sqlmap-users — sqlmap users mailing list

[sqlmap-users] I: Re: critical

[<ju...@li...>]

----Messaggio originale----

Da: ju...@li...

Data: 01/12/2013 13.46

A: <mir...@gm...>

Cc: <sql...@li...>

Ogg: R: Re: [sqlmap-users] critical



Sorry,
here the missing part...bye



[13:35:56] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the GitHub repository. If the exception persists, please send by e-mail to 'sql...@li...' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: posix
Command line: ./sqlmap -u "http://95.237.248.69/dvwa/vulnerabilities/sqli/?id=1&amp;Submit=Submit#" --cookie "PHPSESSID=2lvbrc86nn45asqhforkqojr87; security=low" --reg-read =HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "./sqlmap", line 87, in main
    start()
  File "/usr/share/sqlmap/lib/controller/controller.py", line 572, in start
    action()
  File "/usr/share/sqlmap/lib/controller/action.py", line 173, in action
    conf.dumper.registerValue(conf.dbmsHandler.regRead())
  File "/usr/share/sqlmap/lib/core/dump.py", line 612, in registerValue
    self.string("Registry key value data", registerData, registerData, content_type=CONTENT_TYPE.REG_READ, sort=False)
TypeError: string() got multiple values for keyword argument 'content_type'


----Messaggio originale----

Da: mir...@gm...

Data: 22/11/2013 6.49

A: <ju...@li...>

Cc: "SqlMap List"<sql...@li...>

Ogg: Re: [sqlmap-users] critical


Hi.
We need a whole stack trace for us to be able to trace it and fix it. Please last part is missing with code info. 
Bye
On Nov 22, 2013 12:17 AM, "ju...@li..." <ju...@li...> wrote:

[00:06:55] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the GitHub repository. If the exception persists, please send by e-mail to 'sql...@li...' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.

sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: posix
Command line: ./sqlmap -u *********************************************************************** --cookie=************************************************** --string=First name: Gordon --reg-read

Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)

 
------------------------------------------------------------------------------

Shape the Mobile Experience: Free Subscription

Software experts and developers: Be at the forefront of tech innovation.

Intel(R) Software Adrenaline delivers strategic insight and game-changing

conversations that shape the rapidly evolving mobile landscape. Sign up now.

http://pubads.g.doubleclick.net/gampad/clk?id=63431311&amp;iu=/4140/ostg.clktrk
_______________________________________________


sqlmap-users mailing list

sql...@li...

https://lists.sourceforge.net/lists/listinfo/sqlmap-users







 

[sqlmap-users] R: Re: critical

[<ju...@li...>]

Sorry,
here the missing part...bye



[13:35:56] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the GitHub repository. If the exception persists, please send by e-mail to 'sql...@li...' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: posix
Command line: ./sqlmap -u "http://95.237.248.69/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "PHPSESSID=2lvbrc86nn45asqhforkqojr87; security=low" --reg-read =HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)



----Messaggio originale----

Da: mir...@gm...

Data: 22/11/2013 6.49

A: <ju...@li...>

Cc: "SqlMap List"<sql...@li...>

Ogg: Re: [sqlmap-users] critical



Hi.
We need a whole stack trace for us to be able to trace it and fix it. Please last part is missing with code info. 
Bye
On Nov 22, 2013 12:17 AM, "ju...@li..." <ju...@li...> wrote:

[00:06:55] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the GitHub repository. If the exception persists, please send by e-mail to 'sql...@li...' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.

sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: posix
Command line: ./sqlmap -u *********************************************************************** --cookie=************************************************** --string=First name: Gordon --reg-read

Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)

 
------------------------------------------------------------------------------

Shape the Mobile Experience: Free Subscription

Software experts and developers: Be at the forefront of tech innovation.

Intel(R) Software Adrenaline delivers strategic insight and game-changing

conversations that shape the rapidly evolving mobile landscape. Sign up now.

http://pubads.g.doubleclick.net/gampad/clk?id=63431311&amp;iu=/4140/ostg.clktrk
_______________________________________________


sqlmap-users mailing list

sql...@li...

https://lists.sourceforge.net/lists/listinfo/sqlmap-users







 

[sqlmap-users] (no subject)

[mastermind <cyb...@ma...>]

[15:10:45] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest developm
ent version from the GitHub repository. If the exception persists, please send by e-mail to 'sqlmap-
us...@li...' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/
new' with the following text and any information required to reproduce the bug. The developers will
try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.5
Operating system: nt
Command line: C:\Users\Mastermind\Desktop\Hack\SQLmap\sqlmap.py -g ****************** --random-agent
 -o --keep-alive --threads=10 --batch --is-dba --dbs --beep --page-rank --smart
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\sqlmap.py", line 95, in main
    start()
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\lib\controller\controller.py", line 363, in start
    if not checkConnection(suppressOutput=conf.forms) or not checkString() or not checkRegexp():
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\lib\controller\checks.py", line 1207, in checkConnec
tion
    page, _ = Request.queryPage(content=True, noteResponseTime=False)
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\lib\request\connect.py", line 880, in queryPage
    page, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer
=referer, host=host, silent=silent, method=method, auxHeaders=auxHeaders, response=response, raise40
4=raise404, ignoreTimeout=timeBasedCompare)
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\lib\request\connect.py", line 383, in getPage
    conn = urllib2.urlopen(req)
  File "C:\Python27\lib\urllib2.py", line 127, in urlopen
    return _opener.open(url, data, timeout)
  File "C:\Python27\lib\urllib2.py", line 404, in open
    response = self._open(req, data)
  File "C:\Python27\lib\urllib2.py", line 422, in _open
    '_open', req)
  File "C:\Python27\lib\urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\thirdparty\keepalive\keepalive.py", line 210, in htt
p_open
    return self.do_open(HTTPConnection, req)
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\thirdparty\keepalive\keepalive.py", line 207, in do_
open
    return self.parent.error('http', req, r, r.status, r.reason, r.msg)
  File "C:\Python27\lib\urllib2.py", line 442, in error
    result = self._call_chain(*args)
  File "C:\Python27\lib\urllib2.py", line 382, in _call_chain
    result = func(*args)
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\lib\request\redirecthandler.py", line 92, in http_er
ror_302
    redirectMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, getUnicode(msg))
  File "C:\Users\Mastermind\Desktop\Hack\SQLmap\lib\core\common.py", line 1962, in getUnicode
    return unicode(value)  # encoding ignored for non-basestring instances
UnicodeDecodeError: 'ascii' codec can't decode byte 0xcd in position 14: ordinal not in range(128)

[sqlmap-users] Ms09-004 on W2K3SP2

[Luis R. <lui...@gm...>]

Hello All,

Since this is my first post I want to make sure that I write that sqlmap is
a brilliant tool and congratulations to the devteam!


I have a question that you might know. I am using sqlmap version
1.0-dev-cda27ec.


Consider a victim system running Windows 2003 SP2 English version with HAL
version : 5.2.3790.3959 (srv03_sp2_rtm.070216-1710) with MSSQL2005 on
VMware Workstation.


>From the attacker I am trying to take advantage of the MS09-004 and when I
try to execute the ./sqlmap.py  -u 'http://vulnerable/page.aspx'
--data=`cat data` --prefix="1', 1);" --suffix="--"  --fresh-queries
--os-bof     it generates an error:

 [13:17:51] [CRITICAL] sqlmap can not exploit the stored procedure buffer
overflow because it does not have a valid return code for the underlying
operating system (Windows 2003 Service Pack 0)


I took a look at the file /plugins/dbms/mssqlserver/takeover.py and saw the
following lines commented out:

2003 Service Pack 2 updated at 12/2008 (....)

2003 Service Pack 2 updated at 09/2009 (....)


I remove the comment but still the same problem. ...the tool seems to
determine that the OS does not contain any SP when in fact it has SP2...


Any ideas?


Thank you,

Luis

Re: [sqlmap-users] Manipulating JSON types to induce SQL errors

[Miroslav S. <mir...@gm...>]

Hi Brandon.

sqlmap does the same thing when doing the SQLi against integer-like
parameters. If we have to inject something into those kind of parameters we
automatically enclose the new value with quotes.

