Re: [sqlmap-users] Comparative precomputation

[Julius K. <jul...@gm...>]

User specified regexps?

2013/2/20 Miroslav Stampar <mir...@gm...>

> Andres.
>
> On Wed, Feb 20, 2013 at 3:11 PM, Andres Riancho <and...@gm...>wrote:
>
>> Miroslav,
>>
>> On Wed, Feb 20, 2013 at 4:15 AM, Miroslav Stampar
>> <mir...@gm...> wrote:
>> > Hi.
>> >
>> > In theory this works, in practice it doesn't. We already overturned 2-3
>> guys
>> > proposing this. Today's pages are too dynamic (banners, promos, etc.).
>>
>> But sqlmap already supports comparing pages with minor differences
>> (using difflib, correct?)
>>
> Yes, and it does the best among all tools.
>
>>
>> > Also,
>> > you would need a parameter value with a big covering range (lots of
>> > different values).
>>
>> 256 different rows for a table doesn't seem to be something difficult
>> to find; while not possible in all cases I agree.
>>
> It's a difficult to find, trust me. Also, how to "differentiate" 256
> different cases when you have 256 different cases of BANNERs in plain
> refresh of pages.
>
>>
>> > Also, whoever wrote this don't have a clue about this subject: ' The
>> > attacker would then take a checksum of the returned html data'. This is
>> > being done in kiddish scripts. Real SQLi tool knows that checksum is
>> faaar
>> > from reliable.
>>
>> See difflib above.
>>
> Seen
>
>>
>> > Anyway, answer is no.
>>
>> I think you're disregarding a good idea (if correctly implemented it
>> provides a 8-times performance improvement) way too fast.
>> Implementation is going to be difficult, but the benefits are great,
>>
> I am not disregarding a good idea. It's good in THEORY, but not in
> practice (THEORY != PRACTICE). You can make a tool your own and try it
> yourself on real life web sites. I am sure that you'll
> be disappointed really quickly.
>
> Anyway, it's not a practical idea at all. Cold fusion is also a great
> idea. Maybe that would be smarter to implement than this one.
>
> Bye
>
>>
>> > Kind regards,
>> > Miroslav Stampar
>> >
>> > On Feb 20, 2013 2:11 AM, "Julius Kivimäki" <jul...@gm...>
>> > wrote:
>> >>
>> >> Should probably look into adding this,
>> >>
>> http://www.blackhatlibrary.net/SQL_injection/Blind/Comparative_precomputation
>> >>
>> >>
>> ------------------------------------------------------------------------------
>> >> Everyone hates slow websites. So do we.
>> >> Make your web apps faster with AppDynamics
>> >> Download AppDynamics Lite for free today:
>> >> http://p.sf.net/sfu/appdyn_d2d_feb
>> >> _______________________________________________
>> >> sqlmap-users mailing list
>> >> sql...@li...
>> >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>> >>
>> >
>> >
>> ------------------------------------------------------------------------------
>> > Everyone hates slow websites. So do we.
>> > Make your web apps faster with AppDynamics
>> > Download AppDynamics Lite for free today:
>> > http://p.sf.net/sfu/appdyn_d2d_feb
>> > _______________________________________________
>> > sqlmap-users mailing list
>> > sql...@li...
>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>> >
>>
>>
>>
>> --
>> Andrés Riancho
>> Project Leader at w3af - http://w3af.org/
>> Web Application Attack and Audit Framework
>> Twitter: @w3af
>> GPG: 0x93C344F3
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm