Re: [sqlmap-users] sqlmap with Sybase

[Miroslav S. <mir...@gm...>]

Hi.

Can you please copy/paste the console output you get for sqlmap run with:

python sqlmap.py ... -D ENERGY --tables --parse-errors

Also, for:

python sqlmap.py ... --dbs

Bye
On Mar 25, 2014 7:16 PM, "les paul" <rw8...@gm...> wrote:

> Hi all,
>
> I'm running into trouble with sqlmap against a Sybase db. Here's the
> fingerprint:
>
> Adaptive Server Enterprise/15.0.3/EBF 17770 ESD#4/P/x86_64/Enterprise
> Linux/ase1503/2768/64-bit/FBO/Thu Aug 26 09:54:27 2010
>
> The technique I'm using is error-based through a POST to a vulnerable
> .aspx page. I am able to enumerate the master db, but not the user tables,
> which are what I want.
>
> $ ./sqlmap.py -u xxx -d "huge_asp_net_viewstate&theparam=blah"
> --dbms=sybase --threads=8 --batch --technique=E -D master --tables
>
> This produces 58 tables, mostly sys* and some mon* which seem standard. I
> can dump the sysobjects table using -D and -T, etc.
>
> The web app is querying a database we'll call "ENERGY". If I try to "-D
> ENERGY --tables", I get "No tables found, try using --hex or --no-cast
> blahblah" (which don't work).
>
> I used -v4 to look closely at the requests, and see sqlmap is prefixing
> the tablenames with "ENERGY.dbo." or sometimes just "ENERGY..", which after
> experimenting I found doesn't work, so I wrote a small tamper script to
> strip off "ENERGY.." and "ENERGY.dbo." - this lets me pull the column names
> from the user tables (type='U'), but I'm still not able to get at the
> actual data/rows in the tables.
>
> I know it must be possible because the web app is definitely querying the
> tables to validate a login (this is a sqli vuln in a login form, heh).
>
> I'm not even sure this is really a bug in sqlmap - maybe something odd in
> the way the database is built or something. I just thought I'd ask in case
> anyone has had success using sqlmap against a similar Sybase db and has
> some tips or suggestions.
>
> Thanks for reading - I can provide more information if anyone's interested.
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>