sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] GET Parameter Splitting

[Miroslav S. <mir...@gm...>]

Hi.

Just double checked and everything works as expected. Could you please send
your complete line you use?

Kind regards,
Miroslav Stampar

p.s. have you enclosed URL with double quotes?

On Tue, Jan 22, 2013 at 10:08 PM, Thunder Chunky <hac...@gm...>wrote:

> Hi Guys,
>
> The current URL that I am testing has several parameters the issue is that
> for the request to succeed all parameters need to be sent.
>
> URL = http://site.com/script?ex1=true&ex2=test&ex3=blah
>
> Unfortunately it appears that sqlmap splits the parameters and tests for
> the injection on each one individually i.e.
>
> Test 1 = http://site.com/script?ex1=true ' UNION
> Test 2 = http://site.com/script?ex2=test ' UNION
>
> Is there any way to make sqlmap perform the injection inline with the URL,
> thus sending all parameters to avoid the 404?
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] GET Parameter Splitting

[Thunder C. <hac...@gm...>]

Hi Guys,

The current URL that I am testing has several parameters the issue is that
for the request to succeed all parameters need to be sent.

URL = http://site.com/script?ex1=true&ex2=test&ex3=blah

Unfortunately it appears that sqlmap splits the parameters and tests for
the injection on each one individually i.e.

Test 1 = http://site.com/script?ex1=true ' UNION
Test 2 = http://site.com/script?ex2=test ' UNION

Is there any way to make sqlmap perform the injection inline with the URL,
thus sending all parameters to avoid the 404?

Re: [sqlmap-users] use blind SQL injection without some charactares due to a WAF

[Dennis <kor...@ya...>]

Damn, I was too slow :)


Am 18.01.2013 13:28, schrieb Miroslav Stampar:
>
> Hi.
>
> Try with --tamper=between.
>
> Kind regards,
> Miroslav Stampar
>
> p.s. It's actually a Python, not Perl
>
> Dana 18.1.2013. 13:19 "wh...@po... <mailto:wh...@po...>"
> <wh...@po... <mailto:wh...@po...>> je napisao/la:
>
>     Hi all,
>      
>     my current test is a web application that redirects me to a
>     generic page, whenever < or > is present in a parameter - before
>     the query gets to the application logic.
>     The application is injectable with a blind injection (MSSQL,
>     proven by manual checking and also found by sqlmap). But if I try
>     e.g. --current-user, sqlmap uses a query
>     with greater than ">" in the where clause :-(
>      
>     Is it possible to use other queries  (like only "=" or "!=" or
>     contains)?
>     I'm to lazy to program this myself - or try to understand the perl
>     - programs I used ages ago ;-)
>      
>      
>     Kind regards,
>      
>     Chris
>
>     ------------------------------------------------------------------------------
>     Master HTML5, CSS3, ASP.NET <http://ASP.NET>, MVC, AJAX,
>     Knockout.js, Web API and
>     much more. Get web development skills now with LearnDevNow -
>     350+ hours of step-by-step video tutorials by Microsoft MVPs and
>     experts.
>     SALE $99.99 this month only -- learn more at:
>     http://p.sf.net/sfu/learnmore_122812
>     _______________________________________________
>     sqlmap-users mailing list
>     sql...@li...
>     <mailto:sql...@li...>
>     https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
>
> ------------------------------------------------------------------------------
> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
> much more. Get web development skills now with LearnDevNow -
> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122812
>
>
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-

Re: [sqlmap-users] use blind SQL injection without some charactares due to a WAF

[Dennis <kor...@ya...>]

use tamper scripts. --tamper=between should do the trick if I'm not
mistaken.

Cheers,
Dennis


Am 18.01.2013 12:54, schrieb wh...@po...:
> Hi all,
>  
> my current test is a web application that redirects me to a generic
> page, whenever < or > is present in a parameter - before the query
> gets to the application logic.
> The application is injectable with a blind injection (MSSQL, proven by
> manual checking and also found by sqlmap). But if I try e.g.
> --current-user, sqlmap uses a query
> with greater than ">" in the where clause :-(
>  
> Is it possible to use other queries  (like only "=" or "!=" or contains)?
> I'm to lazy to program this myself - or try to understand the perl -
> programs I used ages ago ;-)
>  
>  
> Kind regards,
>  
> Chris
>
>
> ------------------------------------------------------------------------------
> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
> much more. Get web development skills now with LearnDevNow -
> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122812
>
>
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] use blind SQL injection without some charactares due to a WAF

[<wh...@po...>]

Hi Miroslav

RTFM ;-) that did the trick, thanks!

Chris


Miroslav Stampar <mir...@gm...> hat am 18. Januar 2013 um 13:28
geschrieben:

> 
>  Hi.
> 
>  Try with --tamper=between.
> 
>  Kind regards,
>  Miroslav Stampar
> 
>  p.s. It's actually a Python, not Perl
> 
>  Dana 18.1.2013. 13:19 " wh...@po... <mailto:wh...@po...> " <
> wh...@po... <mailto:wh...@po...> > je napisao/la:
>    > >    Hi all,
> > 
> >    my current test is a web application that redirects me to a generic page,
> > whenever < or > is present in a parameter - before the query gets to the
> > application logic.
> >    The application is injectable with a blind injection (MSSQL, proven by
> > manual checking and also found by sqlmap). But if I try e.g. --current-user,
> > sqlmap uses a query
> >    with greater than ">" in the where clause :-(
> > 
> >    Is it possible to use other queries  (like only "=" or "!=" or contains)?
> >    I'm to lazy to program this myself - or try to understand the perl -
> > programs I used ages ago ;-)
> > 
> > 
> >    Kind regards,
> > 
> >    Chris
> > 
> > 
> >   ------------------------------------------------------------------------------
> >    Master HTML5, CSS3, ASP.NET <http://ASP.NET> , MVC, AJAX, Knockout.js,
> > Web API and
> >    much more. Get web development skills now with LearnDevNow -
> >    350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> >    SALE $99.99 this month only -- learn more at:
> >    http://p.sf.net/sfu/learnmore_122812
> > <http://p.sf.net/sfu/learnmore_122812>
> >    _______________________________________________
> >    sqlmap-users mailing list
> >    sql...@li...
> > <mailto:sql...@li...>
> >    https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> > <https://lists.sourceforge.net/lists/listinfo/sqlmap-users>
> >  > 

Re: [sqlmap-users] use blind SQL injection without some charactares due to a WAF

[Miroslav S. <mir...@gm...>]

Hi.

Try with --tamper=between.

Kind regards,
Miroslav Stampar

p.s. It's actually a Python, not Perl
Dana 18.1.2013. 13:19 "wh...@po..." <wh...@po...> je napisao/la:

> **
>  Hi all,
>
>  my current test is a web application that redirects me to a generic page,
> whenever < or > is present in a parameter - before the query gets to the
> application logic.
>  The application is injectable with a blind injection (MSSQL, proven by
> manual checking and also found by sqlmap). But if I try e.g.
> --current-user, sqlmap uses a query
>  with greater than ">" in the where clause :-(
>
>  Is it possible to use other queries  (like only "=" or "!=" or contains)?
>  I'm to lazy to program this myself - or try to understand the perl -
> programs I used ages ago ;-)
>
>
>  Kind regards,
>
>  Chris
>
>
> ------------------------------------------------------------------------------
> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
> much more. Get web development skills now with LearnDevNow -
> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122812
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] use blind SQL injection without some charactares due to a WAF

[<wh...@po...>]

Hi all,

my current test is a web application that redirects me to a generic page,
whenever < or > is present in a parameter - before the query gets to the
application logic.
The application is injectable with a blind injection (MSSQL, proven by manual
checking and also found by sqlmap). But if I try e.g. --current-user, sqlmap
uses a query
with greater than ">" in the where clause :-(

Is it possible to use other queries  (like only "=" or "!=" or contains)?
I'm to lazy to program this myself - or try to understand the perl - programs I
used ages ago ;-)


Kind regards,

Chris

[sqlmap-users] (no subject)

[Stan S. <sep...@gm...>]

 I can not make it do it. I'm sure it's something that I'm doing as
obviously it should work but I can not get it to output a text file :(
I

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

Hi.

Traffic file should be inside the folder where you run sqlmap.py.

So, if you are running sqlmap.py from folder ABC, then traffic.txt should
be located in that same directory.

E.g.:
C:\sqlmap> python sqlmap.py -u "..." ... -t traffic.txt
....
C:\sqlmap>dir *.txt
traffic.txt

Kind regards,
Miroslav Stampar

On Wed, Jan 16, 2013 at 2:48 PM, Stan Smith <sep...@gm...> wrote:

>  I tried the traffic switch but there is no file created in rhe traffic
> folder. Honoured 2 be speaking to you by the way. :)
>
>
> ------------------------------------------------------------------------------
> Master Java SE, Java EE, Eclipse, Spring, Hibernate, JavaScript, jQuery
> and much more. Keep your Java skills current with LearnJavaNow -
> 200+ hours of step-by-step video tutorials by Java experts.
> SALE $49.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122612
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] (no subject)

[Stan S. <sep...@gm...>]

 I tried the traffic switch but there is no file created in rhe traffic
folder. Honoured 2 be speaking to you by the way. :)

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

Hi.

