sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] There was a problem while hashing entry

[Miroslav S. <mir...@gm...>]

This should not happen with built in dictionary. Maybe it's username column
included containing localized data. Could you please send an excerpt of
those errors?
Dana 8.2.2013. 13:02 "Владимир Мартьянов" <vil...@gm...> je
napisao/la:

> Hello!
> Fisе of all I want to thank you for the great product! When I saw how it
> works I was very impressed.
>
> Now about a problem. I found some hashes in DB and I want to try check
> them by a built-in dictionary, but I have a message "There was a problem
> while hashing entry" for every entry. Why could it be? Does sqlmap use
> md5deep?
>
>
> ------------------------------------------------------------------------------
> Free Next-Gen Firewall Hardware Offer
> Buy your Sophos next-gen firewall before the end March 2013
> and get the hardware for free! Learn more.
> http://p.sf.net/sfu/sophos-d2d-feb
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] There was a problem while hashing entry

[Владимир М. <vil...@gm...>]

Hello!
Fisе of all I want to thank you for the great product! When I saw how it
works I was very impressed.

Now about a problem. I found some hashes in DB and I want to try check them
by a built-in dictionary, but I have a message "There was a problem while
hashing entry" for every entry. Why could it be? Does sqlmap use md5deep?

Re: [sqlmap-users] Unknown Hash Format

[Chris O. <chr...@gm...>]

You're spot on... column number 1 million is an API Key column which has -
you guessed it - the same format as MySQL old hashes.  Thanks for your time.


On 7 February 2013 17:03, Chris Oakley <chr...@gm...> wrote:

> I'll have a look, there are many columns, one moment.
>
>
> On 7 February 2013 17:02, Miroslav Stampar <mir...@gm...>wrote:
>
>> Hi.
>>
>> I can't reproduce that that value is recognized as a MySQL (old). Maybe
>> some other value has been recognized in a table dump as MySQL (old) but
>> that value wasn't that (pretty sure).
>>
>> Kind regards,
>> Miroslav Stampar
>> On Thu, Feb 7, 2013 at 3:09 PM, Miroslav Stampar <
>> mir...@gm...> wrote:
>>
>>> This looks like a first part of standard MySQL pass hash. Full one
>>> should start with * and have 40 hex chars.
>>>
>>> Maybe one part is stored at one DBMS instance and the other at the other
>>> (for security reasons). This is a recommended way in high profile targets.
>>>
>>> I'll take a look later why it's recognized as mysql_old as it obvioulsy
>>> isn't.
>>>
>>> Bye
>>> Dana 7.2.2013. 14:46 "Chris Oakley" <chr...@gm...> je
>>> napisao/la:
>>>
>>>>  Hi All
>>>>
>>>> Not a direct SQLMap question but I thought someone might be able to
>>>> shed some light on this.  I'm testing an app that has SQL injection and a
>>>> lot of the user passwords hashes are in the following format:
>>>>
>>>> *15C828E597C8B6781C2
>>>>
>>>> Does anyone recognise what this is?  They're all unsalted.  SQLMap
>>>> picks it up as MySQL (Old) when it's trying to crack them, but this is
>>>> incorrect as far as I'm away.  Older MySQL hashes come in the format:
>>>>
>>>> 5c47637e661879aa (weddingtv) - cracked by SQLMap :)
>>>> Sorry to go a bit off topic...
>>>>
>>>> Cheers
>>>>
>>>> Chris
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Free Next-Gen Firewall Hardware Offer
>>>> Buy your Sophos next-gen firewall before the end March 2013
>>>> and get the hardware for free! Learn more.
>>>> http://p.sf.net/sfu/sophos-d2d-feb
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>> sql...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>>
>>
>>
>> --
>> Miroslav Stampar
>> http://about.me/stamparm
>
>
>

Re: [sqlmap-users] Unknown Hash Format

[Chris O. <chr...@gm...>]

I'll have a look, there are many columns, one moment.


On 7 February 2013 17:02, Miroslav Stampar <mir...@gm...>wrote:

> Hi.
>
> I can't reproduce that that value is recognized as a MySQL (old). Maybe
> some other value has been recognized in a table dump as MySQL (old) but
> that value wasn't that (pretty sure).
>
> Kind regards,
> Miroslav Stampar
> On Thu, Feb 7, 2013 at 3:09 PM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> This looks like a first part of standard MySQL pass hash. Full one should
>> start with * and have 40 hex chars.
>>
>> Maybe one part is stored at one DBMS instance and the other at the other
>> (for security reasons). This is a recommended way in high profile targets.
>>
>> I'll take a look later why it's recognized as mysql_old as it obvioulsy
>> isn't.
>>
>> Bye
>> Dana 7.2.2013. 14:46 "Chris Oakley" <chr...@gm...> je
>> napisao/la:
>>
>>>  Hi All
>>>
>>> Not a direct SQLMap question but I thought someone might be able to shed
>>> some light on this.  I'm testing an app that has SQL injection and a lot of
>>> the user passwords hashes are in the following format:
>>>
>>> *15C828E597C8B6781C2
>>>
>>> Does anyone recognise what this is?  They're all unsalted.  SQLMap picks
>>> it up as MySQL (Old) when it's trying to crack them, but this is incorrect
>>> as far as I'm away.  Older MySQL hashes come in the format:
>>>
>>> 5c47637e661879aa (weddingtv) - cracked by SQLMap :)
>>> Sorry to go a bit off topic...
>>>
>>> Cheers
>>>
>>> Chris
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Free Next-Gen Firewall Hardware Offer
>>> Buy your Sophos next-gen firewall before the end March 2013
>>> and get the hardware for free! Learn more.
>>> http://p.sf.net/sfu/sophos-d2d-feb
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm

Re: [sqlmap-users] Unknown Hash Format

[Miroslav S. <mir...@gm...>]

Hi.

I can't reproduce that that value is recognized as a MySQL (old). Maybe
some other value has been recognized in a table dump as MySQL (old) but
that value wasn't that (pretty sure).

Kind regards,
Miroslav Stampar
On Thu, Feb 7, 2013 at 3:09 PM, Miroslav Stampar <mir...@gm...
> wrote:

> This looks like a first part of standard MySQL pass hash. Full one should
> start with * and have 40 hex chars.
>
> Maybe one part is stored at one DBMS instance and the other at the other
> (for security reasons). This is a recommended way in high profile targets.
>
> I'll take a look later why it's recognized as mysql_old as it obvioulsy
> isn't.
>
> Bye
> Dana 7.2.2013. 14:46 "Chris Oakley" <chr...@gm...> je
> napisao/la:
>
>> Hi All
>>
>> Not a direct SQLMap question but I thought someone might be able to shed
>> some light on this.  I'm testing an app that has SQL injection and a lot of
>> the user passwords hashes are in the following format:
>>
>> *15C828E597C8B6781C2
>>
>> Does anyone recognise what this is?  They're all unsalted.  SQLMap picks
>> it up as MySQL (Old) when it's trying to crack them, but this is incorrect
>> as far as I'm away.  Older MySQL hashes come in the format:
>>
>> 5c47637e661879aa (weddingtv) - cracked by SQLMap :)
>> Sorry to go a bit off topic...
>>
>> Cheers
>>
>> Chris
>>
>>
>> ------------------------------------------------------------------------------
>> Free Next-Gen Firewall Hardware Offer
>> Buy your Sophos next-gen firewall before the end March 2013
>> and get the hardware for free! Learn more.
>> http://p.sf.net/sfu/sophos-d2d-feb
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Unknown Hash Format

[Chris O. <chr...@gm...>]

Hi All

Not a direct SQLMap question but I thought someone might be able to shed
some light on this.  I'm testing an app that has SQL injection and a lot of
the user passwords hashes are in the following format:

*15C828E597C8B6781C2

Does anyone recognise what this is?  They're all unsalted.  SQLMap picks it
up as MySQL (Old) when it's trying to crack them, but this is incorrect as
far as I'm away.  Older MySQL hashes come in the format:

5c47637e661879aa (weddingtv) - cracked by SQLMap :)
Sorry to go a bit off topic...

Cheers

Chris

Re: [sqlmap-users] Seeking web developers to join the sqlmap project

[Bernardo D. A. G. <ber...@gm...>]

Hi,

Quick update on this.. the REST-JSON API is nearly complete. It will
soon be possible to launch, query and monitor sqlmap scans via HTTP
requests.
Although the API will be widely documented on the wiki, I thought
about sharing a sneak peek of how it currently works:

1) Start it on a terminal
$ python sqlmapapi.py -s
[17:21:15] [INFO] Running REST-JSON API server at '127.0.0.1:8775'..
[17:21:15] [INFO] Admin ID: af1d8cd4c607db5271202156c7175867
[17:21:15] [DEBUG] IPC database: /tmp/sqlmapipc-yxIjvv
[17:21:15] [DEBUG] REST-JSON API server connected to IPC database

2) Call the method to create a new task:
$ curl http://127.0.0.1:8775/task/new
{
    "taskid": "f5033fd4da442534"
}

3) Set the options (as you normally do when you call sqlmap from
command line (e.g. --technique B -v 2 --banner) and start a scan for
the new task:
$ curl -H "Content-Type: application/json" -X POST -d '{"url":
"http://debindev/sqlmap/mysql/get_int.php?id=1", "tech": "B",
"verbose": 2, "getBanner": "True"}'
http://127.0.0.1:8775/scan/f5033fd4da442534/start
{
    "engineid": 18300,
    "success": true
}

4) retrieve the data and error messages:
$ curl http://127.0.0.1:8775/scan/f5033fd4da442534/data
{
    "data": [
        {
            "status": 1,
            "type": 1,
            "value": [
                {
                    "dbms": null,
                    "suffix": "",
                    "clause": [
                        1
                    ],
                    "ptype": 1,
                    "dbms_version": null,
                    "prefix": "",
                    "place": "GET",
                    "os": null,
                    "conf": {
                        "string": null,
                        "notString": null,
                        "titles": false,
                        "regexp": null,
                        "textOnly": false,
                        "optimize": false
                    },
                    "parameter": "id",
                    "data": {
                        "1": {
                            "comment": "",
                            "matchRatio": 0.463,
                            "title": "AND boolean-based blind - WHERE
or HAVING clause",
                            "templatePayload": null,
                            "vector": "AND [INFERENCE]",
                            "where": 1,
                            "payload": "id=1 AND 3873=3873"
                        }
                    }
                }
            ]
        },
        {
            "status": 0,
            "type": 2,
            "value": "5.1.66-0+squee"
        }
    ],
    "error": []

As you can see, the banner has been retrieved partially - when the
dump finishes, the whole banner will be available.

Bernardo

On 13 December 2012 20:05, Bernardo Damele A. G.
<ber...@gm...> wrote:
> Hi,
>
> Sooner or later all projects go web and with the over hyped web 2.0
> era and the high availability of eye-candy web development frameworks
> we have plans to follow the infosec tools herd starting by developing
> a RESTful API to interact with the sqlmap engine independently from
> the command line.
>
> As of a couple of days ago we do have an XML-RPC service[1] thanks to
> Miroslav, although we have decided internally after much bitching to
> replace it with a REST-JSON API[7] to let anyone script and interact
> with the sqlmap engine via HTTP.
> The idea is to put the API behind some kind of authentication and
> allow concurrent sessions by different "users" whereby sqlmap API can
> be run (e.g. python sqlmap --daemon or similar) on a predefined
> interface and TCP port and clients can query the API on such TCP port
> to mount attacks against a single target or multiple targets[5].
>
> Needless to say that we are at an early design phase hence this email.
> It is that time of the year again when the most prepare for holidays
> and celebrating Christmas with family (enjoy!) and the few Internauts
> addicted contribute towards the sqlmap project with ideas and code[2]
> so if you feel like:
>
> * You have experience with web development in Python or..
> * ..you have motivation and time enough to learn how to develop a
> RESTful API in Python and..
> * ..you are familiar or keen on learning Python web frameworks like
> Flask[3] and Bottle[4] and..
> * ..you have the guts to commit your time to discuss the design of
> this (or others) feature and contribute code[2] to one of the most
> acclaimed[6] and discussed (blamed sometimes) IT security tools out
> there..
>
> ..then do not hesitate to reply to this email either privately to us
> only (de...@sq...) or publicly hitting the "Reply" button in your
> favorite mail client.
>
> We look forward to reading from you. Yes, I am looking at you Python
> software developer with web skills!
>
> [1] https://github.com/sqlmapproject/sqlmap/issues/287
> [2] https://github.com/sqlmapproject/sqlmap/blob/master/CONTRIBUTING.md#submitting-code-changes
> [3] http://flask.pocoo.org
> [4] http://bottlepy.org
> [5] how cool is this
> [6] http://sectools.org/tool/sqlmap/
> [7] https://github.com/sqlmapproject/sqlmap/issues/297
>
> --
> Bernardo Damele A. G.
>
> E-mail / Jabber: bernardo.damele (at) gmail.com
> Mobile: +447788962949 (UK 07788962949)



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] certificate authentication

[Miroslav S. <mir...@gm...>]

Hi Travis.

This should be fixed now [1]. If not, please report back.

Kind regards,
Miroslav Stampar

[1]
https://github.com/sqlmapproject/sqlmap/commit/62772125e365c89f5c0c9e322f798d8e3c5dbed2

On Mon, Feb 4, 2013 at 7:26 PM, Travis Altman <tra...@gm...>wrote:

> Command line: sqlmap.py -c sqlmap.conf
> Technique: None
> Back-end DBMS: Oracle (identified)
> Traceback (most recent call last):
>   File "/Users/travis/tools/sqlmap/_sqlmap.py", line 73, in main
>     start()
>   File "/Users/travis/tools/sqlmap/lib/controller/controller.py", line
> 351, in start
>     if not checkConnection(suppressOutput=conf.forms) or not checkString()
> or not checkRegexp():
>   File "/Users/travis/tools/sqlmap/lib/controller/checks.py", line 1047,
> in checkConnection
>     page, _ = Request.queryPage(content=True, noteResponseTime=False)
>   File "/Users/travis/tools/sqlmap/lib/request/connect.py", line 802, in
> queryPage
>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
> cookie=cookie, ua=ua, referer=referer, host=host, silent=silent,
> method=method, auxHeaders=auxHeaders, response=response, raise404=raise404,
> ignoreTimeout=timeBasedCompare)
>   File "/Users/travis/tools/sqlmap/lib/request/connect.py", line 355, in
> getPage
>     conn = urllib2.urlopen(req)
>   File
> "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
> line 126, in urlopen
>     return _opener.open(url, data, timeout)
>   File
> "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
> line 394, in open
>     response = self._open(req, data)
>   File
> "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
> line 412, in _open
>     '_open', req)
>   File
> "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
> line 372, in _call_chain
>     result = func(*args)
>   File "/Users/travis/tools/sqlmap/lib/request/certhandler.py", line 21,
> in https_open
>     return self.do_open(self.getConnection, req)
>   File
> "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
> line 1140, in do_open
>     h = http_class(host, timeout=req.timeout) # will parse host:port
> TypeError: getConnection() got an unexpected keyword argument 'timeout'
>
> [*] shutting down at 11:58:46
>
>
> On Mon, Feb 4, 2013 at 1:24 PM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> Hi.
>>
>> Traceback would be most helpful.
>>
>> Bye
>> On Feb 4, 2013 7:22 PM, "Travis Altman" <tra...@gm...> wrote:
>>
>>>  I've got an application that requires a certificate before it allows
>>> me through the front door.  I'm using the sqlmap.conf file and I'm
>>> adjusting the aCert parameter to be "key.key,cert.pem".  I extracted the
>>> key and cert from the pkcs file using the technique here
>>> http://blog.bioid.com/post/Extract-the-certificate-and-key-from-a-PKCS12-file.
>>>  I try to run sqlmap at that point but it errors out.  If the stack trace
>>> would help let me know but figured someone might be able to answer my
>>> question and ensure that I'm utilizing the cert function properly.  Thanks.
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Everyone hates slow websites. So do we.
>>> Make your web apps faster with AppDynamics
>>> Download AppDynamics Lite for free today:
>>> http://p.sf.net/sfu/appdyn_d2d_jan
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] certificate authentication

[Travis A. <tra...@gm...>]

Command line: sqlmap.py -c sqlmap.conf
Technique: None
Back-end DBMS: Oracle (identified)
Traceback (most recent call last):
  File "/Users/travis/tools/sqlmap/_sqlmap.py", line 73, in main
    start()
  File "/Users/travis/tools/sqlmap/lib/controller/controller.py", line 351,
in start
    if not checkConnection(suppressOutput=conf.forms) or not checkString()
or not checkRegexp():
  File "/Users/travis/tools/sqlmap/lib/controller/checks.py", line 1047, in
checkConnection
    page, _ = Request.queryPage(content=True, noteResponseTime=False)
  File "/Users/travis/tools/sqlmap/lib/request/connect.py", line 802, in
queryPage
    page, headers, code = Connect.getPage(url=uri, get=get, post=post,
cookie=cookie, ua=ua, referer=referer, host=host, silent=silent,
method=method, auxHeaders=auxHeaders, response=response, raise404=raise404,
ignoreTimeout=timeBasedCompare)
  File "/Users/travis/tools/sqlmap/lib/request/connect.py", line 355, in
getPage
    conn = urllib2.urlopen(req)
  File
"/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
line 126, in urlopen
    return _opener.open(url, data, timeout)
  File
"/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
line 394, in open
    response = self._open(req, data)
  File
"/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
line 412, in _open
    '_open', req)
  File
"/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
line 372, in _call_chain
    result = func(*args)
  File "/Users/travis/tools/sqlmap/lib/request/certhandler.py", line 21, in
https_open
    return self.do_open(self.getConnection, req)
  File
"/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py",
line 1140, in do_open
    h = http_class(host, timeout=req.timeout) # will parse host:port
TypeError: getConnection() got an unexpected keyword argument 'timeout'

[*] shutting down at 11:58:46


On Mon, Feb 4, 2013 at 1:24 PM, Miroslav Stampar <mir...@gm...
> wrote:

> Hi.
>
> Traceback would be most helpful.
>
> Bye
> On Feb 4, 2013 7:22 PM, "Travis Altman" <tra...@gm...> wrote:
>
>> I've got an application that requires a certificate before it allows me
>> through the front door.  I'm using the sqlmap.conf file and I'm adjusting
>> the aCert parameter to be "key.key,cert.pem".  I extracted the key and cert
>> from the pkcs file using the technique here
>> http://blog.bioid.com/post/Extract-the-certificate-and-key-from-a-PKCS12-file.
>>  I try to run sqlmap at that point but it errors out.  If the stack trace
>> would help let me know but figured someone might be able to answer my
>> question and ensure that I'm utilizing the cert function properly.  Thanks.
>>
>>
>> ------------------------------------------------------------------------------
>> Everyone hates slow websites. So do we.
>> Make your web apps faster with AppDynamics
>> Download AppDynamics Lite for free today:
>> http://p.sf.net/sfu/appdyn_d2d_jan
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>

Re: [sqlmap-users] certificate authentication

[Miroslav S. <mir...@gm...>]

Hi.

Traceback would be most helpful.

Bye
On Feb 4, 2013 7:22 PM, "Travis Altman" <tra...@gm...> wrote:

> I've got an application that requires a certificate before it allows me
> through the front door.  I'm using the sqlmap.conf file and I'm adjusting
> the aCert parameter to be "key.key,cert.pem".  I extracted the key and cert
> from the pkcs file using the technique here
> http://blog.bioid.com/post/Extract-the-certificate-and-key-from-a-PKCS12-file.
>  I try to run sqlmap at that point but it errors out.  If the stack trace
> would help let me know but figured someone might be able to answer my
> question and ensure that I'm utilizing the cert function properly.  Thanks.
>
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_d2d_jan
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] certificate authentication

[Travis A. <tra...@gm...>]

I've got an application that requires a certificate before it allows me
through the front door.  I'm using the sqlmap.conf file and I'm adjusting
the aCert parameter to be "key.key,cert.pem".  I extracted the key and cert
from the pkcs file using the technique here
http://blog.bioid.com/post/Extract-the-certificate-and-key-from-a-PKCS12-file.
 I try to run sqlmap at that point but it errors out.  If the stack trace
would help let me know but figured someone might be able to answer my
question and ensure that I'm utilizing the cert function properly.  Thanks.

Re: [sqlmap-users] How Do I change data with sqlmap?

[Miroslav S. <mir...@gm...>]

Hi.

Hardly, as you'll either need stacked queries support (rare) or credentials
to connect directly.

Kind regards,
Miroslav Stampar
Dana 3.2.2013. 12:30 "Liran Mimony" <rea...@gm...> je napisao/la:

> I mean
>
> I want to change the value of a column, can anyone give me an example on
> how to do it?
>
> I want to do it in MySQL, is it possible?
>
> Thanks
>
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_d2d_jan
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] How Do I change data with sqlmap?

[Liran M. <rea...@gm...>]

I mean

I want to change the value of a column, can anyone give me an example on
how to do it?

I want to do it in MySQL, is it possible?

Thanks

Re: [sqlmap-users] Problem with sqlmap

[Bernardo D. <ber...@gm...>]

Remove "Cookie=" from the cookie value. Make sure you have sqlmap updated
from GitHub and the session cookie is valid.

Bernardo Damele A. G.

This message was sent from a smartphone

On 1 Feb 2013, at 15:02, stefano lorenzi <lor...@gm...> wrote:

Hi all, and sorry for my English

I tried use sqlmap and I installed dvwa application in my virtual machine.
I use backbox distro and backtrack but I have the same problem, I used this
command below
the problem is that parmater id is injectable  but I receve

[15:52:30] [WARNING] heuristic test shows that GET parameter 'id' might not
be injectable


I tried also --level 3 --risk 5 but nothing.....


sqlmap -u '
http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit'
--cookie='Cookie=security=low; PHPSESSID=g123shj27qt27pf5prctrk0t32' --dbs
--dbms=mysql




    sqlmap/1.0-dev-d6606a8 - automatic SQL injection and database takeover
tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior
mutual consent is illegal. It is the end user's responsibility to obey all
applicable local, state and federal laws. Developers assume no liability
and are not responsible for any misuse or damage caused by this program

[*] starting at 15:52:27

[15:52:27] [INFO] testing connection to the target url
[15:52:27] [INFO] heuristics detected web page charset 'None'
sqlmap got a 302 redirect to 'http://192.168.56.101:80/dvwa/login.php'. Do
you want to follow? [Y/n]
[15:52:28] [INFO] testing if the url is stable, wait a few seconds
you provided a HTTP Cookie header value. The target url provided its own
cookies within the HTTP Set-Cookie header which intersect with yours. Do
you want to merge them in futher requests? [Y/n]
[15:52:30] [WARNING] GET parameter 'id' does not appear dynamic
[15:52:30] [WARNING] reflective value(s) found and filtering out
[15:52:30] [WARNING] heuristic test shows that GET parameter 'id' might not
be injectable
[15:52:30] [INFO] testing for SQL injection on GET parameter 'id'
[15:52:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:52:30] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
clause'
[15:52:31] [INFO] testing 'MySQL inline queries'
[15:52:31] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:52:31] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:52:31] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:52:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:52:34] [WARNING] GET parameter 'id' is not injectable
[15:52:34] [WARNING] GET parameter 'Submit' does not appear dynamic
[15:52:34] [WARNING] heuristic test shows that GET parameter 'Submit' might
not be injectable
[15:52:34] [INFO] testing for SQL injection on GET parameter 'Submit'
[15:52:34] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:52:34] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
clause'
[15:52:34] [INFO] testing 'MySQL inline queries'
[15:52:34] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:52:34] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:52:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:52:36] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:52:37] [WARNING] GET parameter 'Submit' is not injectable
[15:52:37] [CRITICAL] all tested parameters appear to be not injectable.
Try to increase '--level'/'--risk' values to perform more tests. Also, you
can try to rerun by providing either a valid value for option '--string'
(or '--regexp')


thanks



-- 
Ciao
Stefano Lorenzi

www.lorenzistefano.com

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_jan

_______________________________________________
sqlmap-users mailing list
sql...@li...
https://lists.sourceforge.net/lists/listinfo/sqlmap-users

[sqlmap-users] Problem with sqlmap

[stefano l. <lor...@gm...>]

Hi all, and sorry for my English

I tried use sqlmap and I installed dvwa application in my virtual machine.
I use backbox distro and backtrack but I have the same problem, I used this
command below
the problem is that parmater id is injectable  but I receve

[15:52:30] [WARNING] heuristic test shows that GET parameter 'id' might not
be injectable


I tried also --level 3 --risk 5 but nothing.....


sqlmap -u '
http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit'
--cookie='Cookie=security=low; PHPSESSID=g123shj27qt27pf5prctrk0t32' --dbs
--dbms=mysql




    sqlmap/1.0-dev-d6606a8 - automatic SQL injection and database takeover
tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior
mutual consent is illegal. It is the end user's responsibility to obey all
applicable local, state and federal laws. Developers assume no liability
and are not responsible for any misuse or damage caused by this program

[*] starting at 15:52:27

[15:52:27] [INFO] testing connection to the target url
[15:52:27] [INFO] heuristics detected web page charset 'None'
sqlmap got a 302 redirect to 'http://192.168.56.101:80/dvwa/login.php'. Do
you want to follow? [Y/n]
[15:52:28] [INFO] testing if the url is stable, wait a few seconds
you provided a HTTP Cookie header value. The target url provided its own
cookies within the HTTP Set-Cookie header which intersect with yours. Do
you want to merge them in futher requests? [Y/n]
[15:52:30] [WARNING] GET parameter 'id' does not appear dynamic
[15:52:30] [WARNING] reflective value(s) found and filtering out
[15:52:30] [WARNING] heuristic test shows that GET parameter 'id' might not
be injectable
[15:52:30] [INFO] testing for SQL injection on GET parameter 'id'
[15:52:30] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:52:30] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
clause'
[15:52:31] [INFO] testing 'MySQL inline queries'
[15:52:31] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:52:31] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:52:31] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:52:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:52:34] [WARNING] GET parameter 'id' is not injectable
[15:52:34] [WARNING] GET parameter 'Submit' does not appear dynamic
[15:52:34] [WARNING] heuristic test shows that GET parameter 'Submit' might
not be injectable
[15:52:34] [INFO] testing for SQL injection on GET parameter 'Submit'
[15:52:34] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:52:34] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING
clause'
[15:52:34] [INFO] testing 'MySQL inline queries'
[15:52:34] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:52:34] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:52:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:52:36] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:52:37] [WARNING] GET parameter 'Submit' is not injectable
[15:52:37] [CRITICAL] all tested parameters appear to be not injectable.
Try to increase '--level'/'--risk' values to perform more tests. Also, you
can try to rerun by providing either a valid value for option '--string'
(or '--regexp')


thanks



-- 
Ciao
Stefano Lorenzi

www.lorenzistefano.com

Re: [sqlmap-users] bug

[Miroslav S. <mir...@gm...>]

Hi.

This is fixed two weeks ago [1].

Bye

[1] https://github.com/sqlmapproject/sqlmap/issues/351
On Jan 31, 2013 9:48 PM, "ahmed atif" <ad...@7r...> wrote:

>  i got this bug please fix it
>
> [04:04:05] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your
> run with
>  the latest development version from the GitHub repository. If the
> exception per
> sists, please send by e-mail to 'sql...@li...' or
> open a n
> ew issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the
> follow
> ing text and any information required to reproduce the bug. The developers
> will
> try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev
> Python version: 2.7.3
> Operating system: nt
> Command line: C:\Users\run\sqlmap\sqlmap.py -u
> *********************************
>
> ********************************************************************************
> *********************************** -D ********* -T ********* --dump
> --level 3 -
> -proxy **************************
> Technique: UNION
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "C:\Users\run\sqlmap\_sqlmap.py", line 73, in main
>     start()
>   File "C:\Users\run\sqlmap\lib\controller\controller.py", line 569, in
> start
>     action()
>   File "C:\Users\run\sqlmap\lib\controller\action.py", line 126, in action
>     conf.dbmsHandler.dumpTable()
>   File "C:\Users\run\sqlmap\plugins\generic\entries.py", line 323, in
> dumpTable
>     conf.dumper.dbTableValues(kb.data.dumpedTable)
>   File "C:\Users\run\sqlmap\lib\core\dump.py", line 483, in dbTableValues
>     mimetype = magic.from_buffer(value, mime=True)
>   File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 104, in
> from_buffer
>
>     m = _get_magic_type(mime)
>   File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 95, in
> _get_magic_t
> ype
>     return _get_magic_mime()
>   File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 84, in
> _get_magic_m
> ime
>     _magic_mime = Magic(mime=True)
>   File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 50, in
> __init__
>     self.cookie = magic_open(flags)
> NameError: global name 'magic_open' is not defined
>
> NameError: global name 'magic_open' is not defined
>
> [*] shutting down at 04:04:05
>
> Exception AttributeError: "Magic instance has no attribute 'cookie'" in
> <bound m
> ethod Magic.__del__ of <thirdparty.magic.magic.Magic instance at
> 0x0000000003797
> 588>> ignored
>
>
>
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_d2d_jan
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] bug

[ahmed a. <ad...@7r...>]

i got this bug please fix it 

[04:04:05] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with
 the latest development version from the GitHub repository. If the exception per
sists, please send by e-mail to 'sql...@li...' or open a n
ew issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the follow
ing text and any information required to reproduce the bug. The developers will
try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.3
Operating system: nt
Command line: C:\Users\run\sqlmap\sqlmap.py -u *********************************
********************************************************************************
*********************************** -D ********* -T ********* --dump --level 3 -
-proxy **************************
Technique: UNION
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "C:\Users\run\sqlmap\_sqlmap.py", line 73, in main
    start()
  File "C:\Users\run\sqlmap\lib\controller\controller.py", line 569, in start
    action()
  File "C:\Users\run\sqlmap\lib\controller\action.py", line 126, in action
    conf.dbmsHandler.dumpTable()
  File "C:\Users\run\sqlmap\plugins\generic\entries.py", line 323, in dumpTable
    conf.dumper.dbTableValues(kb.data.dumpedTable)
  File "C:\Users\run\sqlmap\lib\core\dump.py", line 483, in dbTableValues
    mimetype = magic.from_buffer(value, mime=True)
  File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 104, in from_buffer

    m = _get_magic_type(mime)
  File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 95, in _get_magic_t
ype
    return _get_magic_mime()
  File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 84, in _get_magic_m
ime
    _magic_mime = Magic(mime=True)
  File "C:\Users\run\sqlmap\thirdparty\magic\magic.py", line 50, in __init__
    self.cookie = magic_open(flags)
NameError: global name 'magic_open' is not defined

NameError: global name 'magic_open' is not defined

[*] shutting down at 04:04:05

Exception AttributeError: "Magic instance has no attribute 'cookie'" in <bound m
ethod Magic.__del__ of <thirdparty.magic.magic.Magic instance at 0x0000000003797
588>> ignored


 		 	   		  

Re: [sqlmap-users] signing requests before sending them

[Miroslav S. <mir...@gm...>]

Yup.