Bye
On Nov 26, 2013 8:02 PM, "Brandon Perry" <bpe...@gm...> wrote:

> A technique I find quite useful on web applications that are weakly-typed
> is manipulating the data within JSON to be more susceptible to fuzzing for
> SQLi.
>
> For instance {"id":0} can be made {"id":"0"} as long as the application
> isn't caring what the type of the ID is (rails, python, perl, etc...).
>
> Generally I do this manually, does sqlmap support this type of
> manipulation? If not, would a tamper script be the solution to automating
> this?
>
> Thanks!
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>
>
> ------------------------------------------------------------------------------
> Rapidly troubleshoot problems before they affect your business. Most IT
> organizations don't have a clear picture of how application performance
> affects their revenue. With AppDynamics, you get 100% visibility into your
> Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics
> Pro!
> http://pubads.g.doubleclick.net/gampad/clk?id=84349351&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] Sqlmap terminated when try to execute system command via sqli

[Trần T. <tra...@gm...>]

please help me

[11:40:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run
with the latest development version from the GitHub repository. If the
exception persists, please send by e-mail to '
sql...@li...' or open a new issue at '
https://github.com/sqlmapproject/sqlmap/issues/new' with the following text
and any information required to reproduce the bug. The developers will try
to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: posix
Command line: ./sqlmap -u
********************************************************************************************
--os-cmd=ls --threads 10
Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "./sqlmap", line 95, in main
    start()
  File "/usr/share/sqlmap/lib/controller/controller.py", line 582, in start
    action()
  File "/usr/share/sqlmap/lib/controller/action.py", line 157, in action
    conf.dbmsHandler.osCmd()
  File "/usr/share/sqlmap/plugins/generic/takeover.py", line 57, in osCmd
    self.initEnv(web=web)
  File "/usr/share/sqlmap/lib/takeover/abstraction.py", line 198, in initEnv
    success = self.udfInjectSys()
  File "/usr/share/sqlmap/lib/takeover/udf.py", line 184, in udfInjectSys
    return self.udfInjectCore(self.sysUdfs)
  File "/usr/share/sqlmap/lib/takeover/udf.py", line 149, in udfInjectCore
    written = self.writeFile(self.udfLocalFile, self.udfRemoteFile,
"binary", forceCheck=True)
  File "/usr/share/sqlmap/plugins/generic/filesystem.py", line 270, in
writeFile
    written = self.stackedWriteFile(localFile, remoteFile, fileType,
forceCheck)
  File "/usr/share/sqlmap/plugins/dbms/mysql/filesystem.py", line 117, in
stackedWriteFile
    fcEncodedList = self.fileEncode(wFile, "hex", False)
  File "/usr/share/sqlmap/plugins/generic/filesystem.py", line 114, in
fileEncode
    with open(fileName, "rb") as f:
IOError: [Errno 2] No such file or directory:
u'/usr/share/sqlmap/udf/mysql/linux/32/lib_mysqludf_sys.so'

[sqlmap-users] Manipulating JSON types to induce SQL errors

[Brandon P. <bpe...@gm...>]

A technique I find quite useful on web applications that are weakly-typed
is manipulating the data within JSON to be more susceptible to fuzzing for
SQLi.

For instance {"id":0} can be made {"id":"0"} as long as the application
isn't caring what the type of the ID is (rails, python, perl, etc...).

Generally I do this manually, does sqlmap support this type of
manipulation? If not, would a tamper script be the solution to automating
this?

Thanks!

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

[sqlmap-users] SQLmap plugin error

[Pushpa JL <pus...@sp...>]

    sqlmap/0.7
    by Bernardo Damele A. G. <ber...@gm...>
    
[*] starting at: 15:45:46

[15:45:46] [INFO] testing connection to the target url
[15:45:47] [INFO] testing if the url is stable, wait a few seconds
[15:45:48] [INFO] url is stable
[15:45:48] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
[15:45:49] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
[15:45:49] [INFO] testing if Cookie parameter 'ASPSESSIONIDCABQSQSS' is dynamic
[15:45:49] [WARNING] Cookie parameter 'ASPSESSIONIDCABQSQSS' is not dynamic
[15:45:49] [INFO] testing if GET parameter 'id' is dynamic
[15:45:49] [INFO] confirming that GET parameter 'id' is dynamic
[15:45:50] [INFO] GET parameter 'id' is dynamic
[15:45:50] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
[15:45:50] [INFO] testing unescaped numeric injection on GET parameter 'id'
[15:45:51] [INFO] confirming unescaped numeric injection on GET parameter 'id'
[15:45:51] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
[15:45:51] [INFO] testing for parenthesis on injectable parameter
[15:45:52] [INFO] the injectable parameter requires 0 parenthesis
[15:45:52] [INFO] testing Microsoft SQL Server
[15:45:53] [INFO] confirming Microsoft SQL Server
[15:45:54] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 

