Re: [sqlmap-users] Problem with using Webscarab conversations

[Miroslav S. <mir...@gm...>]

Downloading right now. Will report back.

KR

On Wed, Jan 19, 2011 at 9:28 PM, Antonios Atlasis
<ant...@gm...> wrote:
> Hi Miroslav and thanks for your answer,
>
> I did reproduce the results a couple of times and you can easily do so.
>
> My target is the ctf6 lampsec security (you can downloaded from
> http://sourceforge.net/projects/lampsecurity/).
>
> After a very fast browsing, I crawled the rest of the site using Webscarab.
>
> I run the command sqlmap --batch -v 2 -l ../webscarab-logs/conversations/
>
> sqlmap failed to find any sqli.
>
> Then I run  sqlmap -u  http://192.168.163.128/index.php?id=4 (one of the
> vulnerable urls) and it does find the sqli vulnerability.
>
> please let me know if you want me to send you any logs.
>
> Regards
>
> Antonios
>
> 2011/1/18 Miroslav Stampar <mir...@gm...>
>>
>> Hi Antonios.
>>
>> main question is: are you able to reproduce this kind of behavior again?
>>
>> if yes, then sqlmap really has some "bug" and it would be great if you
>> could (maybe privately) provide is with further details from used
>> logs.
>>
>> if no, thing that comes to my mind and that can screw things up is
>> "dynamicity". we've worked hard to make a good comparison/detection
>> engine together with dynamicity removal, but still, pages with lots of
>> garbaged styles/tags/scripts... can screw things up, especially when
>> only a small part of the page is affected by injection itself. hence
>> there are switches like --string and --text-only (removes all
>> tags/scripts/styles and retrieves only pure text) that can do miracles
>> in those kind of cases.
>>
>> KR
>>
>> On Tue, Jan 18, 2011 at 10:04 PM, Antonios Atlasis
>> <ant...@gm...> wrote:
>> >
>> > Hello to the list,
>> >
>> > after spidering a site that is vulnerable to SQLi with Webscarab, I fed
>> > its
>> > conversations directory to sqlmap using the -l option.
>> > sqlmap didn't find any SQLi vulnerable.
>> >
>> > Then, I fed a vulnerable URL to sqlmap with the -u option (which URL was
>> > also included in the webscarab conversations and it had also been tested
>> > before with sqlmap), and sqlmap did found this time the specific SQLi
>> > vulnerability.
>> >
>> > Has anyone else observed a problem using Webscarab conversations? Is
>> > there
>> > any tip or trick that I can use in order to solve this problem?
>> >
>> > Thanks in advance
>> >
>> > Antonios
>> >
>> >
>> > ------------------------------------------------------------------------------
>> > Protect Your Site and Customers from Malware Attacks
>> > Learn about various malware tactics and how to avoid them. Understand
>> > malware threats, the impact they can have on your business, and how you
>> > can protect your company and customers by using code signing.
>> > http://p.sf.net/sfu/oracle-sfdevnl
>> > _______________________________________________
>> > sqlmap-users mailing list
>> > sql...@li...
>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>> >
>> >
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>> Mobile: +385921010204 (HR 0921010204)
>> PGP Key ID: 0xB5397B1B
>> Location: Zagreb, Croatia
>
>
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia