sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] SQLmap cannot get password hash

[Miroslav S. <mir...@gm...>]

hi Ryan.

maybe you don't have enough permissions for accessing table mysql.user.

key query is: SELECT user, password FROM mysql.user

if you could somehow try to access it manually (...AND EXISTS(SELECT
user, password FROM mysql.user)) and confirm that.

kr

On Tue, Oct 19, 2010 at 5:20 AM, Ryan Fabella <ry...@gm...> wrote:
> Dear List,
>
> i use sqlmap-0.9-dev which is built in on backtrack 4 Rc1
> my target is using mysql 5.1.30really5.0.75-0ubuntu10.3
>
> but i always cannot grab the hash password.
>
> [WARNING] unable to retrieve the number of password hashes for user
>
> i can get --dbs , --users
>
> need your help.
>
> Thank You
>
> ------------------------------------------------------------------------------
> Download new Adobe(R) Flash(R) Builder(TM) 4
> The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly
> Flex(R) Builder(TM)) enable the development of rich applications that run
> across multiple browsers and platforms. Download your free trials today!
> http://p.sf.net/sfu/adobe-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

[sqlmap-users] SQLmap cannot get password hash

[Ryan F. <ry...@gm...>]

Dear List,

i use sqlmap-0.9-dev which is built in on backtrack 4 Rc1
my target is using mysql 5.1.30really5.0.75-0ubuntu10.3

but i always cannot grab the hash password.

[WARNING] unable to retrieve the number of password hashes for user

i can get --dbs , --users

need your help.

Thank You

[sqlmap-users] App outputs only column #0

[Anton M. <aza...@ya...>]

Hello.

One web application has union query injection. But only zero-th column is printed at the page.
Like this:

<?php
if (isset($_GET['name']))
{
    mysql_connect('localhost', 'user', 'TopSecret');
    mysql_select_db('sqlmap_test');
    $result = mysql_query("SELECT * FROM `data` WHERE `name` = '{$_GET['name']}'");
    $row = mysql_fetch_row($result);
    echo $row[0];
}
else
{
    echo '<a href="?name=item_1">Click me</a>';
}
?>

Data in DBMS should be like this:
mysql> CREATE DATABASE `sqlmap_test`;
mysql> USE `sqlmap_test`;
mysql> CREATE TABLE `data` (`name` VARCHAR(255), `value` VARCHAR(255));
mysql> INSERT INTO `data` VALUES ('item_1', 'foo');

sqlmap can't determine this injection. And after changing "echo $row[0];" to "echo $row[1];" everything is OK.
In fact it finds, but set "kb.unionPosition" to 0 and after that check if injection was found with code similair to "if kb.unionPosition:".
As I understand, expected that kb.unionPosition will be None if nothing is found and 1,2,3... if something is found. And so sqlmap interprets 0-th position as it wasn't found ability to use UNION (because 0 in "if kb.unionPosition:" is interpreted as False).

I did rogue patch basically changing
if kb.unionPosition:
to
if kb.unionPosition != None:
and similair things. Didn't test carefully and I'm definetily not knowledgable enough to ensure that everything is done properly, but in my particular case it helped.

diff -ur sqlmap-dev/lib/controller/action.py sqlmap-dev-edited/lib/controller/action.py
--- sqlmap-dev/lib/controller/action.py	2010-10-19 01:50:39.241344594 +0400
+++ sqlmap-dev-edited/lib/controller/action.py	2010-10-19 02:54:13.465340951 +0400
@@ -60,7 +60,7 @@
     if conf.timeTest:
         conf.dumper.technic("time based blind sql injection payload", timeTest())
 
-    if ( conf.unionUse or conf.unionTest ) and not kb.unionPosition:
+    if ( conf.unionUse or conf.unionTest ) and kb.unionPosition == None:
         conf.dumper.technic("valid union", unionTest())
 
     # Enumeration options
diff -ur sqlmap-dev/lib/core/agent.py sqlmap-dev-edited/lib/core/agent.py
--- sqlmap-dev/lib/core/agent.py	2010-10-19 01:50:39.484343548 +0400
+++ sqlmap-dev-edited/lib/core/agent.py	2010-10-19 02:55:54.672339497 +0400
@@ -452,7 +452,7 @@
             query        = query[len("TOP %s " % topNum):]
             inbandQuery += "TOP %s " % topNum
 
-        if not exprPosition:
+        if exprPosition == None:
             exprPosition = kb.unionPosition
 
         intoRegExp = re.search("(\s+INTO (DUMP|OUT)FILE\s+\'(.+?)\')", query, re.I)
diff -ur sqlmap-dev/lib/core/session.py sqlmap-dev-edited/lib/core/session.py
--- sqlmap-dev/lib/core/session.py	2010-10-19 01:50:39.501342465 +0400
+++ sqlmap-dev-edited/lib/core/session.py	2010-10-19 02:52:27.288339918 +0400
@@ -223,7 +223,7 @@
         kb.unionComment = comment
         kb.unionCount = count
 
-    if position:
+    if position != None:
         condition = (
                       not kb.resumedQueries or ( kb.resumedQueries.has_key(conf.url) and
                       ( not kb.resumedQueries[conf.url].has_key("Union position")
diff -ur sqlmap-dev/lib/request/inject.py sqlmap-dev-edited/lib/request/inject.py
--- sqlmap-dev/lib/request/inject.py	2010-10-19 01:50:39.600342306 +0400
+++ sqlmap-dev-edited/lib/request/inject.py	2010-10-19 02:51:28.344340250 +0400
@@ -347,7 +347,7 @@
 
         expression = expression.replace("DISTINCT ", "")
 
-        if inband and kb.unionPosition:
+        if inband and kb.unionPosition != None:
             value = __goInband(expression, expected, sort, resumeValue, unpack, dump)
 
             if not value:
diff -ur sqlmap-dev/plugins/dbms/mssqlserver/enumeration.py sqlmap-dev-edited/plugins/dbms/mssqlserver/enumeration.py
--- sqlmap-dev/plugins/dbms/mssqlserver/enumeration.py	2010-10-19 01:50:33.629342785 +0400
+++ sqlmap-dev-edited/plugins/dbms/mssqlserver/enumeration.py	2010-10-19 03:00:52.724338261 +0400
@@ -48,7 +48,7 @@
             else:
                 dbs = [conf.db]
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             for db in dbs:
                 if conf.excludeSysDbs and db in self.excludeDbsList:
                     infoMsg = "skipping system database '%s'" % db
@@ -138,7 +138,7 @@
 
                     continue
 
-                if kb.unionPosition or conf.direct:
+                if kb.unionPosition != None or conf.direct:
                     query = rootQuery["inband"]["query"] % db
                     query += tblQuery
                     values = inject.getValue(query, blind=False)
@@ -223,7 +223,7 @@
 
                     continue
 
-                if kb.unionPosition or conf.direct:
+                if kb.unionPosition != None or conf.direct:
                     query = rootQuery["inband"]["query"] % (db, db, db, db, db)
                     query += " AND %s" % colQuery.replace("[DB]", db)
                     values = inject.getValue(query, blind=False)
diff -ur sqlmap-dev/plugins/dbms/mssqlserver/filesystem.py sqlmap-dev-edited/plugins/dbms/mssqlserver/filesystem.py
--- sqlmap-dev/plugins/dbms/mssqlserver/filesystem.py	2010-10-19 01:50:33.625342874 +0400
+++ sqlmap-dev-edited/plugins/dbms/mssqlserver/filesystem.py	2010-10-19 03:00:15.052341781 +0400
@@ -92,7 +92,7 @@
         binToHexQuery = urlencode(binToHexQuery, convall=True)
         inject.goStacked(binToHexQuery)
 
-        if kb.unionPosition:
+        if kb.unionPosition != None:
             result = inject.getValue("SELECT %s FROM %s ORDER BY id ASC" % (self.tblField, hexTbl), sort=False, resumeValue=False, blind=False)
 
         if not result:
diff -ur sqlmap-dev/plugins/dbms/oracle/enumeration.py sqlmap-dev-edited/plugins/dbms/oracle/enumeration.py
--- sqlmap-dev/plugins/dbms/oracle/enumeration.py	2010-10-19 01:50:33.577342360 +0400
+++ sqlmap-dev-edited/plugins/dbms/oracle/enumeration.py	2010-10-19 03:01:11.381340862 +0400
@@ -36,7 +36,7 @@
         # Set containing the list of DBMS administrators
         areAdmins = set()
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if query2:
                 query     = rootQuery["inband"]["query2"]
                 condition = rootQuery["inband"]["condition2"]
@@ -196,7 +196,7 @@
             colQuery = colQuery % column
 
             for db in dbs.keys():
-                if kb.unionPosition or conf.direct:
+                if kb.unionPosition != None or conf.direct:
                     query = rootQuery["inband"]["query"]
                     query += colQuery
                     values = inject.getValue(query, blind=False)
diff -ur sqlmap-dev/plugins/generic/enumeration.py sqlmap-dev-edited/plugins/generic/enumeration.py
--- sqlmap-dev/plugins/generic/enumeration.py	2010-10-19 01:50:33.817345961 +0400
+++ sqlmap-dev-edited/plugins/generic/enumeration.py	2010-10-19 02:50:44.488340196 +0400
@@ -136,7 +136,7 @@
         condition  = ( kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ) )
         condition |= ( kb.dbms == "MySQL" and not kb.data.has_information_schema )
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if condition:
                 query = rootQuery["inband"]["query2"]
             else:
@@ -193,7 +193,7 @@
 
         logger.info(infoMsg)
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
                 query = rootQuery["inband"]["query2"]
             else:
@@ -390,7 +390,7 @@
                          "E": "EXECUTE"
                      }
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if kb.dbms == "MySQL" and not kb.data.has_information_schema:
                 query     = rootQuery["inband"]["query2"]
                 condition = rootQuery["inband"]["condition2"]
@@ -636,7 +636,7 @@
 
         rootQuery = queries[kb.dbms].dbs
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if kb.dbms == "MySQL" and not kb.data.has_information_schema:
                 query = rootQuery["inband"]["query2"]
             else:
@@ -703,7 +703,7 @@
 
         rootQuery = queries[kb.dbms].tables
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             query = rootQuery["inband"]["query"]
             condition = rootQuery["inband"]["condition"]
 
@@ -899,7 +899,7 @@
         infoMsg += "on database '%s'" % conf.db
         logger.info(infoMsg)
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if kb.dbms in ( "MySQL", "PostgreSQL" ):
                 query = rootQuery["inband"]["query"] % (conf.tbl, conf.db)
                 query += condQuery
@@ -1078,7 +1078,7 @@
 
         entriesCount = 0
 
-        if kb.unionPosition or conf.direct:
+        if kb.unionPosition != None or conf.direct:
             if kb.dbms == "Oracle":
                 query = rootQuery["inband"]["query"] % (colString, conf.tbl.upper())
             elif kb.dbms == "SQLite":
@@ -1336,7 +1336,7 @@
             dbQuery = "%s%s" % (dbCond, dbCondParam)
             dbQuery = dbQuery % db
 
-            if kb.unionPosition or conf.direct:
+            if kb.unionPosition != None or conf.direct:
                 if kb.dbms == "MySQL" and not kb.data.has_information_schema:
                     query = rootQuery["inband"]["query2"]
                 else:
@@ -1424,7 +1424,7 @@
             tblQuery = "%s%s" % (tblCond, tblCondParam)
             tblQuery = tblQuery % tbl
 
-            if kb.unionPosition or conf.direct:
+            if kb.unionPosition != None or conf.direct:
                 query = rootQuery["inband"]["query"]
                 query += tblQuery
                 query += exclDbsQuery
@@ -1545,7 +1545,7 @@
             colQuery = "%s%s" % (colCond, colCondParam)
             colQuery = colQuery % column
 
-            if kb.unionPosition or conf.direct:
+            if kb.unionPosition != None or conf.direct:
                 query = rootQuery["inband"]["query"]
                 query += colQuery
                 query += exclDbsQuery

And thanks very much for such helpful program!


      

[sqlmap-users] Bug !

[<leg...@sa...>]

->


[03:25:38] [ERROR] unhandled exception in sqlmap/0.9-dev, please copy  
the command line and the following text and send by e-mail to  
sql...@li.... The developer will fix it as soon  
as possible:
sqlmap version: 0.9-dev
Python version: 2.5.2
Operating system: posix
Traceback (most recent call last):
   File "./sqlmap.py", line 89, in main
     start()
   File "/pentest/database/sqlmap/lib/controller/controller.py", line  
268, in start
     action()
   File "/pentest/database/sqlmap/lib/controller/action.py", line 117,  
in action
     conf.dumper.dbTableValues(conf.dbmsHandler.dumpTable())
   File "/pentest/database/sqlmap/lib/core/dump.py", line 329, in dbTableValues
     self.__write("| %s%s" % (value, blank), n=False)
   File "/pentest/database/sqlmap/lib/core/dump.py", line 50, in __write
     print data,
UnicodeEncodeError: 'ascii' codec can't encode character u'\xe3' in  
position 4: ordinal not in range(128)

[*] shutting down at: 03:25:38

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

hi.

thank you for your report. updated version should handle this issue
(connection time outs are not welcome, while expected from time to
time, but keepalive module shouldn't crash like this when reusing
connection instance - fixed).

kind regards.

On Sat, Oct 16, 2010 at 4:58 PM,  <nig...@em...> wrote:
> sqlmap -u "http://Website.com/content.php?show=videos&section=12&gallery=28" -f -b -o
> [16:43:59] [INFO] testing connection to the target url
> [16:44:01] [INFO] testing NULL connection to the target url
> [16:44:03] [INFO] testing if the url is stable, wait a few seconds
> [16:44:06] [INFO] url is stable
> [16:44:06] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
> [16:45:13] [INFO] confirming that User-Agent parameter 'User-Agent' is dynamic
> [16:45:13] [CRITICAL] connection timed out to the target url, sqlmap is going to retry the request
>
> [16:45:14] [CRITICAL] unhandled exception in sqlmap/0.9-dev, please copy the command line and the following text and send by e-mai
> l to sql...@li.... The developer will fix it as soon as possible:
> sqlmap version: 0.9-dev
> Python version: 2.6.5
> Operating system: nt
> Traceback (most recent call last):
>  File "C:\pentest\p\sqlmap.0.9\sqlmap.py", line 78, in main
>    start()
>  File "C:\pentest\p\sqlmap.0.9\lib\controller\controller.py", line 230, in start
>    elif not checkDynParam(place, parameter, value):
>  File "C:\pentest\p\sqlmap.0.9\lib\controller\checks.py", line 135, in checkDynParam
>    dynResult2 = Request.queryPage(payload, place)
>  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 339, in queryPage
>    page, headers = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, silent=silent, method=method, auxHeaders=au
> xHeaders, response=response, raise404=raise404)
>  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 252, in getPage
>    return Connect.__getPageProxy(**kwargs)
>  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 42, in __getPageProxy
>    return Connect.getPage(**kwargs)
>  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 164, in getPage
>    conn = urllib2.urlopen(req)
>  File "C:\Python26\lib\urllib2.py", line 126, in urlopen
>    return _opener.open(url, data, timeout)
>  File "C:\Python26\lib\urllib2.py", line 391, in open
>    response = self._open(req, data)
>  File "C:\Python26\lib\urllib2.py", line 409, in _open
>    '_open', req)
>  File "C:\Python26\lib\urllib2.py", line 369, in _call_chain
>    result = func(*args)
>  File "C:\pentest\p\sqlmap.0.9\extra\keepalive\keepalive.py", line 204, in http_open
>    return self.do_open(HTTPConnection, req)
>  File "C:\pentest\p\sqlmap.0.9\extra\keepalive\keepalive.py", line 154, in do_open
>    self._start_connection(h, req)
>  File "C:\pentest\p\sqlmap.0.9\extra\keepalive\keepalive.py", line 129, in _start_connection
>    h.putrequest('GET', req.get_selector())
>  File "C:\Python26\lib\httplib.py", line 814, in putrequest
>    raise CannotSendRequest()
> CannotSendRequest
>
> [*] shutting down at: 16:45:14
>
> ------------------------------------------------------------------------------
> Download new Adobe(R) Flash(R) Builder(TM) 4
> The new Adobe(R) Flex(R) 4 and Flash(R) Builder(TM) 4 (formerly
> Flex(R) Builder(TM)) enable the development of rich applications that run
> across multiple browsers and platforms. Download your free trials today!
> http://p.sf.net/sfu/adobe-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

[sqlmap-users] (no subject)

[<nig...@em...>]

sqlmap -u "http://Website.com/content.php?show=videos&section=12&gallery=28" -f -b -o
[16:43:59] [INFO] testing connection to the target url
[16:44:01] [INFO] testing NULL connection to the target url
[16:44:03] [INFO] testing if the url is stable, wait a few seconds
[16:44:06] [INFO] url is stable
[16:44:06] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
[16:45:13] [INFO] confirming that User-Agent parameter 'User-Agent' is dynamic
[16:45:13] [CRITICAL] connection timed out to the target url, sqlmap is going to retry the request