[15:45:54] [INFO] fetching database users
[15:45:54] [ERROR] unhandled exception in sqlmap/0.7, please copy the command line and the following text and send by e-mail to sql...@li.... The developer will fix it as soon as possible:
sqlmap version: 0.7
Python version: 2.6.1
Operating system: win32

[*] shutting down at: 15:45:54

Traceback (most recent call last):
  File "sqlmap.py", line 84, in main
  File "lib\controller\controller.pyc", line 263, in start
  File "lib\controller\action.pyc", line 97, in action
  File "plugins\generic\enumeration.pyc", line 176, in getUsers
IndexError: list index out of range

--- EXECUTION IS COMPLETE ---

Re: [sqlmap-users] Crashes

[Miroslav S. <mir...@gm...>]

Hi.

Thank you for your report. It should be fixed with the latest commit.

Kind regards,
Miroslav Stampar


On Mon, Nov 25, 2013 at 8:27 AM, flashc0re <fla...@ro...> wrote:

> Hey, mates!
> Here is crash log (((
>
> [07:25:23] [INFO] the SQL query used returns 23 entries
> [07:25:36] [INFO] searching column 'option_value' across all databases
> [07:25:36] [WARNING] HTTP error codes detected during run:
> 500 (Internal Server Error) - 1 times
>
> [07:25:36] [CRITICAL] unhandled exception in sqlmap/1.0-dev-369006c,
> retry your run with the latest development version from the GitHub
> repository. If the exception persists, please send by e-mail to
> 'sql...@li...' or open a new issue at
> 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following
> text and any information required to reproduce the bug. The developers
> will try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev-369006c
> Python version: 2.7.5+
> Operating system: posix
> Command line: /home/flashc0re/hack/sqlmap-dev/sqlmap.py -u
> ******************************************* --search -C ************
> --hex --tor --check-tor --tor-port=9050 --tor-type=socks5
> Technique: ERROR
> Back-end DBMS: Microsoft SQL Server (fingerprinted)
> Traceback (most recent call last):
>   File "/home/flashc0re/hack/sqlmap-dev/sqlmap.py", line 95, in main
>     start()
>   File "/home/flashc0re/hack/sqlmap-dev/lib/controller/controller.py",
> line 582, in start
>     action()
>   File "/home/flashc0re/hack/sqlmap-dev/lib/controller/action.py", line
> 133, in action
>     conf.dbmsHandler.search()
>   File "/home/flashc0re/hack/sqlmap-dev/plugins/generic/search.py", line
> 594, in search
>     self.searchColumn()
>   File
> "/home/flashc0re/hack/sqlmap-dev/plugins/dbms/mssqlserver/enumeration.py",
> line 322, in searchColumn
>     query += " AND %s" % colQuery.replace("[DB]", db)
> TypeError: coercing to Unicode: need string or buffer, NoneType found
>
> [*] shutting down at 07:25:36
>
>
>
> ------------------------------------------------------------------------------
> Shape the Mobile Experience: Free Subscription
> Software experts and developers: Be at the forefront of tech innovation.
> Intel(R) Software Adrenaline delivers strategic insight and game-changing
> conversations that shape the rapidly evolving mobile landscape. Sign up
> now.
> http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Crashes

[flashc0re <fla...@ro...>]

Hey, mates!
Here is crash log (((

[07:25:23] [INFO] the SQL query used returns 23 entries
[07:25:36] [INFO] searching column 'option_value' across all databases
[07:25:36] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times

[07:25:36] [CRITICAL] unhandled exception in sqlmap/1.0-dev-369006c,
retry your run with the latest development version from the GitHub
repository. If the exception persists, please send by e-mail to
'sql...@li...' or open a new issue at
'https://github.com/sqlmapproject/sqlmap/issues/new' with the following
text and any information required to reproduce the bug. The developers
will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev-369006c
Python version: 2.7.5+
Operating system: posix
Command line: /home/flashc0re/hack/sqlmap-dev/sqlmap.py -u
******************************************* --search -C ************
--hex --tor --check-tor --tor-port=9050 --tor-type=socks5
Technique: ERROR
Back-end DBMS: Microsoft SQL Server (fingerprinted)
Traceback (most recent call last):
  File "/home/flashc0re/hack/sqlmap-dev/sqlmap.py", line 95, in main
    start()
  File "/home/flashc0re/hack/sqlmap-dev/lib/controller/controller.py",
line 582, in start
    action()
  File "/home/flashc0re/hack/sqlmap-dev/lib/controller/action.py", line
133, in action
    conf.dbmsHandler.search()
  File "/home/flashc0re/hack/sqlmap-dev/plugins/generic/search.py", line
594, in search
    self.searchColumn()
  File
"/home/flashc0re/hack/sqlmap-dev/plugins/dbms/mssqlserver/enumeration.py",
line 322, in searchColumn
    query += " AND %s" % colQuery.replace("[DB]", db)
TypeError: coercing to Unicode: need string or buffer, NoneType found

[*] shutting down at 07:25:36

Re: [sqlmap-users] critical

[Miroslav S. <mir...@gm...>]

Hi.

We need a whole stack trace for us to be able to trace it and fix it.
Please last part is missing with code info.

Bye
On Nov 22, 2013 12:17 AM, "ju...@li..." <ju...@li...> wrote:

> [00:06:55] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your
> run with the latest development version from the GitHub repository. If the
> exception persists, please send by e-mail to '
> sql...@li...' or open a new issue at '
> https://github.com/sqlmapproject/sqlmap/issues/new' with the following
> text and any information required to reproduce the bug. The developers will
> try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev
> Python version: 2.7.3
> Operating system: posix
> Command line: ./sqlmap -u
> ***********************************************************************
> --cookie=************************************************** --string=First
> name: Gordon --reg-read
> Technique: STACKED
> Back-end DBMS: MySQL (fingerprinted)
>
>
>
>
> ------------------------------------------------------------------------------
> Shape the Mobile Experience: Free Subscription
> Software experts and developers: Be at the forefront of tech innovation.
> Intel(R) Software Adrenaline delivers strategic insight and game-changing
> conversations that shape the rapidly evolving mobile landscape. Sign up
> now.
> http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] critical

[<ju...@li...>]

[00:06:55] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the GitHub repository. If the exception persists, please send by e-mail to 'sql...@li...' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: posix
Command line: ./sqlmap -u *********************************************************************** --cookie=************************************************** --string=First name: Gordon --reg-read
Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)
 

Re: [sqlmap-users] How to Get git hash as versioning number

[Zaki A. <zak...@gm...>]

Thanks a lot Miroslav!

-za,

Re: [sqlmap-users] How to Get git hash as versioning number

[Miroslav S. <mir...@gm...>]

Hi.

Please go to
https://github.com/sqlmapproject/sqlmap/blob/master/lib/core/revision.py to
see the code.

Bye
On Nov 20, 2013 10:10 AM, "Zaki Akhmad" <zak...@gm...> wrote:

> Hi,
>
> I'd like to know how sqlmap implemented the git hash as versioning
> number. Te six digit from git hash.
>
> $ python sqlmap.py --version
> sqlmap/1.0-dev-c37ad88
>
> I'd like to use it at my python script.
>
> Thank you,
>
> --
> Zaki Akhmad
>
>
> ------------------------------------------------------------------------------
> Shape the Mobile Experience: Free Subscription
> Software experts and developers: Be at the forefront of tech innovation.
> Intel(R) Software Adrenaline delivers strategic insight and game-changing
> conversations that shape the rapidly evolving mobile landscape. Sign up
> now.
> http://pubads.g.doubleclick.net/gampad/clk?id=63431311&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

[sqlmap-users] How to Get git hash as versioning number

[Zaki A. <zak...@gm...>]

Hi,

I'd like to know how sqlmap implemented the git hash as versioning
number. Te six digit from git hash.

$ python sqlmap.py --version
sqlmap/1.0-dev-c37ad88

I'd like to use it at my python script.