Bye
Dana 25.1.2013. 18:48 "Boris Chazalet" <bor...@or...> je
napisao/la:

>  Wow, thanks a lot Miroslav!
>
> So what's the rule, any variable created in the eval code is considered as
> a HTTP parameter for the ongoing request?
>
> Regards,
> Boris
>
> On 25/01/13 15:20, Miroslav Stampar wrote:
>
> Hi Boris.
>
>  This would do:
>
>  python sqlmap.py -u "
> http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty<http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c>"
> --eval='import hashlib;sig=hashlib.md5("%s:%s:%s:%s" % (name, phone,
> password, "secretkey123")).hexdigest()'
>
>  Kind regards,
> Miroslav Stampar
>
> On Fri, Jan 25, 2013 at 3:13 PM, Boris Chazalet <bor...@or...
> > wrote:
>
>>  Well, an example of a valid request to the server looks something like
>> this:
>>
>> http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c
>>
>> with name, phone, password being regular parameters and sig being the
>> hash of the params value, or in other words:
>> sig = md5(bob:phone:qwerty:secretkey)
>>
>> The server first checks the sig parameter and reject the request if it
>> does not match its own calculation.
>>
>> I have a python script to compute the sig value using the secret key so I
>> just would like to access any sqlmap request before it is actually send in
>> order to append the sig parameter and its value, i.e.
>> "&sig=3cd7a0db76ff9dca48979e24c39b408c".
>>
>> My question is whether that can be done with the --eval switch or if that
>> requires me to go into the source code of sqlmap and add this functionality
>>
>> Thanks a lot for your help.
>> Regards,
>> Boris
>>
>> On 24/01/13 18:17, Miroslav Stampar wrote:
>>
>> Hi.
>>
>> Could you please give more information?
>>
>> Kind regards,
>> Miroslav Stampar
>> Dana 24.1.2013. 18:56 "Boris Chazalet" <bor...@or...> je
>> napisao/la:
>>
>>> Hi,
>>>
>>> I need to sign the requests with a secret key before sending it to the
>>> server for them to be accepted. More precisely, I need to hash the
>>> different request parameters together with a secret key and to add that
>>> hash as an extra parameter in the final URL.
>>>
>>> Is that something that can be done with the --eval switch or do I need
>>> to modify the source code?
>>>
>>> Regards,
>>> Boris
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>>> MVPs and experts. ON SALE this month only -- learn more at:
>>> http://p.sf.net/sfu/learnnow-d2d
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>> MVPs and experts. ON SALE this month only -- learn more at:
>> http://p.sf.net/sfu/learnnow-d2d
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
>  --
> Miroslav Stampar
> http://about.me/stamparm
>
>
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] signing requests before sending them

[Boris C. <bor...@or...>]

Wow, thanks a lot Miroslav!

So what's the rule, any variable created in the eval code is considered 
as a HTTP parameter for the ongoing request?

Regards,
Boris

On 25/01/13 15:20, Miroslav Stampar wrote:
> Hi Boris.
>
> This would do:
>
> python sqlmap.py -u 
> "http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty 
> <http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c>" 
> --eval='import hashlib;sig=hashlib.md5("%s:%s:%s:%s" % (name, phone, 
> password, "secretkey123")).hexdigest()'
>
> Kind regards,
> Miroslav Stampar
>
> On Fri, Jan 25, 2013 at 3:13 PM, Boris Chazalet 
> <bor...@or... <mailto:bor...@or...>> wrote:
>
>     Well, an example of a valid request to the server looks something
>     like this:
>     http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c
>
>     with name, phone, password being regular parameters and sig being
>     the hash of the params value, or in other words:
>     sig = md5(bob:phone:qwerty:secretkey)
>
>     The server first checks the sig parameter and reject the request
>     if it does not match its own calculation.
>
>     I have a python script to compute the sig value using the secret
>     key so I just would like to access any sqlmap request before it is
>     actually send in order to append the sig parameter and its value,
>     i.e. "&sig=3cd7a0db76ff9dca48979e24c39b408c".
>
>     My question is whether that can be done with the --eval switch or
>     if that requires me to go into the source code of sqlmap and add
>     this functionality
>
>     Thanks a lot for your help.
>     Regards,
>     Boris
>
>     On 24/01/13 18:17, Miroslav Stampar wrote:
>>
>>     Hi.
>>
>>     Could you please give more information?
>>
>>     Kind regards,
>>     Miroslav Stampar
>>
>>     Dana 24.1.2013. 18:56 "Boris Chazalet" <bor...@or...
>>     <mailto:bor...@or...>> je napisao/la:
>>
>>         Hi,
>>
>>         I need to sign the requests with a secret key before sending
>>         it to the
>>         server for them to be accepted. More precisely, I need to
>>         hash the
>>         different request parameters together with a secret key and
>>         to add that
>>         hash as an extra parameter in the final URL.
>>
>>         Is that something that can be done with the --eval switch or
>>         do I need
>>         to modify the source code?
>>
>>         Regards,
>>         Boris
>>
>>
>>
>>         ------------------------------------------------------------------------------
>>         Master Visual Studio, SharePoint, SQL, ASP.NET
>>         <http://ASP.NET>, C# 2012, HTML5, CSS,
>>         MVC, Windows 8 Apps, JavaScript and much more. Keep your
>>         skills current
>>         with LearnDevNow - 3,200 step-by-step video tutorials by
>>         Microsoft
>>         MVPs and experts. ON SALE this month only -- learn more at:
>>         http://p.sf.net/sfu/learnnow-d2d
>>         _______________________________________________
>>         sqlmap-users mailing list
>>         sql...@li...
>>         <mailto:sql...@li...>
>>         https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>     ------------------------------------------------------------------------------
>     Master Visual Studio, SharePoint, SQL, ASP.NET <http://ASP.NET>,
>     C# 2012, HTML5, CSS,
>     MVC, Windows 8 Apps, JavaScript and much more. Keep your skills
>     current
>     with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>     MVPs and experts. ON SALE this month only -- learn more at:
>     http://p.sf.net/sfu/learnnow-d2d
>     _______________________________________________
>     sqlmap-users mailing list
>     sql...@li...
>     <mailto:sql...@li...>
>     https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
>
>
> -- 
> Miroslav Stampar
> http://about.me/stamparm

Re: [sqlmap-users] signing requests before sending them

[Miroslav S. <mir...@gm...>]

Hi Boris.

