[sqlmap-users] [WARNING] GET parameter 'module' is not injectable
Brought to you by:
inquisb
Menu
▾
▴
[sqlmap-users] [WARNING] GET parameter 'module' is not injectable
|
From: <gr...@ab...> - 2015-06-01 07:33:14
|
<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Hello,</div> <div> </div> <div>I want to test our written function. So i start testing with the following command:</div> <div>sqlmap.py -u "https://SERVER/index.php?module=upload&func=checkUserForm&c_id=102" --banner --auth-type=Basic --auth-cred=name:password</div> <div> </div> <div>Now I'm wondering about the status of some messages.</div> <div> </div> <div>Why ist the following message a warning:</div> <div>[09:25:52] [WARNING] GET parameter 'module' is not injectable</div> <div> </div> <div>Or why ist this critical:</div> <div>[09:26:54] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request</div> <div> </div> <div>Is there an overview about the different message-states (info, warning, critcal and so on) and the meaning of them?</div> <div> </div> <div> </div> <div>A short listing of the whole output:</div> <div> <div>[09:24:49] [INFO] testing connection to the target URL</div> <div>[09:24:51] [INFO] heuristics detected web page charset 'UTF-8'</div> <div>[09:24:51] [WARNING] reflective value(s) found and filtering out</div> <div>[09:24:51] [INFO] testing if the target URL is stable. This can take a couple of seconds</div> <div>[09:24:52] [INFO] target URL is stable</div> <div>[09:24:52] [INFO] testing if GET parameter 'module' is dynamic</div> <div>[09:24:52] [INFO] confirming that GET parameter 'module' is dynamic</div> <div>[09:24:53] [WARNING] GET parameter 'module' does not appear dynamic</div> <div>[09:24:53] [WARNING] heuristic (basic) test shows that GET parameter 'module' might not be injectable</div> <div>[09:24:53] [INFO] testing for SQL injection on GET parameter 'module'</div> <div>[09:24:53] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'</div> <div>[09:24:56] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Parameter replace'</div> <div>[09:24:57] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'</div> <div>[09:24:58] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'</div> <div>[09:25:00] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'</div> <div>[09:25:01] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'</div> <div>[09:25:03] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'</div> <div>[09:25:03] [INFO] testing 'MySQL inline queries'</div> <div>[09:25:03] [INFO] testing 'PostgreSQL inline queries'</div> <div>[09:25:04] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'</div> <div>[09:25:04] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'</div> <div>[09:25:05] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'</div> <div>[09:25:07] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'</div> <div>[09:25:08] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'</div> <div>[09:25:10] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'</div> <div>[09:25:11] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'</div> <div>[09:25:13] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'</div> <div>[09:25:14] [INFO] testing 'Oracle AND time-based blind'</div> <div>[09:25:16] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'</div> <div>[09:25:16] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option</div> <div>'--dbms'</div> <div>[09:25:32] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'</div> <div>[09:25:52] [WARNING] GET parameter 'module' is not injectable</div> <div>[09:25:52] [INFO] testing if GET parameter 'func' is dynamic</div> <div>sqlmap got a 302 redirect to 'https://SERVER:443/index.php'. Do you want to follow? [Y/n] n</div> <div>[09:26:54] [ERROR] detected invalid data for declared content encoding 'gzip' ('unpack requires a string argument of length 4')</div> <div>[09:26:54] [WARNING] turning off page compression</div> <div>[09:26:54] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request</div> <div>[09:26:55] [INFO] confirming that GET parameter 'func' is dynamic</div> <div>[09:26:55] [WARNING] GET parameter 'func' does not appear dynamic</div> <div>[09:26:55] [WARNING] heuristic (basic) test shows that GET parameter 'func' might not be injectable</div> <div>...</div> <div> </div> <div> </div> <div>Thank you,</div> <div> </div> <div>regards Peter</div> <div> </div> </div> <div class="signature"> </div></div></body></html> |