Thank you,

-- 
Zaki Akhmad

Re: [sqlmap-users] Another 2 little change

[Bernardo D. A. G. <ber...@gm...>]

Hi Marco,

On 14 November 2013 11:31, Marco Mirandola <mm...@gm...> wrote:
> Hello everyone
>
> I thought of 2 small modifications to the source:
> 1) If the selected query came out only one record in this case:
>
> [12:16:30] [INFO] the SQL query provided has more than one field. sqlmap
> will no
> w unpack it into distinct queries to be able to retrieve the output even if
> we a
> re going blind
> [12:16:30] [INFO] retrieved: 1
> the SQL query provided can return 1 entries. How many entries do you want to
> ret
> rieve?
> [a] All (default)
> [#] Specific number
> [q] Quit
> is superfluous to the choices

Done, https://github.com/sqlmapproject/sqlmap/commit/59b6791faa25fa36c72f9b1cae61d5107ecafeba.

> 2) Especially in cases of brute force attacks as "based blind" would be
> appropriate for speedy extraction follow the following rules:
> - In the case of an account after the '@' if the letter after is a 'l' try
> with the next 'ocalhost'.
> - In the case of an email after an '@' and 'h' try with the next 'otmail.',
> Or '@ g' try 'mail.com', all this to gain time and not slaughter the server
> requests . (you should have a file with the main domains so that the program
> verification).

These cases are too specific to those email providers and the MySQL >=
5 users' table.
Nonetheless, we do have a number of switches that you may find useful
to speed the enumeration process - these are documented here,
https://github.com/sqlmapproject/sqlmap/wiki/Usage#optimization.
Specifically to your need, you can tweak the txt/common-outputs.txt
file with common output under the relevant label (in the form
[label]). This is documented under
https://github.com/sqlmapproject/sqlmap/wiki/Usage#output-prediction.

> - If a field is a hash (and that you might as noticing only after 1 or 2
> extractions of the field), you can restrict only the hexadecimal digits

I am not sure this is a good idea and would work well under all circumstances.

-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

[sqlmap-users] Another 2 little change

[Marco M. <mm...@gm...>]

Hello everyone

I thought of 2 small modifications to the source:
1) If the selected query came out only one record in this case:










*[12:16:30] [INFO] the SQL query provided has more than one field. sqlmap
will now unpack it into distinct queries to be able to retrieve the output
even if we are going blind[12:16:30] [INFO] retrieved: 1the SQL query
provided can return 1 entries. How many entries do you want to retrieve?[a]
All (default)[#] Specific number[q] Quit*
is superfluous to the choices

2) Especially in cases of brute force attacks as "based blind" would be
appropriate for speedy extraction follow the following rules:
- In the case of an account after the '@' if the letter after is a 'l' try
with the next 'ocalhost'.
- In the case of an email after an '@' and 'h' try with the next 'otmail.',
Or '@ g' try 'mail.com', all this to gain time and not slaughter the server
requests . (you should have a file with the main domains so that the program
verification).
- If a field is a hash (and that you might as noticing only after 1 or 2
extractions of the field), you can restrict only the hexadecimal digits

I hope I was helpful
Best regards

Re: [sqlmap-users] payload problem? "Incorrect syntax near"

[Vinicius Da L. <vin...@gm...>]

Confirmed fixed! You rock!

Thanks!


2013/11/12 Miroslav Stampar <mir...@gm...>

> Hi.
>
> Could you please update and retry it now?
>
> Kind regards,
> Miroslav Stampar
>
>
> On Tue, Nov 12, 2013 at 2:13 PM, Vinicius Da Loop <
> vin...@gm...> wrote:
>
>> Hello,
>>
>> List db ok, list tables and columns OK, but when I try dump contents, got
>> 'Incorrect syntax' error in html response, so I suspect that something is
>> wrong about the payload sent by sqlmap:
>>
>> ./sqlmap.py -u "http://www.[snip].br/noticias/[snip].asp?ID=4416"
>> --random-agent --threads=1 --technique=E -D 057 -T Cadastro -C
>> CAD_ID,CAD_Nome,CAD_Email --dump -v 6
>>
>> [PAYLOAD] 4416 AND 9709=CONVERT(INT,(SELECT
>> CHAR(113)+CHAR(119)+CHAR(122)+CHAR(114)+CHAR(113)+(SELECT
>> ISNULL(CAST(LTRIM(STR(COUNT(*))) AS NVARCHAR(4000)),CHAR(32)) FROM
>> 057.dbo.Cadastro)+CHAR(113)+CHAR(115)+CHAR(117)+CHAR(119)+CHAR(113)))
>>
>> [WARNING] HTTP error codes detected during run:
>> 500 (Internal Server Error) - 2 times
>>
>> HTML RESPONSE:
>>
>> <p>Microsoft OLE DB Provider for SQL Server</font> <font face="Arial"
>> size=2>error '80040e14'</font>
>> <p>
>> <font face="Arial" size=2>Line 1: Incorrect syntax near '057.'.</font>
>>
>> Any clue?
>> Thanks!
>>
>>
>> ------------------------------------------------------------------------------
>> November Webinars for C, C++, Fortran Developers
>> Accelerate application performance with scalable programming models.
>> Explore
>> techniques for threading, error checking, porting, and tuning. Get the
>> most
>> from the latest Intel processors and coprocessors. See abstracts and
>> register
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>

