gm...>]

Fixed and committed, thanks for reporting.

Cheers,
Bernardo


On Mon, Mar 15, 2010 at 10:15, Kasper Føns <th...@ma...> wrote:
> Hello sqlmap users.
>
> It seems that sqlmap is not too happy with google-dorks results.
>
> This is self explainatory I think:
> C:\Users\foens\Desktop\sqlmap>sqlmap.py -g "inurl:php?id" -p id
>
>     sqlmap/0.8 - automatic SQL injection and database takeover tool
>     http://sqlmap.sourceforge.net
>
> [*] starting at: 11:10:00
>
> [11:10:00] [INFO] first request to Google to get the session cookie
> [11:10:00] [INFO] using Google result page #1
> [11:10:01] [INFO] sqlmap got 100 results for your Google dork
> expression, 95 of them are testable targets
> [11:10:01] [INFO] sqlmap got a total of 95 targets
> url 1:
> GET http://www.axiotron.com/index.php?id=modbook
> do you want to test this url? [Y/n/q]
>  > y
> [11:10:04] [INFO] testing url http://www.axiotron.com/index.php?id=modbook
> [11:10:04] [ERROR] all testable parameters you provided are not present
> within the GET, POST and Cookie parameters
>
> [*] shutting down at: 11:10:04
>
> It does not seem it is able to see that the id parameter is found in the
> GET request.
>
> This also seems to be the result of:
> C:\Users\foens\Desktop\sqlmap>sqlmap.py -g "inurl:php?id"
>
>     sqlmap/0.8 - automatic SQL injection and database takeover tool
>     http://sqlmap.sourceforge.net
>
> [*] starting at: 11:12:32
>
> [11:12:32] [INFO] first request to Google to get the session cookie
> [11:12:32] [INFO] using Google result page #1
> [11:12:33] [INFO] sqlmap got 100 results for your Google dork
> expression, 95 of them are testable targets
> [11:12:33] [INFO] sqlmap got a total of 95 targets
> url 1:
> GET http://www.axiotron.com/index.php?id=modbook
> do you want to test this url? [Y/n/q]
>  > y
> [11:12:37] [INFO] testing url http://www.axiotron.com/index.php?id=modbook
> [11:12:37] [INFO] using
> 'C:\Users\foens\Desktop\sqlmap\output\www.axiotron.com\session' as
> session file
> [11:12:37] [INFO] testing connection to the target url
> [11:12:38] [INFO] testing if the url is stable, wait a few seconds
> [11:12:41] [INFO] url is stable
> [11:12:41] [INFO] testing if Cookie parameter 'fe_typo_user' is dynamic
> [11:12:42] [WARNING] Cookie parameter 'fe_typo_user' is not dynamic
> [11:12:42] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
> [11:12:44] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
> url 2:
> GET http://www.llgc.org.uk/index.php?id=2
> do you want to test this url? [Y/n/q]
>  > q
>
> [*] shutting down at: 11:12:56
>
>
> C:\Users\foens\Desktop\sqlmap>
>
> Why is the GET parameter id not checked here?
>
> I am using latest svn version.
>
> /Kasper
>
> ------------------------------------------------------------------------------
> Download Intel&#174; Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F