[16:45:14] [CRITICAL] unhandled exception in sqlmap/0.9-dev, please copy the command line and the following text and send by e-mai
l to sql...@li.... The developer will fix it as soon as possible:
sqlmap version: 0.9-dev
Python version: 2.6.5
Operating system: nt
Traceback (most recent call last):
  File "C:\pentest\p\sqlmap.0.9\sqlmap.py", line 78, in main
    start()
  File "C:\pentest\p\sqlmap.0.9\lib\controller\controller.py", line 230, in start
    elif not checkDynParam(place, parameter, value):
  File "C:\pentest\p\sqlmap.0.9\lib\controller\checks.py", line 135, in checkDynParam
    dynResult2 = Request.queryPage(payload, place)
  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 339, in queryPage
    page, headers = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, silent=silent, method=method, auxHeaders=au
xHeaders, response=response, raise404=raise404)
  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 252, in getPage
    return Connect.__getPageProxy(**kwargs)
  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 42, in __getPageProxy
    return Connect.getPage(**kwargs)
  File "C:\pentest\p\sqlmap.0.9\lib\request\connect.py", line 164, in getPage
    conn = urllib2.urlopen(req)
  File "C:\Python26\lib\urllib2.py", line 126, in urlopen
    return _opener.open(url, data, timeout)
  File "C:\Python26\lib\urllib2.py", line 391, in open
    response = self._open(req, data)
  File "C:\Python26\lib\urllib2.py", line 409, in _open
    '_open', req)
  File "C:\Python26\lib\urllib2.py", line 369, in _call_chain
    result = func(*args)
  File "C:\pentest\p\sqlmap.0.9\extra\keepalive\keepalive.py", line 204, in http_open
    return self.do_open(HTTPConnection, req)
  File "C:\pentest\p\sqlmap.0.9\extra\keepalive\keepalive.py", line 154, in do_open
    self._start_connection(h, req)
  File "C:\pentest\p\sqlmap.0.9\extra\keepalive\keepalive.py", line 129, in _start_connection
    h.putrequest('GET', req.get_selector())
  File "C:\Python26\lib\httplib.py", line 814, in putrequest
    raise CannotSendRequest()
CannotSendRequest

[*] shutting down at: 16:45:14

Re: [sqlmap-users] New feature

[Carlos G. V. <car...@gm...>]

I was looking into the space2comment.py tamper script. I think this lines...

        while value.find(" ") > -1:
            value = value.replace(" ", "/**/")

... could be replaced just with value = value.replace(...), no need of
while (unless value is of a type that i don't know and requires it).
Just a tip. Tested in my box with python 2.6.5, this is the result:

$ python
Python 2.6.5 (r265:79063, Apr 16 2010, 13:09:56)
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> s_in="this is a string with spaces"
>>> s_in.replace(" ", "/**/")
'this/**/is/**/a/**/string/**/with/**/spaces'

Cya!


2010/10/13 Miroslav Stampar <mir...@gm...>:
> hi.
>
> that functionality is now added to './tamper/charencode.py'
>
> also, one more module is added './tamper/randomcase.py' which could be
> used for as a method for bypassing "shitty" IDSes.
>
> bye.
>
> On Wed, Oct 13, 2010 at 7:43 PM, Carlos Gabriel Vergara
> <car...@gm...> wrote:
>> For the last case, i mean to encode all the injection using %.
>>
>> For example:
>>
>> http://somehost/script.asp?id=SELECT%20FIELD%20FROM%20TABLE
>>
>> to
>>
>> http://somehost/script.asp?id=%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
>>
>> This could be combined with the script that double encodes, since you
>> can stack tamper scripts.
>> By the way, a nice online tool to encode/decode can be found at:
>>
>> http://yehg.net/encoding/
>>
>> Best regards,
>>
>> 2010/10/13 Miroslav Stampar <mir...@gm...>:
>>> On Wed, Oct 13, 2010 at 3:55 PM, Carlos Gabriel Vergara
>>> <car...@gm...> wrote:
>>>> Good work!
>>>>
>>>> Will try it as soon as i have a minute.
>>>>
>>>> Some examples of tamper functions:
>>>>
>>>> a) Replace chars with %, with double encoding... i mean: %20 to %2520
>>>
>>> added ./tamper/doubleencode.py
>>>
>>>> b) Replace spaces with /**/ for mssql (i think theres already an
>>>> option for this in later versions)
>>>
>>> added ./tamper/space2comment.py
>>>
>>>> c) Related to a), replace all injection with encoding using %
>>>
>>> didn't understand this one. could you please explain it more. thx.
>>>
>>>>
>>>> If I remember something else, will post it.
>>>>
>>>> Best regards,
>>>> G
>>>>
>>>> 2010/10/13 Miroslav Stampar <mir...@gm...>:
>>>>> ...and yes, they can be stacked together:
>>>>>
>>>>> sample:
>>>>> --tamper="./tamper/ifnull2ifisnull.py;./tamper/dummy.py"
>>>>>
>>>>> bye
>>>>>
>>>>> On Wed, Oct 13, 2010 at 3:15 PM, Miroslav Stampar
>>>>> <mir...@gm...> wrote:
>>>>>> hello all.
>>>>>>
>>>>>> switch '--tamper' is now fully implemented in the latest SVN revision.
>>>>>> tampering modules must include function with declaration like 'def
>>>>>> tamper(place, value):'. argument 'place' states which injection place
>>>>>> ('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
>>>>>> value represent the old query value (prior to return value of that
>>>>>> tampering function).
>>>>>>
>>>>>> tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
>>>>>> so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
>>>>>> tampering modules/functions too.
>>>>>>
>>>>>> sample usage is:
>>>>>>
>>>>>> ./sqlmap.py -u "http://www.site.com/index.php?id=1"
>>>>>> --tamper="./tamper/ifnull2ifisnull.py"
>>>>>>
>>>>>> if you have any other suggestions for other useful tampering functions
>>>>>> please say and i'll try to implement it/them if it makes sense.
>>>>>>
>>>>>> kind regards.
>>>>>>
>>>>>> On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
>>>>>> <mir...@gm...> wrote:
>>>>>>> hi.
>>>>>>>
>>>>>>> now, there is an option "--tamper=<file>" which does this.
>>>>>>>
>>>>>>> you can play around with it using for example:
>>>>>>> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>>>>>>>
>>>>>>> for "practical" examples please wait for working version of
>>>>>>> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
>>>>>>> parenthesis in regular expression i use for recognizing parts of
>>>>>>> ifnull.
>>>>>>>
>>>>>>> kind regards.
>>>>>>>
>>>>>>> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
>>>>>>> <car...@gm...> wrote:
>>>>>>>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>>>>>>>> found the need of "touch" the urls that the tool crafts to send to the
>>>>>>>> server.
>>>>>>>> Most of the times this happens because all scenarios are some sort of
>>>>>>>> unique, even if they share the same DMBS.
>>>>>>>> In this cases i spend a lot of time programming pseudo proxys (quick
>>>>>>>> and dirty coding in python) to solve the obstacle.
>>>>>>>> I have some free time now, and want to make a module for sqlmap that
>>>>>>>> "tampers" the data to be send, let me introduce some logic to modify
>>>>>>>> it, and then send it to the server.
>>>>>>>> For example: i need to replace blanks with /**/ for a mssql server. I
>>>>>>>> will be using sqlmap like this:
>>>>>>>>
>>>>>>>> sqlmap -u "http://host/script.py?id=15" -p id
>>>>>>>> --tamper-script="/home/kaleb/script.py"
>>>>>>>>
>>>>>>>> In script.py, some sort of code that picks the GET/POST about to be
>>>>>>>> sent to the server, search for the blanks in the query, replace them
>>>>>>>> with /**/, and then give it back to sqlmap to be sended.
>>>>>>>>
>>>>>>>> Another example (mentioned in a previous thread): i need to replace
>>>>>>>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>>>>>>>> string manipulation, made in a mini proxy, losting performance in the
>>>>>>>> middle.
>>>>>>>>
>>>>>>>> The question: which part of sqlmap code i need to start reviewing?
>>>>>>>> Thus i used it a lot, never looked into the code. In need a little
>>>>>>>> tip, just to start with something in mind.
>>>>>>>>
>>>>>>>> Thanks a lot.
>>>>>>>>
>>>>>>>> PD: excuse my rusty english, by the way =)
>>>>>>>>
>>>>>>>> --
>>>>>>>> --------8<--------
>>>>>>>> Carlos Gabriel Vergara
>>>>>>>> http://www.ThorSecurity.com.ar
>>>>>>>>
>>>>>>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>>>>>>> -------->8--------
>>>>>>>>
>>>>>>>> ------------------------------------------------------------------------------
>>>>>>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>>>>>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>>>>>>> Spend less time writing and  rewriting code and more time creating great
>>>>>>>> experiences on the web. Be a part of the beta today.
>>>>>>>> http://p.sf.net/sfu/beautyoftheweb
>>>>>>>> _______________________________________________
>>>>>>>> sqlmap-users mailing list
>>>>>>>> sql...@li...
>>>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> Miroslav Stampar
>>>>>>>
>>>>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>>>>> Mobile: +385921010204 (HR 0921010204)
>>>>>>> PGP Key ID: 0xB5397B1B
>>>>>>> Location: Zagreb, Croatia
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Miroslav Stampar
>>>>>>
>>>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>>>> Mobile: +385921010204 (HR 0921010204)
>>>>>> PGP Key ID: 0xB5397B1B
>>>>>> Location: Zagreb, Croatia
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Miroslav Stampar
>>>>>
>>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>>> Mobile: +385921010204 (HR 0921010204)
>>>>> PGP Key ID: 0xB5397B1B
>>>>> Location: Zagreb, Croatia
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> --------8<--------
>>>> Carlos Gabriel Vergara
>>>> http://www.ThorSecurity.com.ar
>>>>
>>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>>> -------->8--------
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>>> Spend less time writing and  rewriting code and more time creating great
>>>> experiences on the web. Be a part of the beta today.
>>>> http://p.sf.net/sfu/beautyoftheweb
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>> sql...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>> Mobile: +385921010204 (HR 0921010204)
>>> PGP Key ID: 0xB5397B1B
>>> Location: Zagreb, Croatia
>>>
>>
>>
>>
>> --
>> --------8<--------
>> Carlos Gabriel Vergara
>> http://www.ThorSecurity.com.ar
>>
>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>> -------->8--------
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail / Jabber: miroslav.stampar (at) gmail.com
> Mobile: +385921010204 (HR 0921010204)
> PGP Key ID: 0xB5397B1B
> Location: Zagreb, Croatia
>



-- 
--------8<--------
Carlos Gabriel Vergara
http://www.ThorSecurity.com.ar

PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
-------->8--------

Re: [sqlmap-users] New feature

[Miroslav S. <mir...@gm...>]

hi.

that functionality is now added to './tamper/charencode.py'

also, one more module is added './tamper/randomcase.py' which could be
used for as a method for bypassing "shitty" IDSes.

bye.

On Wed, Oct 13, 2010 at 7:43 PM, Carlos Gabriel Vergara
<car...@gm...> wrote:
> For the last case, i mean to encode all the injection using %.
>
> For example:
>
> http://somehost/script.asp?id=SELECT%20FIELD%20FROM%20TABLE
>
> to
>
> http://somehost/script.asp?id=%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
>
> This could be combined with the script that double encodes, since you
> can stack tamper scripts.
> By the way, a nice online tool to encode/decode can be found at:
>
> http://yehg.net/encoding/
>
> Best regards,
>
> 2010/10/13 Miroslav Stampar <mir...@gm...>:
>> On Wed, Oct 13, 2010 at 3:55 PM, Carlos Gabriel Vergara
>> <car...@gm...> wrote:
>>> Good work!
>>>
>>> Will try it as soon as i have a minute.
>>>
>>> Some examples of tamper functions:
>>>
>>> a) Replace chars with %, with double encoding... i mean: %20 to %2520
>>
>> added ./tamper/doubleencode.py
>>
>>> b) Replace spaces with /**/ for mssql (i think theres already an
>>> option for this in later versions)
>>
>> added ./tamper/space2comment.py
>>
>>> c) Related to a), replace all injection with encoding using %
>>
>> didn't understand this one. could you please explain it more. thx.
>>
>>>
>>> If I remember something else, will post it.
>>>
>>> Best regards,
>>> G
>>>
>>> 2010/10/13 Miroslav Stampar <mir...@gm...>:
>>>> ...and yes, they can be stacked together:
>>>>
>>>> sample:
>>>> --tamper="./tamper/ifnull2ifisnull.py;./tamper/dummy.py"
>>>>
>>>> bye
>>>>
>>>> On Wed, Oct 13, 2010 at 3:15 PM, Miroslav Stampar
>>>> <mir...@gm...> wrote:
>>>>> hello all.
>>>>>
>>>>> switch '--tamper' is now fully implemented in the latest SVN revision.
>>>>> tampering modules must include function with declaration like 'def
>>>>> tamper(place, value):'. argument 'place' states which injection place
>>>>> ('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
>>>>> value represent the old query value (prior to return value of that
>>>>> tampering function).
>>>>>
>>>>> tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
>>>>> so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
>>>>> tampering modules/functions too.
>>>>>
>>>>> sample usage is:
>>>>>
>>>>> ./sqlmap.py -u "http://www.site.com/index.php?id=1"
>>>>> --tamper="./tamper/ifnull2ifisnull.py"
>>>>>
>>>>> if you have any other suggestions for other useful tampering functions
>>>>> please say and i'll try to implement it/them if it makes sense.
>>>>>
>>>>> kind regards.
>>>>>
>>>>> On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
>>>>> <mir...@gm...> wrote:
>>>>>> hi.
>>>>>>
>>>>>> now, there is an option "--tamper=<file>" which does this.
>>>>>>
>>>>>> you can play around with it using for example:
>>>>>> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>>>>>>
>>>>>> for "practical" examples please wait for working version of
>>>>>> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
>>>>>> parenthesis in regular expression i use for recognizing parts of
>>>>>> ifnull.
>>>>>>
>>>>>> kind regards.
>>>>>>
>>>>>> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
>>>>>> <car...@gm...> wrote:
>>>>>>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>>>>>>> found the need of "touch" the urls that the tool crafts to send to the
>>>>>>> server.
>>>>>>> Most of the times this happens because all scenarios are some sort of
>>>>>>> unique, even if they share the same DMBS.
>>>>>>> In this cases i spend a lot of time programming pseudo proxys (quick
>>>>>>> and dirty coding in python) to solve the obstacle.
>>>>>>> I have some free time now, and want to make a module for sqlmap that
>>>>>>> "tampers" the data to be send, let me introduce some logic to modify
>>>>>>> it, and then send it to the server.
>>>>>>> For example: i need to replace blanks with /**/ for a mssql server. I
>>>>>>> will be using sqlmap like this:
>>>>>>>
>>>>>>> sqlmap -u "http://host/script.py?id=15" -p id
>>>>>>> --tamper-script="/home/kaleb/script.py"
>>>>>>>
>>>>>>> In script.py, some sort of code that picks the GET/POST about to be
>>>>>>> sent to the server, search for the blanks in the query, replace them
>>>>>>> with /**/, and then give it back to sqlmap to be sended.
>>>>>>>
>>>>>>> Another example (mentioned in a previous thread): i need to replace
>>>>>>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>>>>>>> string manipulation, made in a mini proxy, losting performance in the
>>>>>>> middle.
>>>>>>>
>>>>>>> The question: which part of sqlmap code i need to start reviewing?
>>>>>>> Thus i used it a lot, never looked into the code. In need a little
>>>>>>> tip, just to start with something in mind.
>>>>>>>
>>>>>>> Thanks a lot.
>>>>>>>
>>>>>>> PD: excuse my rusty english, by the way =)
>>>>>>>
>>>>>>> --
>>>>>>> --------8<--------
>>>>>>> Carlos Gabriel Vergara
>>>>>>> http://www.ThorSecurity.com.ar
>>>>>>>
>>>>>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>>>>>> -------->8--------
>>>>>>>
>>>>>>> ------------------------------------------------------------------------------
>>>>>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>>>>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>>>>>> Spend less time writing and  rewriting code and more time creating great
>>>>>>> experiences on the web. Be a part of the beta today.
>>>>>>> http://p.sf.net/sfu/beautyoftheweb
>>>>>>> _______________________________________________
>>>>>>> sqlmap-users mailing list
>>>>>>> sql...@li...
>>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Miroslav Stampar
>>>>>>
>>>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>>>> Mobile: +385921010204 (HR 0921010204)
>>>>>> PGP Key ID: 0xB5397B1B
>>>>>> Location: Zagreb, Croatia
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Miroslav Stampar
>>>>>
>>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>>> Mobile: +385921010204 (HR 0921010204)
>>>>> PGP Key ID: 0xB5397B1B
>>>>> Location: Zagreb, Croatia
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Miroslav Stampar
>>>>
>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>> Mobile: +385921010204 (HR 0921010204)
>>>> PGP Key ID: 0xB5397B1B
>>>> Location: Zagreb, Croatia
>>>>
>>>
>>>
>>>
>>> --
>>> --------8<--------
>>> Carlos Gabriel Vergara
>>> http://www.ThorSecurity.com.ar
>>>
>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>> -------->8--------
>>>
>>> ------------------------------------------------------------------------------
>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>> Spend less time writing and  rewriting code and more time creating great
>>> experiences on the web. Be a part of the beta today.
>>> http://p.sf.net/sfu/beautyoftheweb
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>> Mobile: +385921010204 (HR 0921010204)
>> PGP Key ID: 0xB5397B1B
>> Location: Zagreb, Croatia
>>
>
>
>
> --
> --------8<--------
> Carlos Gabriel Vergara
> http://www.ThorSecurity.com.ar
>
> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
> -------->8--------
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] New feature

[Carlos G. V. <car...@gm...>]

For the last case, i mean to encode all the injection using %.

For example:

http://somehost/script.asp?id=SELECT%20FIELD%20FROM%20TABLE

to

http://somehost/script.asp?id=%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

This could be combined with the script that double encodes, since you
can stack tamper scripts.
By the way, a nice online tool to encode/decode can be found at:

http://yehg.net/encoding/

Best regards,

2010/10/13 Miroslav Stampar <mir...@gm...>:
> On Wed, Oct 13, 2010 at 3:55 PM, Carlos Gabriel Vergara
> <car...@gm...> wrote:
>> Good work!
>>
>> Will try it as soon as i have a minute.
>>
>> Some examples of tamper functions:
>>
>> a) Replace chars with %, with double encoding... i mean: %20 to %2520
>
> added ./tamper/doubleencode.py
>
>> b) Replace spaces with /**/ for mssql (i think theres already an
>> option for this in later versions)
>
> added ./tamper/space2comment.py
>
>> c) Related to a), replace all injection with encoding using %
>
> didn't understand this one. could you please explain it more. thx.
>
>>
>> If I remember something else, will post it.
>>
>> Best regards,
>> G
>>
>> 2010/10/13 Miroslav Stampar <mir...@gm...>:
>>> ...and yes, they can be stacked together:
>>>
>>> sample:
>>> --tamper="./tamper/ifnull2ifisnull.py;./tamper/dummy.py"
>>>
>>> bye
>>>
>>> On Wed, Oct 13, 2010 at 3:15 PM, Miroslav Stampar
>>> <mir...@gm...> wrote:
>>>> hello all.
>>>>
>>>> switch '--tamper' is now fully implemented in the latest SVN revision.
>>>> tampering modules must include function with declaration like 'def
>>>> tamper(place, value):'. argument 'place' states which injection place
>>>> ('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
>>>> value represent the old query value (prior to return value of that
>>>> tampering function).
>>>>
>>>> tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
>>>> so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
>>>> tampering modules/functions too.
>>>>
>>>> sample usage is:
>>>>
>>>> ./sqlmap.py -u "http://www.site.com/index.php?id=1"
>>>> --tamper="./tamper/ifnull2ifisnull.py"
>>>>
>>>> if you have any other suggestions for other useful tampering functions
>>>> please say and i'll try to implement it/them if it makes sense.
>>>>
>>>> kind regards.
>>>>
>>>> On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
>>>> <mir...@gm...> wrote:
>>>>> hi.
>>>>>
>>>>> now, there is an option "--tamper=<file>" which does this.
>>>>>
>>>>> you can play around with it using for example:
>>>>> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>>>>>
>>>>> for "practical" examples please wait for working version of
>>>>> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
>>>>> parenthesis in regular expression i use for recognizing parts of
>>>>> ifnull.
>>>>>
>>>>> kind regards.
>>>>>
>>>>> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
>>>>> <car...@gm...> wrote:
>>>>>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>>>>>> found the need of "touch" the urls that the tool crafts to send to the
>>>>>> server.
>>>>>> Most of the times this happens because all scenarios are some sort of
>>>>>> unique, even if they share the same DMBS.
>>>>>> In this cases i spend a lot of time programming pseudo proxys (quick
>>>>>> and dirty coding in python) to solve the obstacle.
>>>>>> I have some free time now, and want to make a module for sqlmap that
>>>>>> "tampers" the data to be send, let me introduce some logic to modify
>>>>>> it, and then send it to the server.
>>>>>> For example: i need to replace blanks with /**/ for a mssql server. I
>>>>>> will be using sqlmap like this:
>>>>>>
>>>>>> sqlmap -u "http://host/script.py?id=15" -p id
>>>>>> --tamper-script="/home/kaleb/script.py"
>>>>>>
>>>>>> In script.py, some sort of code that picks the GET/POST about to be
>>>>>> sent to the server, search for the blanks in the query, replace them
>>>>>> with /**/, and then give it back to sqlmap to be sended.
>>>>>>
>>>>>> Another example (mentioned in a previous thread): i need to replace
>>>>>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>>>>>> string manipulation, made in a mini proxy, losting performance in the
>>>>>> middle.
>>>>>>
>>>>>> The question: which part of sqlmap code i need to start reviewing?
>>>>>> Thus i used it a lot, never looked into the code. In need a little
>>>>>> tip, just to start with something in mind.
>>>>>>
>>>>>> Thanks a lot.
>>>>>>
>>>>>> PD: excuse my rusty english, by the way =)
>>>>>>
>>>>>> --
>>>>>> --------8<--------
>>>>>> Carlos Gabriel Vergara
>>>>>> http://www.ThorSecurity.com.ar
>>>>>>
>>>>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>>>>> -------->8--------
>>>>>>
>>>>>> ------------------------------------------------------------------------------
>>>>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>>>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>>>>> Spend less time writing and  rewriting code and more time creating great
>>>>>> experiences on the web. Be a part of the beta today.
>>>>>> http://p.sf.net/sfu/beautyoftheweb
>>>>>> _______________________________________________
>>>>>> sqlmap-users mailing list
>>>>>> sql...@li...
>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Miroslav Stampar
>>>>>
>>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>>> Mobile: +385921010204 (HR 0921010204)
>>>>> PGP Key ID: 0xB5397B1B
>>>>> Location: Zagreb, Croatia
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Miroslav Stampar
>>>>
>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>> Mobile: +385921010204 (HR 0921010204)
>>>> PGP Key ID: 0xB5397B1B
>>>> Location: Zagreb, Croatia
>>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>> Mobile: +385921010204 (HR 0921010204)
>>> PGP Key ID: 0xB5397B1B
>>> Location: Zagreb, Croatia
>>>
>>
>>
>>
>> --
>> --------8<--------
>> Carlos Gabriel Vergara
>> http://www.ThorSecurity.com.ar
>>
>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>> -------->8--------
>>
>> ------------------------------------------------------------------------------
>> Beautiful is writing same markup. Internet Explorer 9 supports
>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>> Spend less time writing and  rewriting code and more time creating great
>> experiences on the web. Be a part of the beta today.
>> http://p.sf.net/sfu/beautyoftheweb
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail / Jabber: miroslav.stampar (at) gmail.com
> Mobile: +385921010204 (HR 0921010204)
> PGP Key ID: 0xB5397B1B
> Location: Zagreb, Croatia
>



-- 
--------8<--------
Carlos Gabriel Vergara
http://www.ThorSecurity.com.ar

PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
-------->8--------

Re: [sqlmap-users] New feature

[Miroslav S. <mir...@gm...>]

On Wed, Oct 13, 2010 at 3:55 PM, Carlos Gabriel Vergara
<car...@gm...> wrote:
> Good work!
>
> Will try it as soon as i have a minute.
>
> Some examples of tamper functions:
>
> a) Replace chars with %, with double encoding... i mean: %20 to %2520

added ./tamper/doubleencode.py

> b) Replace spaces with /**/ for mssql (i think theres already an
> option for this in later versions)

added ./tamper/space2comment.py

> c) Related to a), replace all injection with encoding using %

didn't understand this one. could you please explain it more. thx.

>
> If I remember something else, will post it.
>
> Best regards,
> G
>
> 2010/10/13 Miroslav Stampar <mir...@gm...>:
>> ...and yes, they can be stacked together:
>>
>> sample:
>> --tamper="./tamper/ifnull2ifisnull.py;./tamper/dummy.py"
>>
>> bye
>>
>> On Wed, Oct 13, 2010 at 3:15 PM, Miroslav Stampar
>> <mir...@gm...> wrote:
>>> hello all.
>>>
>>> switch '--tamper' is now fully implemented in the latest SVN revision.
>>> tampering modules must include function with declaration like 'def
>>> tamper(place, value):'. argument 'place' states which injection place
>>> ('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
>>> value represent the old query value (prior to return value of that
>>> tampering function).
>>>
>>> tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
>>> so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
>>> tampering modules/functions too.
>>>
>>> sample usage is:
>>>
>>> ./sqlmap.py -u "http://www.site.com/index.php?id=1"
>>> --tamper="./tamper/ifnull2ifisnull.py"
>>>
>>> if you have any other suggestions for other useful tampering functions
>>> please say and i'll try to implement it/them if it makes sense.
>>>
>>> kind regards.
>>>
>>> On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
>>> <mir...@gm...> wrote:
>>>> hi.
>>>>
>>>> now, there is an option "--tamper=<file>" which does this.
>>>>
>>>> you can play around with it using for example:
>>>> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>>>>
>>>> for "practical" examples please wait for working version of
>>>> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
>>>> parenthesis in regular expression i use for recognizing parts of
>>>> ifnull.
>>>>
>>>> kind regards.
>>>>
>>>> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
>>>> <car...@gm...> wrote:
>>>>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>>>>> found the need of "touch" the urls that the tool crafts to send to the
>>>>> server.
>>>>> Most of the times this happens because all scenarios are some sort of
>>>>> unique, even if they share the same DMBS.
>>>>> In this cases i spend a lot of time programming pseudo proxys (quick
>>>>> and dirty coding in python) to solve the obstacle.
>>>>> I have some free time now, and want to make a module for sqlmap that
>>>>> "tampers" the data to be send, let me introduce some logic to modify
>>>>> it, and then send it to the server.
>>>>> For example: i need to replace blanks with /**/ for a mssql server. I
>>>>> will be using sqlmap like this:
>>>>>
>>>>> sqlmap -u "http://host/script.py?id=15" -p id
>>>>> --tamper-script="/home/kaleb/script.py"
>>>>>
>>>>> In script.py, some sort of code that picks the GET/POST about to be
>>>>> sent to the server, search for the blanks in the query, replace them
>>>>> with /**/, and then give it back to sqlmap to be sended.
>>>>>
>>>>> Another example (mentioned in a previous thread): i need to replace
>>>>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>>>>> string manipulation, made in a mini proxy, losting performance in the
>>>>> middle.
>>>>>
>>>>> The question: which part of sqlmap code i need to start reviewing?
>>>>> Thus i used it a lot, never looked into the code. In need a little
>>>>> tip, just to start with something in mind.
>>>>>
>>>>> Thanks a lot.
>>>>>
>>>>> PD: excuse my rusty english, by the way =)
>>>>>
>>>>> --
>>>>> --------8<--------
>>>>> Carlos Gabriel Vergara
>>>>> http://www.ThorSecurity.com.ar
>>>>>
>>>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>>>> -------->8--------
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>>>> Spend less time writing and  rewriting code and more time creating great
>>>>> experiences on the web. Be a part of the beta today.
>>>>> http://p.sf.net/sfu/beautyoftheweb
>>>>> _______________________________________________
>>>>> sqlmap-users mailing list
>>>>> sql...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Miroslav Stampar
>>>>
>>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>>> Mobile: +385921010204 (HR 0921010204)
>>>> PGP Key ID: 0xB5397B1B
>>>> Location: Zagreb, Croatia
>>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>> Mobile: +385921010204 (HR 0921010204)
>>> PGP Key ID: 0xB5397B1B
>>> Location: Zagreb, Croatia
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>> Mobile: +385921010204 (HR 0921010204)
>> PGP Key ID: 0xB5397B1B
>> Location: Zagreb, Croatia
>>
>
>
>
> --
> --------8<--------
> Carlos Gabriel Vergara
> http://www.ThorSecurity.com.ar
>
> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
> -------->8--------
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] New feature

[Carlos G. V. <car...@gm...>]

Good work!

Will try it as soon as i have a minute.

Some examples of tamper functions:

a) Replace chars with %, with double encoding... i mean: %20 to %2520
b) Replace spaces with /**/ for mssql (i think theres already an
option for this in later versions)
c) Related to a), replace all injection with encoding using %

If I remember something else, will post it.

Best regards,
G

2010/10/13 Miroslav Stampar <mir...@gm...>:
> ...and yes, they can be stacked together:
>
> sample:
> --tamper="./tamper/ifnull2ifisnull.py;./tamper/dummy.py"
>
> bye
>
> On Wed, Oct 13, 2010 at 3:15 PM, Miroslav Stampar
> <mir...@gm...> wrote:
>> hello all.
>>
>> switch '--tamper' is now fully implemented in the latest SVN revision.
>> tampering modules must include function with declaration like 'def
>> tamper(place, value):'. argument 'place' states which injection place
>> ('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
>> value represent the old query value (prior to return value of that
>> tampering function).
>>
>> tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
>> so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
>> tampering modules/functions too.
>>
>> sample usage is:
>>
>> ./sqlmap.py -u "http://www.site.com/index.php?id=1"
>> --tamper="./tamper/ifnull2ifisnull.py"
>>
>> if you have any other suggestions for other useful tampering functions
>> please say and i'll try to implement it/them if it makes sense.
>>
>> kind regards.
>>
>> On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
>> <mir...@gm...> wrote:
>>> hi.
>>>
>>> now, there is an option "--tamper=<file>" which does this.
>>>
>>> you can play around with it using for example:
>>> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>>>
>>> for "practical" examples please wait for working version of
>>> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
>>> parenthesis in regular expression i use for recognizing parts of
>>> ifnull.
>>>
>>> kind regards.
>>>
>>> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
>>> <car...@gm...> wrote:
>>>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>>>> found the need of "touch" the urls that the tool crafts to send to the
>>>> server.
>>>> Most of the times this happens because all scenarios are some sort of
>>>> unique, even if they share the same DMBS.
>>>> In this cases i spend a lot of time programming pseudo proxys (quick
>>>> and dirty coding in python) to solve the obstacle.
>>>> I have some free time now, and want to make a module for sqlmap that
>>>> "tampers" the data to be send, let me introduce some logic to modify
>>>> it, and then send it to the server.
>>>> For example: i need to replace blanks with /**/ for a mssql server. I
>>>> will be using sqlmap like this:
>>>>
>>>> sqlmap -u "http://host/script.py?id=15" -p id
>>>> --tamper-script="/home/kaleb/script.py"
>>>>
>>>> In script.py, some sort of code that picks the GET/POST about to be
>>>> sent to the server, search for the blanks in the query, replace them
>>>> with /**/, and then give it back to sqlmap to be sended.
>>>>
>>>> Another example (mentioned in a previous thread): i need to replace
>>>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>>>> string manipulation, made in a mini proxy, losting performance in the
>>>> middle.
>>>>
>>>> The question: which part of sqlmap code i need to start reviewing?
>>>> Thus i used it a lot, never looked into the code. In need a little
>>>> tip, just to start with something in mind.
>>>>
>>>> Thanks a lot.
>>>>
>>>> PD: excuse my rusty english, by the way =)
>>>>
>>>> --
>>>> --------8<--------
>>>> Carlos Gabriel Vergara
>>>> http://www.ThorSecurity.com.ar
>>>>
>>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>>> -------->8--------
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>>> Spend less time writing and  rewriting code and more time creating great
>>>> experiences on the web. Be a part of the beta today.
>>>> http://p.sf.net/sfu/beautyoftheweb
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>> sql...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>>> Mobile: +385921010204 (HR 0921010204)
>>> PGP Key ID: 0xB5397B1B
>>> Location: Zagreb, Croatia
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>> Mobile: +385921010204 (HR 0921010204)
>> PGP Key ID: 0xB5397B1B
>> Location: Zagreb, Croatia
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail / Jabber: miroslav.stampar (at) gmail.com
> Mobile: +385921010204 (HR 0921010204)
> PGP Key ID: 0xB5397B1B
> Location: Zagreb, Croatia
>



-- 
--------8<--------
Carlos Gabriel Vergara
http://www.ThorSecurity.com.ar

PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
-------->8--------

Re: [sqlmap-users] New feature

[Miroslav S. <mir...@gm...>]

...and yes, they can be stacked together:

sample:
--tamper="./tamper/ifnull2ifisnull.py;./tamper/dummy.py"

bye

On Wed, Oct 13, 2010 at 3:15 PM, Miroslav Stampar
<mir...@gm...> wrote:
> hello all.
>
> switch '--tamper' is now fully implemented in the latest SVN revision.
> tampering modules must include function with declaration like 'def
> tamper(place, value):'. argument 'place' states which injection place
> ('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
> value represent the old query value (prior to return value of that
> tampering function).
>
> tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
> so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
> tampering modules/functions too.
>
> sample usage is:
>
> ./sqlmap.py -u "http://www.site.com/index.php?id=1"
> --tamper="./tamper/ifnull2ifisnull.py"
>
> if you have any other suggestions for other useful tampering functions
> please say and i'll try to implement it/them if it makes sense.
>
> kind regards.
>
> On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
> <mir...@gm...> wrote:
>> hi.
>>
>> now, there is an option "--tamper=<file>" which does this.
>>
>> you can play around with it using for example:
>> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>>
>> for "practical" examples please wait for working version of
>> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
>> parenthesis in regular expression i use for recognizing parts of
>> ifnull.
>>
>> kind regards.
>>
>> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
>> <car...@gm...> wrote:
>>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>>> found the need of "touch" the urls that the tool crafts to send to the
>>> server.
>>> Most of the times this happens because all scenarios are some sort of
>>> unique, even if they share the same DMBS.
>>> In this cases i spend a lot of time programming pseudo proxys (quick
>>> and dirty coding in python) to solve the obstacle.
>>> I have some free time now, and want to make a module for sqlmap that
>>> "tampers" the data to be send, let me introduce some logic to modify
>>> it, and then send it to the server.
>>> For example: i need to replace blanks with /**/ for a mssql server. I
>>> will be using sqlmap like this:
>>>
>>> sqlmap -u "http://host/script.py?id=15" -p id
>>> --tamper-script="/home/kaleb/script.py"
>>>
>>> In script.py, some sort of code that picks the GET/POST about to be
>>> sent to the server, search for the blanks in the query, replace them
>>> with /**/, and then give it back to sqlmap to be sended.
>>>
>>> Another example (mentioned in a previous thread): i need to replace
>>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>>> string manipulation, made in a mini proxy, losting performance in the
>>> middle.
>>>
>>> The question: which part of sqlmap code i need to start reviewing?
>>> Thus i used it a lot, never looked into the code. In need a little
>>> tip, just to start with something in mind.
>>>
>>> Thanks a lot.
>>>
>>> PD: excuse my rusty english, by the way =)
>>>
>>> --
>>> --------8<--------
>>> Carlos Gabriel Vergara
>>> http://www.ThorSecurity.com.ar
>>>
>>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>>> -------->8--------
>>>
>>> ------------------------------------------------------------------------------
>>> Beautiful is writing same markup. Internet Explorer 9 supports
>>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>>> Spend less time writing and  rewriting code and more time creating great
>>> experiences on the web. Be a part of the beta today.
>>> http://p.sf.net/sfu/beautyoftheweb
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>> Mobile: +385921010204 (HR 0921010204)
>> PGP Key ID: 0xB5397B1B
>> Location: Zagreb, Croatia
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail / Jabber: miroslav.stampar (at) gmail.com
> Mobile: +385921010204 (HR 0921010204)
> PGP Key ID: 0xB5397B1B
> Location: Zagreb, Croatia
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] New feature

[Miroslav S. <mir...@gm...>]

hello all.

switch '--tamper' is now fully implemented in the latest SVN revision.
tampering modules must include function with declaration like 'def
tamper(place, value):'. argument 'place' states which injection place
('POST', 'GET', 'URI' or 'User-Agent') is query being used for, while
value represent the old query value (prior to return value of that
tampering function).

tampering function for IFNULL(A,B) -> IF(ISNULL(A),B,A) is implemented
so far (./sqlmap/tamper/ifnull2ifisnull.py) but you can make your own
tampering modules/functions too.

sample usage is:

./sqlmap.py -u "http://www.site.com/index.php?id=1"
--tamper="./tamper/ifnull2ifisnull.py"

if you have any other suggestions for other useful tampering functions
please say and i'll try to implement it/them if it makes sense.

kind regards.

On Wed, Oct 13, 2010 at 9:43 AM, Miroslav Stampar
<mir...@gm...> wrote:
> hi.
>
> now, there is an option "--tamper=<file>" which does this.
>
> you can play around with it using for example:
> ./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"
>
> for "practical" examples please wait for working version of
> ./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
> parenthesis in regular expression i use for recognizing parts of
> ifnull.
>
> kind regards.
>
> On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
> <car...@gm...> wrote:
>> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
>> found the need of "touch" the urls that the tool crafts to send to the
>> server.
>> Most of the times this happens because all scenarios are some sort of
>> unique, even if they share the same DMBS.
>> In this cases i spend a lot of time programming pseudo proxys (quick
>> and dirty coding in python) to solve the obstacle.
>> I have some free time now, and want to make a module for sqlmap that
>> "tampers" the data to be send, let me introduce some logic to modify
>> it, and then send it to the server.
>> For example: i need to replace blanks with /**/ for a mssql server. I
>> will be using sqlmap like this:
>>
>> sqlmap -u "http://host/script.py?id=15" -p id
>> --tamper-script="/home/kaleb/script.py"
>>
>> In script.py, some sort of code that picks the GET/POST about to be
>> sent to the server, search for the blanks in the query, replace them
>> with /**/, and then give it back to sqlmap to be sended.
>>
>> Another example (mentioned in a previous thread): i need to replace
>> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
>> string manipulation, made in a mini proxy, losting performance in the
>> middle.
>>
>> The question: which part of sqlmap code i need to start reviewing?
>> Thus i used it a lot, never looked into the code. In need a little
>> tip, just to start with something in mind.
>>
>> Thanks a lot.
>>
>> PD: excuse my rusty english, by the way =)
>>
>> --
>> --------8<--------
>> Carlos Gabriel Vergara
>> http://www.ThorSecurity.com.ar
>>
>> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
>> -------->8--------
>>
>> ------------------------------------------------------------------------------
>> Beautiful is writing same markup. Internet Explorer 9 supports
>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>> Spend less time writing and  rewriting code and more time creating great
>> experiences on the web. Be a part of the beta today.
>> http://p.sf.net/sfu/beautyoftheweb
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail / Jabber: miroslav.stampar (at) gmail.com
> Mobile: +385921010204 (HR 0921010204)
> PGP Key ID: 0xB5397B1B
> Location: Zagreb, Croatia
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] New feature

[Miroslav S. <mir...@gm...>]

hi.

now, there is an option "--tamper=<file>" which does this.

you can play around with it using for example:
./sqlmap.py -u "www.test.com" --tamper="./tamper/dummy.py"

for "practical" examples please wait for working version of
./tamper/ifnull2ifisnull.py. i need to solve the problem of counting
parenthesis in regular expression i use for recognizing parts of
ifnull.

kind regards.

On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
<car...@gm...> wrote:
> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
> found the need of "touch" the urls that the tool crafts to send to the
> server.
> Most of the times this happens because all scenarios are some sort of
> unique, even if they share the same DMBS.
> In this cases i spend a lot of time programming pseudo proxys (quick
> and dirty coding in python) to solve the obstacle.
> I have some free time now, and want to make a module for sqlmap that
> "tampers" the data to be send, let me introduce some logic to modify
> it, and then send it to the server.
> For example: i need to replace blanks with /**/ for a mssql server. I
> will be using sqlmap like this:
>
> sqlmap -u "http://host/script.py?id=15" -p id
> --tamper-script="/home/kaleb/script.py"
>
> In script.py, some sort of code that picks the GET/POST about to be
> sent to the server, search for the blanks in the query, replace them
> with /**/, and then give it back to sqlmap to be sended.
>
> Another example (mentioned in a previous thread): i need to replace
> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
> string manipulation, made in a mini proxy, losting performance in the
> middle.
>
> The question: which part of sqlmap code i need to start reviewing?
> Thus i used it a lot, never looked into the code. In need a little
> tip, just to start with something in mind.
>
> Thanks a lot.
>
> PD: excuse my rusty english, by the way =)
>
> --
> --------8<--------
> Carlos Gabriel Vergara
> http://www.ThorSecurity.com.ar
>
> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
> -------->8--------
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] Introducing --text-only switch

[Miroslav S. <mir...@gm...>]

hi.

they are also left out (see that regular expression down in p.s.: <[^>]+>)

bye

On Wed, Oct 13, 2010 at 12:27 AM, Carlos Gabriel Vergara
<car...@gm...> wrote:
> What about CDATA tags and comments (<!-- -->)?
>
> 2010/10/12 Miroslav Stampar <mir...@gm...>:
>> Hi.
>>
>> With the latest SVN commit we've introduced new switch --text-only. It
>> should sharp up detection engine capabilities of sqlmap by using
>> comparison of only textual parts of retrieved pages. This means that
>> page parts as javascript code, style guidelines and general tags are
>> going to be cleaned up before the comparison phase removing most
>> probably irrelevant and/or dynamic parts of the queries page. Please,
>> report any problems you might encounter while using it.
>>
>> Kind regards.
>>
>> p.s. generally, we are removing parts described by this regular
>> expression: <script.+?</script>|<style.+?</style>|<[^>]+>
>> if you have any other suggestion(s) you are more than welcome to give it.
>>
>> --
>> Miroslav Stampar
>>
>> E-mail / Jabber: miroslav.stampar (at) gmail.com
>> Mobile: +385921010204 (HR 0921010204)
>> PGP Key ID: 0xB5397B1B
>> Location: Zagreb, Croatia
>>
>> ------------------------------------------------------------------------------
>> Beautiful is writing same markup. Internet Explorer 9 supports
>> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
>> Spend less time writing and  rewriting code and more time creating great
>> experiences on the web. Be a part of the beta today.
>> http://p.sf.net/sfu/beautyoftheweb
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> --------8<--------
> Carlos Gabriel Vergara
> http://www.ThorSecurity.com.ar
>
> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
> -------->8--------
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] Introducing --text-only switch

[Carlos G. V. <car...@gm...>]

What about CDATA tags and comments (<!-- -->)?

2010/10/12 Miroslav Stampar <mir...@gm...>:
> Hi.
>
> With the latest SVN commit we've introduced new switch --text-only. It
> should sharp up detection engine capabilities of sqlmap by using
> comparison of only textual parts of retrieved pages. This means that
> page parts as javascript code, style guidelines and general tags are
> going to be cleaned up before the comparison phase removing most
> probably irrelevant and/or dynamic parts of the queries page. Please,
> report any problems you might encounter while using it.
>
> Kind regards.
>
> p.s. generally, we are removing parts described by this regular
> expression: <script.+?</script>|<style.+?</style>|<[^>]+>
> if you have any other suggestion(s) you are more than welcome to give it.
>
> --
> Miroslav Stampar
>
> E-mail / Jabber: miroslav.stampar (at) gmail.com
> Mobile: +385921010204 (HR 0921010204)
> PGP Key ID: 0xB5397B1B
> Location: Zagreb, Croatia
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
--------8<--------
Carlos Gabriel Vergara
http://www.ThorSecurity.com.ar

PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
-------->8--------

Re: [sqlmap-users] New feature

[Miroslav S. <mir...@gm...>]

hi Carlos.

i've understood the problem and i will try to make something out (no
need for you to code it).

kind regards.

On Tue, Oct 12, 2010 at 8:02 PM, Carlos Gabriel Vergara
<car...@gm...> wrote:
> Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
> found the need of "touch" the urls that the tool crafts to send to the
> server.
> Most of the times this happens because all scenarios are some sort of
> unique, even if they share the same DMBS.
> In this cases i spend a lot of time programming pseudo proxys (quick
> and dirty coding in python) to solve the obstacle.
> I have some free time now, and want to make a module for sqlmap that
> "tampers" the data to be send, let me introduce some logic to modify
> it, and then send it to the server.
> For example: i need to replace blanks with /**/ for a mssql server. I
> will be using sqlmap like this:
>
> sqlmap -u "http://host/script.py?id=15" -p id
> --tamper-script="/home/kaleb/script.py"
>
> In script.py, some sort of code that picks the GET/POST about to be
> sent to the server, search for the blanks in the query, replace them
> with /**/, and then give it back to sqlmap to be sended.
>
> Another example (mentioned in a previous thread): i need to replace
> IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
> string manipulation, made in a mini proxy, losting performance in the
> middle.
>
> The question: which part of sqlmap code i need to start reviewing?
> Thus i used it a lot, never looked into the code. In need a little
> tip, just to start with something in mind.
>
> Thanks a lot.
>
> PD: excuse my rusty english, by the way =)
>
> --
> --------8<--------
> Carlos Gabriel Vergara
> http://www.ThorSecurity.com.ar
>
> PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
> -------->8--------
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

[sqlmap-users] Introducing --text-only switch

[Miroslav S. <mir...@gm...>]

Hi.