This would do:

python sqlmap.py -u "
http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty<http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c>"
--eval='import hashlib;sig=hashlib.md5("%s:%s:%s:%s" % (name, phone,
password, "secretkey123")).hexdigest()'

Kind regards,
Miroslav Stampar

On Fri, Jan 25, 2013 at 3:13 PM, Boris Chazalet
<bor...@or...>wrote:

>  Well, an example of a valid request to the server looks something like
> this:
>
> http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c
>
> with name, phone, password being regular parameters and sig being the hash
> of the params value, or in other words:
> sig = md5(bob:phone:qwerty:secretkey)
>
> The server first checks the sig parameter and reject the request if it
> does not match its own calculation.
>
> I have a python script to compute the sig value using the secret key so I
> just would like to access any sqlmap request before it is actually send in
> order to append the sig parameter and its value, i.e.
> "&sig=3cd7a0db76ff9dca48979e24c39b408c".
>
> My question is whether that can be done with the --eval switch or if that
> requires me to go into the source code of sqlmap and add this functionality
>
> Thanks a lot for your help.
> Regards,
> Boris
>
> On 24/01/13 18:17, Miroslav Stampar wrote:
>
> Hi.
>
> Could you please give more information?
>
> Kind regards,
> Miroslav Stampar
> Dana 24.1.2013. 18:56 "Boris Chazalet" <bor...@or...> je
> napisao/la:
>
>> Hi,
>>
>> I need to sign the requests with a secret key before sending it to the
>> server for them to be accepted. More precisely, I need to hash the
>> different request parameters together with a secret key and to add that
>> hash as an extra parameter in the final URL.
>>
>> Is that something that can be done with the --eval switch or do I need
>> to modify the source code?
>>
>> Regards,
>> Boris
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>> MVPs and experts. ON SALE this month only -- learn more at:
>> http://p.sf.net/sfu/learnnow-d2d
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] signing requests before sending them

[Boris C. <bor...@or...>]

Well, an example of a valid request to the server looks something like this:
http://myserver.com/createUser.xml?name=Bob&phone=0789123456&password=qwerty&sig=3cd7a0db76ff9dca48979e24c39b408c

with name, phone, password being regular parameters and sig being the 
hash of the params value, or in other words:
sig = md5(bob:phone:qwerty:secretkey)

The server first checks the sig parameter and reject the request if it 
does not match its own calculation.

I have a python script to compute the sig value using the secret key so 
I just would like to access any sqlmap request before it is actually 
send in order to append the sig parameter and its value, i.e. 
"&sig=3cd7a0db76ff9dca48979e24c39b408c".

My question is whether that can be done with the --eval switch or if 
that requires me to go into the source code of sqlmap and add this 
functionality

Thanks a lot for your help.
Regards,
Boris

On 24/01/13 18:17, Miroslav Stampar wrote:
>
> Hi.
>
> Could you please give more information?
>
> Kind regards,
> Miroslav Stampar
>
> Dana 24.1.2013. 18:56 "Boris Chazalet" <bor...@or... 
> <mailto:bor...@or...>> je napisao/la:
>
>     Hi,
>
>     I need to sign the requests with a secret key before sending it to the
>     server for them to be accepted. More precisely, I need to hash the
>     different request parameters together with a secret key and to add
>     that
>     hash as an extra parameter in the final URL.
>
>     Is that something that can be done with the --eval switch or do I need
>     to modify the source code?
>
>     Regards,
>     Boris
>
>
>
>     ------------------------------------------------------------------------------
>     Master Visual Studio, SharePoint, SQL, ASP.NET <http://ASP.NET>,
>     C# 2012, HTML5, CSS,
>     MVC, Windows 8 Apps, JavaScript and much more. Keep your skills
>     current
>     with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>     MVPs and experts. ON SALE this month only -- learn more at:
>     http://p.sf.net/sfu/learnnow-d2d
>     _______________________________________________
>     sqlmap-users mailing list
>     sql...@li...
>     <mailto:sql...@li...>
>     https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

Re: [sqlmap-users] Error

[Miroslav S. <mir...@gm...>]

Hi Florian.

Thank you for your report. It should be ok now.

Bye

On Fri, Jan 25, 2013 at 2:45 AM, Florian Strankowski <fs...@co...> wrote:

