[sqlmap-users] SQLMAP question
Brought to you by:
inquisb
Menu
▾
▴
[sqlmap-users] SQLMAP question
|
From: Mat L. <map...@ho...> - 2010-08-18 15:42:16
|
My colleague were looking to use SQLMAP to test against SQLInjection in a few of our in house intranet pages. Before the testing we decided to setup a basic ASP.NET page to use SQLMAP against to get a better understanding of the product. We setup a very simple page that takes in a parameter named ID in the query string. The page will then extract the query string parameter ID and then build a dynamic SQL statement ("SELECT * FROM books where bookID = '" + IDparameter + "'") to run to retrieve the book that matches the given ID. The results are then bound to a gridview control on the page. If no books are found that match the given ID or an error occurs in the retrieval of the book the gridview is simply bound to null. The page is very simple and seems to work as we expected. The problem is we cannot get SQLMAP to identify that there is a SQLInjection vulnerability with the ID parameter. Here is what we are sending sqlmap -u "http://localhost/sqltesting/booktesting.aspx?id=1". When sending this command SQLMAP does not find the vulnerability. Below is the output of the above command. Just wondering if anyone can help us understand why SQLMAP is not locating the vulnerability. Any help would be greatly appreciated.
Thanks
Matt
[11:22:46] [INFO] testing connection to the target url
[11:22:46] [INFO] testing if the url is stable, wait a few seconds
[11:22:47] [INFO] url is stable
[11:22:47] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
[11:22:47] [INFO] testing unescaped numeric injection on GET parameter 'id'
[11:22:47] [INFO] GET parameter 'id' is not unescaped numeric injectable
[11:22:47] [INFO] testing single quoted string injection on GET parameter 'id'
[11:22:47] [INFO] confirming single quoted string injection on GET parameter 'id
'
[11:22:47] [INFO] GET parameter 'id' is not single quoted string injectable
[11:22:47] [INFO] testing LIKE single quoted string injection on GET parameter '
id'
[11:22:47] [INFO] confirming LIKE single quoted string injection on GET paramete
r 'id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE single quoted string injectable
[11:22:48] [INFO] testing double quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not double quoted string injectable
[11:22:48] [INFO] testing LIKE double quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE double quoted string injectable
[11:22:48] [INFO] GET parameter 'id' is not injectable with 0 parenthesis
[11:22:48] [INFO] testing sql injection on GET parameter 'id' with 1 parenthesis
[11:22:48] [INFO] testing unescaped numeric injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not unescaped numeric injectable
[11:22:48] [INFO] testing single quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not single quoted string injectable
[11:22:48] [INFO] testing LIKE single quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE single quoted string injectable
[11:22:48] [INFO] testing double quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not double quoted string injectable
[11:22:48] [INFO] testing LIKE double quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE double quoted string injectable
[11:22:48] [INFO] GET parameter 'id' is not injectable with 1 parenthesis
[11:22:48] [INFO] testing sql injection on GET parameter 'id' with 2 parenthesis
[11:22:48] [INFO] testing unescaped numeric injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not unescaped numeric injectable
[11:22:48] [INFO] testing single quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not single quoted string injectable
[11:22:48] [INFO] testing LIKE single quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE single quoted string injectable
[11:22:48] [INFO] testing double quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not double quoted string injectable
[11:22:48] [INFO] testing LIKE double quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE double quoted string injectable
[11:22:48] [INFO] GET parameter 'id' is not injectable with 2 parenthesis
[11:22:48] [INFO] testing sql injection on GET parameter 'id' with 3 parenthesis
[11:22:48] [INFO] testing unescaped numeric injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not unescaped numeric injectable
[11:22:48] [INFO] testing single quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not single quoted string injectable
[11:22:48] [INFO] testing LIKE single quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE single quoted string injectable
[11:22:48] [INFO] testing double quoted string injection on GET parameter 'id'
[11:22:48] [INFO] GET parameter 'id' is not double quoted string injectable
[11:22:48] [INFO] testing LIKE double quoted string injection on GET parameter '
id'
[11:22:48] [INFO] GET parameter 'id' is not LIKE double quoted string injectable
[11:22:48] [INFO] GET parameter 'id' is not injectable with 3 parenthesis
[11:22:48] [WARNING] GET parameter 'id' is not injectable |