Re: [sqlmap-users] payload problem? "Incorrect syntax near"

[Miroslav S. <mir...@gm...>]

Hi.

Could you please update and retry it now?

Kind regards,
Miroslav Stampar


On Tue, Nov 12, 2013 at 2:13 PM, Vinicius Da Loop <
vin...@gm...> wrote:

> Hello,
>
> List db ok, list tables and columns OK, but when I try dump contents, got
> 'Incorrect syntax' error in html response, so I suspect that something is
> wrong about the payload sent by sqlmap:
>
> ./sqlmap.py -u "http://www.[snip].br/noticias/[snip].asp?ID=4416"
> --random-agent --threads=1 --technique=E -D 057 -T Cadastro -C
> CAD_ID,CAD_Nome,CAD_Email --dump -v 6
>
> [PAYLOAD] 4416 AND 9709=CONVERT(INT,(SELECT
> CHAR(113)+CHAR(119)+CHAR(122)+CHAR(114)+CHAR(113)+(SELECT
> ISNULL(CAST(LTRIM(STR(COUNT(*))) AS NVARCHAR(4000)),CHAR(32)) FROM
> 057.dbo.Cadastro)+CHAR(113)+CHAR(115)+CHAR(117)+CHAR(119)+CHAR(113)))
>
> [WARNING] HTTP error codes detected during run:
> 500 (Internal Server Error) - 2 times
>
> HTML RESPONSE:
>
> <p>Microsoft OLE DB Provider for SQL Server</font> <font face="Arial"
> size=2>error '80040e14'</font>
> <p>
> <font face="Arial" size=2>Line 1: Incorrect syntax near '057.'.</font>
>
> Any clue?
> Thanks!
>
>
> ------------------------------------------------------------------------------
> November Webinars for C, C++, Fortran Developers
> Accelerate application performance with scalable programming models.
> Explore
> techniques for threading, error checking, porting, and tuning. Get the most
> from the latest Intel processors and coprocessors. See abstracts and
> register
> http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] payload problem? "Incorrect syntax near"

[Vinicius Da L. <vin...@gm...>]

Hello,

List db ok, list tables and columns OK, but when I try dump contents, got
'Incorrect syntax' error in html response, so I suspect that something is
wrong about the payload sent by sqlmap:

./sqlmap.py -u "http://www.[snip].br/noticias/[snip].asp?ID=4416"
--random-agent --threads=1 --technique=E -D 057 -T Cadastro -C
CAD_ID,CAD_Nome,CAD_Email --dump -v 6

[PAYLOAD] 4416 AND 9709=CONVERT(INT,(SELECT
CHAR(113)+CHAR(119)+CHAR(122)+CHAR(114)+CHAR(113)+(SELECT
ISNULL(CAST(LTRIM(STR(COUNT(*))) AS NVARCHAR(4000)),CHAR(32)) FROM
057.dbo.Cadastro)+CHAR(113)+CHAR(115)+CHAR(117)+CHAR(119)+CHAR(113)))

[WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 2 times

HTML RESPONSE:

<p>Microsoft OLE DB Provider for SQL Server</font> <font face="Arial"
size=2>error '80040e14'</font>
<p>
<font face="Arial" size=2>Line 1: Incorrect syntax near '057.'.</font>

Any clue?
Thanks!

Re: [sqlmap-users] SQLmap

[Miroslav S. <mir...@gm...>]

Hi.

Use --union-cols=18 then. Also, you can force the dbms by using
--dbms=mysql.