With the latest SVN commit we've introduced new switch --text-only. It
should sharp up detection engine capabilities of sqlmap by using
comparison of only textual parts of retrieved pages. This means that
page parts as javascript code, style guidelines and general tags are
going to be cleaned up before the comparison phase removing most
probably irrelevant and/or dynamic parts of the queries page. Please,
report any problems you might encounter while using it.

Kind regards.

p.s. generally, we are removing parts described by this regular
expression: <script.+?</script>|<style.+?</style>|<[^>]+>
if you have any other suggestion(s) you are more than welcome to give it.

-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

[sqlmap-users] New feature

[Carlos G. V. <car...@gm...>]

Hi! I was using sqlmap for a year or two, and in a lot of scenarios i
found the need of "touch" the urls that the tool crafts to send to the
server.
Most of the times this happens because all scenarios are some sort of
unique, even if they share the same DMBS.
In this cases i spend a lot of time programming pseudo proxys (quick
and dirty coding in python) to solve the obstacle.
I have some free time now, and want to make a module for sqlmap that
"tampers" the data to be send, let me introduce some logic to modify
it, and then send it to the server.
For example: i need to replace blanks with /**/ for a mssql server. I
will be using sqlmap like this:

sqlmap -u "http://host/script.py?id=15" -p id
--tamper-script="/home/kaleb/script.py"

In script.py, some sort of code that picks the GET/POST about to be
sent to the server, search for the blanks in the query, replace them
with /**/, and then give it back to sqlmap to be sended.

Another example (mentioned in a previous thread): i need to replace
IFNULL(A,B) sentence with IF(ISNULL(A), B, A). It needed a lot of
string manipulation, made in a mini proxy, losting performance in the
middle.

The question: which part of sqlmap code i need to start reviewing?
Thus i used it a lot, never looked into the code. In need a little
tip, just to start with something in mind.

Thanks a lot.

PD: excuse my rusty english, by the way =)

-- 
--------8<--------
Carlos Gabriel Vergara
http://www.ThorSecurity.com.ar

PGP: http://www.ThorSecurity.com.ar/gabrielvergara.pgp
-------->8--------

Re: [sqlmap-users] sql injection without URL Parameter

[Philippe A. R. S. <sc...@co...>]

 Hi,
> fixed ;)
>
There still seems to be some problem with "URI marks".
Some chars are not mapped correctly:

back-end DBMS: MySQL 5

but:
banner:    '5 0(67'

Cheers,

Philippe

Re: [sqlmap-users] sql injection without URL Parameter

[Philippe A. R. S. <sc...@co...>]

 Am 11.10.2010 16:32, schrieb Miroslav Stampar:
> fixed ;)
>
That was fast!
Works like a charm, thanx a lot!

Re: [sqlmap-users] sql injection without URL Parameter

[Miroslav S. <mir...@gm...>]

fixed ;)

kind regards

On Mon, Oct 11, 2010 at 3:53 PM, Philippe A. R. Schaeffer
<sc...@co...> wrote:
>  Hi,
>
> I just gave the new "URI Marker" a try with the following result:
>
> ./sqlmap.py -u "http://www.site.com/path/Id/978-3-7857-6020-8*"
>
> sqlmap version: 0.9-dev
> Python version: 2.5.2
> Operating system: posix
> Traceback (most recent call last):
>  File "./sqlmap.py", line 96, in main
>    start()
>  File "/vol/tools/sqlmap-dev/lib/controller/controller.py", line 236,
> in start
>    heuristicCheckSqlInjection(place, parameter, value)
>  File "/vol/tools/sqlmap-dev/lib/controller/checks.py", line 111, in
> heuristicCheckSqlInjection
>    Request.queryPage(payload, place)
>  File "/vol/tools/sqlmap-dev/lib/request/connect.py", line 347, in
> queryPage
>    page, headers = Connect.getPage(url=uri, get=get, post=post,
> cookie=cookie, ua=ua, silent=silent, method=method,
> auxHeaders=auxHeaders, response=response, raise404=raise404)
>  File "/vol/tools/sqlmap-dev/lib/request/connect.py", line 177, in
> getPage
>    conn = urllib2.urlopen(req)
>  File "/usr/lib/python2.5/urllib2.py", line 124, in urlopen
>    return _opener.open(url, data)
>  File "/usr/lib/python2.5/urllib2.py", line 373, in open
>    protocol = req.get_type()
>  File "/usr/lib/python2.5/urllib2.py", line 244, in get_type
>    raise ValueError, "unknown url type: %s" % self.__original
> ValueError: unknown url type: '"'"''"))"
>
>
> The Code ran as far as:
> [15:48:50] [INFO] testing if URI parameter '#1' is dynamic
> [15:48:57] [INFO] confirming that URI parameter '#1' is dynamic
> [15:49:13] [INFO] URI parameter '#1' is dynamic
> [15:49:13] [CRITICAL] unhandled exception in sqlmap/0.9-dev
>
> If I find some time I will also try to take look into it.
> Until then any feedback is welcome ;-)
>
> Cheers,
>
> Philippe
>
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

Re: [sqlmap-users] sql injection without URL Parameter

[Philippe A. R. S. <sc...@co...>]

 Hi,

I just gave the new "URI Marker" a try with the following result:

./sqlmap.py -u "http://www.site.com/path/Id/978-3-7857-6020-8*"

sqlmap version: 0.9-dev
Python version: 2.5.2
Operating system: posix
Traceback (most recent call last):
  File "./sqlmap.py", line 96, in main
    start()
  File "/vol/tools/sqlmap-dev/lib/controller/controller.py", line 236,
in start
    heuristicCheckSqlInjection(place, parameter, value)
  File "/vol/tools/sqlmap-dev/lib/controller/checks.py", line 111, in
heuristicCheckSqlInjection
    Request.queryPage(payload, place)
  File "/vol/tools/sqlmap-dev/lib/request/connect.py", line 347, in
queryPage
    page, headers = Connect.getPage(url=uri, get=get, post=post,
cookie=cookie, ua=ua, silent=silent, method=method,
auxHeaders=auxHeaders, response=response, raise404=raise404)
  File "/vol/tools/sqlmap-dev/lib/request/connect.py", line 177, in
getPage
    conn = urllib2.urlopen(req)
  File "/usr/lib/python2.5/urllib2.py", line 124, in urlopen
    return _opener.open(url, data)
  File "/usr/lib/python2.5/urllib2.py", line 373, in open
    protocol = req.get_type()
  File "/usr/lib/python2.5/urllib2.py", line 244, in get_type
    raise ValueError, "unknown url type: %s" % self.__original
ValueError: unknown url type: '"'"''"))"


The Code ran as far as:
[15:48:50] [INFO] testing if URI parameter '#1' is dynamic
[15:48:57] [INFO] confirming that URI parameter '#1' is dynamic
[15:49:13] [INFO] URI parameter '#1' is dynamic
[15:49:13] [CRITICAL] unhandled exception in sqlmap/0.9-dev

If I find some time I will also try to take look into it.
Until then any feedback is welcome ;-)

Cheers,

Philippe

Re: [sqlmap-users] Silly bug

[Miroslav S. <mir...@gm...>]

hi.

thank you for your report. update to the latest version from our SVN
repository to have it fixed (new sessions will be saved correctly from
now on).

bye.

On Sun, Oct 10, 2010 at 9:45 PM,  <ja...@ev...> wrote:
> Hello,
>
>  While pen-testing a web app with SQLMap-Dev (Latest SVN) I noted that
> while testing an injectable parameter with '[]' in it is not marked as
> exploitable in the session file(It has to reidentify it every time). I
> believe this is because of the way sqlmap saves session files
> [url][parm] etc... How can we make it so arg[]='s are picked up and
> saved in the session file?
>
>
> Thanks
> James
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail / Jabber: miroslav.stampar (at) gmail.com
Mobile: +385921010204 (HR 0921010204)
PGP Key ID: 0xB5397B1B
Location: Zagreb, Croatia

[sqlmap-users] Silly bug

[<ja...@ev...>]

Hello,

 While pen-testing a web app with SQLMap-Dev (Latest SVN) I noted that 
while testing an injectable parameter with '[]' in it is not marked as 
exploitable in the session file(It has to reidentify it every time). I 
believe this is because of the way sqlmap saves session files 
[url][parm] etc... How can we make it so arg[]='s are picked up and 
saved in the session file?


Thanks
James