> sqlmap version: 1.0-dev-aed833c
> Python version: 2.6.6
> Operating system: posix
> Command line: ./sqlmap.py -u *****************************************
> --headers=x-forwarded-for: 1* --threads 10 --banner
> Technique: TIME
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>    File "/root/sqlmap-dev/_sqlmap.py", line 73, in main
>      start()
>    File "/root/sqlmap-dev/lib/controller/controller.py", line 569, in start
>      action()
>    File "/root/sqlmap-dev/lib/controller/action.py", line 31, in action
>      setHandler()
>    File "/root/sqlmap-dev/lib/controller/handler.py", line 81, in
> setHandler
>      if handler.checkDbms():
>    File "/root/sqlmap-dev/plugins/dbms/mysql/fingerprint.py", line 163,
> in checkDbms
>      self.getBanner()
>    File "/root/sqlmap-dev/plugins/generic/enumeration.py", line 57, in
> getBanner
>      kb.data.banner = unArrayizeValue(inject.getValue(query,
> safeCharEncode=False))
>    File "/root/sqlmap-dev/lib/request/inject.py", line 388, in getValue
>      value = _goInferenceProxy(query, fromUser, batch, unpack,
> charsetType, firstChar, lastChar, dump)
>    File "/root/sqlmap-dev/lib/request/inject.py", line 269, in
> _goInferenceProxy
>      outputs = _goInferenceFields(expression, expressionFields,
> expressionFieldsList, payload, charsetType=charsetType,
> firstChar=firstChar, lastChar=lastChar, dump=dump)
>    File "/root/sqlmap-dev/lib/request/inject.py", line 117, in
> _goInferenceFields
>      output = _goInference(payload, expressionReplaced, charsetType,
> firstChar, lastChar, dump, field)
>    File "/root/sqlmap-dev/lib/request/inject.py", line 89, in _goInference
>      count, value = bisection(payload, expression, length, charsetType,
> firstChar, lastChar, dump)
>    File "/root/sqlmap-dev/lib/techniques/blind/inference.py", line 516,
> in bisection
>      val = getChar(index, asciiTbl)
>    File "/root/sqlmap-dev/lib/techniques/blind/inference.py", line 247,
> in getChar
>      result = Request.queryPage(forgedPayload,
> timeBasedCompare=timeBasedCompare, raise404=False)
>    File "/root/sqlmap-dev/lib/request/connect.py", line 764, in queryPage
>      Connect.queryPage(content=True)
>    File "/root/sqlmap-dev/lib/request/connect.py", line 693, in queryPage
>      auxHeaders[value.split(',')[0]] = value.split(',', 1)[1]
> AttributeError: 'NoneType' object has no attribute 'split'
>
> [*] shutting down at 02:44:32
>
> --
> Florian Strankowski
>
> Core Solutions
> Rosenstrasse 10
> 21335 Lueneburg, Germany
>
> phone +49 4131 70 63 968
> mobil +49 1769 73 17 000
>
>
> This e-mail may contain confidential and/or privileged information. If
> you are not the intended recipient (or have received this e-mail in
> error) please notify the sender immediately and destroy this e-mail. Any
> unauthorised copying, disclosure or distribution of the material in this
> e-mail is strictly forbidden and may be unlawful.
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Error

[Florian S. <fs...@co...>]

sqlmap version: 1.0-dev-aed833c
Python version: 2.6.6
Operating system: posix
Command line: ./sqlmap.py -u ***************************************** 
--headers=x-forwarded-for: 1* --threads 10 --banner
Technique: TIME
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
   File "/root/sqlmap-dev/_sqlmap.py", line 73, in main
     start()
   File "/root/sqlmap-dev/lib/controller/controller.py", line 569, in start
     action()
   File "/root/sqlmap-dev/lib/controller/action.py", line 31, in action
     setHandler()
   File "/root/sqlmap-dev/lib/controller/handler.py", line 81, in setHandler
     if handler.checkDbms():
   File "/root/sqlmap-dev/plugins/dbms/mysql/fingerprint.py", line 163, 
in checkDbms
     self.getBanner()
   File "/root/sqlmap-dev/plugins/generic/enumeration.py", line 57, in 
getBanner
     kb.data.banner = unArrayizeValue(inject.getValue(query, 
safeCharEncode=False))
   File "/root/sqlmap-dev/lib/request/inject.py", line 388, in getValue
     value = _goInferenceProxy(query, fromUser, batch, unpack, 
charsetType, firstChar, lastChar, dump)
   File "/root/sqlmap-dev/lib/request/inject.py", line 269, in 
_goInferenceProxy
     outputs = _goInferenceFields(expression, expressionFields, 
expressionFieldsList, payload, charsetType=charsetType, 
firstChar=firstChar, lastChar=lastChar, dump=dump)
   File "/root/sqlmap-dev/lib/request/inject.py", line 117, in 
_goInferenceFields
     output = _goInference(payload, expressionReplaced, charsetType, 
firstChar, lastChar, dump, field)
   File "/root/sqlmap-dev/lib/request/inject.py", line 89, in _goInference
     count, value = bisection(payload, expression, length, charsetType, 
firstChar, lastChar, dump)
   File "/root/sqlmap-dev/lib/techniques/blind/inference.py", line 516, 
in bisection
     val = getChar(index, asciiTbl)
   File "/root/sqlmap-dev/lib/techniques/blind/inference.py", line 247, 
in getChar
     result = Request.queryPage(forgedPayload, 
timeBasedCompare=timeBasedCompare, raise404=False)
   File "/root/sqlmap-dev/lib/request/connect.py", line 764, in queryPage
     Connect.queryPage(content=True)
   File "/root/sqlmap-dev/lib/request/connect.py", line 693, in queryPage
     auxHeaders[value.split(',')[0]] = value.split(',', 1)[1]
AttributeError: 'NoneType' object has no attribute 'split'

[*] shutting down at 02:44:32

-- 
Florian Strankowski

Core Solutions
Rosenstrasse 10
21335 Lueneburg, Germany

phone +49 4131 70 63 968
mobil +49 1769 73 17 000


This e-mail may contain confidential and/or privileged information. If 
you are not the intended recipient (or have received this e-mail in 
error) please notify the sender immediately and destroy this e-mail. Any 
unauthorised copying, disclosure or distribution of the material in this 
e-mail is strictly forbidden and may be unlawful.

Re: [sqlmap-users] signing requests before sending them

[Miroslav S. <mir...@gm...>]

Hi.

Could you please give more information?

Kind regards,
Miroslav Stampar
Dana 24.1.2013. 18:56 "Boris Chazalet" <bor...@or...> je
napisao/la:

> Hi,
>
> I need to sign the requests with a secret key before sending it to the
> server for them to be accepted. More precisely, I need to hash the
> different request parameters together with a secret key and to add that
> hash as an extra parameter in the final URL.
>
> Is that something that can be done with the --eval switch or do I need
> to modify the source code?
>
> Regards,
> Boris
>
>
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

[sqlmap-users] signing requests before sending them

[Boris C. <bor...@or...>]

Hi,

I need to sign the requests with a secret key before sending it to the 
server for them to be accepted. More precisely, I need to hash the 
different request parameters together with a secret key and to add that 
hash as an extra parameter in the final URL.

Is that something that can be done with the --eval switch or do I need 
to modify the source code?

Regards,
Boris