Kind regards,
Miroslav Stampar
On Oct 31, 2013 9:25 PM, "remi driessens" <rem...@ho...> wrote:

> hi developers from sqlmap
>
> i have a problem with sqlmap everytime i do this on my vulnerable site it
> gives me all tested parameters apear to be not injectable. try to increase
> --level / --risk values to preform more tests...
>
> and if i do sql manualy i can get in the database of the website :s ive
> noticed this testing 'MySQL union query (NULL) - 1 to 10 collumns my
> website has 18 columns and the vulnerable column is 12 i thought maybe this
> is the problem ? i hope you can bring me some awnsers
>
>
> ------------------------------------------------------------------------------
> Android is increasing in popularity, but the open development platform that
> developers love is also attractive to malware creators. Download this white
> paper to learn more about secure code signing practices that can help keep
> Android apps secure.
> http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] Login

[Bernardo D. A. G. <ber...@gm...>]

https://github.com/sqlmapproject/sqlmap/wiki/Usage#http-cookie-header.
If you struggle then do provide sqlmap with the raw request, see
https://github.com/sqlmapproject/sqlmap/wiki/Usage#load-http-request-from-a-file.

Bernardo

On 1 November 2013 00:15,  <dr...@sa...> wrote:
>
> How can i put my login credentials and then in a session context (
> because i get redirect to login after i -u"www.url.i.want.com" i have
> a login and password and i want to use to it to give sqlmap the
> privileges to look for sqli in my page"
>
> ------------------------------------------------------------------------------
> Android is increasing in popularity, but the open development platform that
> developers love is also attractive to malware creators. Download this white
> paper to learn more about secure code signing practices that can help keep
> Android apps secure.
> http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] search password LIKE small bug

[Bernardo D. A. G. <ber...@gm...>]

Jacco,

if you provide --search -C password, then select LIKE search (default)
then sqlmap with apply the LIKE only on the column name, not on table
nor or database.
To search for tables like password provide --search -T password instead.

Bernardo


On 1 November 2013 07:53, Jacco van Tuijl <jac...@gm...> wrote:
> Hi all,
>
> When  using the  --search 'password' option
>
> and selecting the LIKE option:
>
> do you want sqlmap to consider provided column(s):
> [1] as LIKE column names (default)
> [2] as exact column names
>> 1
>
> When searching a database for a column with the text 'password' it uses
> LIKE.
> when searching the table it doesn't use LIKE : it uses = and so it doesn't
> return a column.
>
> [15:15:49] [INFO] fetching number of tables containing columns like
> 'password' in database 'master'
> [15:15:49] [INFO] retrieved: 4
> [15:15:50] [INFO] retrieving the length of query output
> [15:15:50] [INFO] retrieved: 10
> [15:16:06] [INFO] retrieved: sql_logins
> [15:16:06] [INFO] fetching columns 'password' for table 'sql_logins' in
> database 'master'
> [15:16:06] [INFO] retrieved: 0
>
> this one should be easy to fix :)
>
> ------------------------------------------------------------------------------
> Android is increasing in popularity, but the open development platform that
> developers love is also attractive to malware creators. Download this white
> paper to learn more about secure code signing practices that can help keep
> Android apps secure.
> http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

[sqlmap-users] search password LIKE small bug

[Jacco v. T. <jac...@gm...>]

Hi all,

When  using the * --search 'password'* option

and selecting the LIKE option:
*
*
*do you want sqlmap to consider provided column(s):*
*[1] as LIKE column names (default)*
*[2] as exact column names*
*> 1*

When searching a database for a column with the text 'password' it uses
LIKE.
when searching the table it doesn't use LIKE : it uses = and so it doesn't
return a column.

*[15:15:49] [INFO] fetching number of tables containing columns like
'password' in database 'master'*
*[15:15:49] [INFO] retrieved: 4*
*[15:15:50] [INFO] retrieving the length of query output*
*[15:15:50] [INFO] retrieved: 10*
*[15:16:06] [INFO] retrieved: sql_logins             *
*[15:16:06] [INFO] fetching columns 'password' for table 'sql_logins' in
database 'master'*
*[15:16:06] [INFO] retrieved: 0*

this one should be easy to fix :)

[sqlmap-users] Login

[<dr...@sa...>]

How can i put my login credentials and then in a session context (  
because i get redirect to login after i -u"www.url.i.want.com" i have  
a login and password and i want to use to it to give sqlmap the  
privileges to look for sqli in my page"