Well, you just append --fresh-queries -t traffic.txt to your normal sqlmap
run (e.g. python sqlmap.py -u "www.target.com/vuln.php?id=1" .... -t
traffic.txt --fresh-queries

I am interested in resulting "traffic.txt" file inside running directory.

Kind regards,
Miroslav Stampar

On Wed, Jan 16, 2013 at 2:23 PM, Stan Smith <sep...@gm...> wrote:

>  I can not seem to make it create the traffic file. :(
>
>  But I am using the version which was in the .zip file that I had downloaded here today. 16/1/2013
>
> https://github.com/sqlmapproject/sqlmap/zipball/master
>
> sqlmapproject-sqlmap-3464a70
>
>  I know that this is very little information to go on. Please advise me on how to provide you with more information.
>
>
>
> ------------------------------------------------------------------------------
> Master Java SE, Java EE, Eclipse, Spring, Hibernate, JavaScript, jQuery
> and much more. Keep your Java skills current with LearnJavaNow -
> 200+ hours of step-by-step video tutorials by Java experts.
> SALE $49.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122612
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] (no subject)

[Stan S. <sep...@gm...>]

 I can not seem to make it create the traffic file. :(

 But I am using the version which was in the .zip file that I had
downloaded here today. 16/1/2013

https://github.com/sqlmapproject/sqlmap/zipball/master
sqlmapproject-sqlmap-3464a70

 I know that this is very little information to go on. Please advise
me on how to provide you with more information.

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

Hi.

Which version do you use? Technique? Maybe you could send a traffic file
for that run (-t traffic.txt --fresh-queries).

Bye
Dana 16.1.2013. 11:57 "Stan Smith" <sep...@gm...> je napisao/la:

>  Having the same problem as described here with the currnt version of
> SQLMap.
>
> http://www.question-defense.com/2011/10/03/sqlmap-wont-enumerate-databases
>
> Any suggestions?
>
>
> ------------------------------------------------------------------------------
> Master Java SE, Java EE, Eclipse, Spring, Hibernate, JavaScript, jQuery
> and much more. Keep your Java skills current with LearnJavaNow -
> 200+ hours of step-by-step video tutorials by Java experts.
> SALE $49.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122612
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] (no subject)

[Stan S. <sep...@gm...>]

 Having the same problem as described here with the currnt version of
SQLMap.

http://www.question-defense.com/2011/10/03/sqlmap-wont-enumerate-databases

Any suggestions?

Re: [sqlmap-users] Issue #48

[Anton S. <ant...@gm...>]

Hi Miroslav,

You've indeed made my morning (although it's night here, but that would
sound awkward) :)

Thank a a bunch to you personally and all those involved.

Sincerely,
Anton.


On Sun, Jan 13, 2013 at 7:38 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Anton.
>
> Let me give to you a late Christmas present [1] :)
>
> Bye
>
> Kind regards,
> Miroslav Stampar
>
> [1] https://github.com/sqlmapproject/sqlmap/issues/48
>
> On Fri, Jan 11, 2013 at 8:22 PM, Anton Sazonov <ant...@gm...>wrote:
>
>> Hello Miroslav and tanks for answering,
>>
>> Never meant to be the pushy one, just felt that once in a half-year
>> reminder would stir things up :)
>>
>> Thanks for an unfortunately fitting analogy though.
>>
>> Anyway, I'm certainly not in position to push/alter your dev schedule,
>> only really wanted to remind you and fellow developers. Just in case. It's
>> been a long while, so do kindly understand my meaning. No offence intended
>> whatsoever. I'm not paying you, nor do you owe me anything. I'm well aware
>> of that. Again, sorry if I offended you or the devteam in some way.
>>
>> Let's write it off to the weekend and a six-pack.
>>
>> Cheers,
>> Anton (the #48 issue guy).
>>
>>
>> On Fri, Jan 11, 2013 at 11:13 PM, Miroslav Stampar <
>> mir...@gm...> wrote:
>>
>>> Hi Anton.
>>>
>>> I'll just use an analogy here. Everybody knows how (not paid) women
>>> react when you are being too pushy :). She'll eventually probably loose
>>> interest.
>>>
>>> Well, this was just an analogy. We'll do it eventually (maybe these
>>> days, can't promise).
>>>
>>> Bye
>>> Dana 11.1.2013. 19:41 "Anton Sazonov" <ant...@gm...> je
>>> napisao/la:
>>>
>>>>  Hello there and thanks a lot for a great product.
>>>>
>>>> I don't mean to be rude and/or insensitive, but is there any hope of
>>>> fixing issue #48 (https://github.com/sqlmapproject/sqlmap/issues/48),
>>>> specifically the possibility of injection into any HTTP header?
>>>>
>>>> Considering I likely first reported it half a year ago or so and it's
>>>> still nowhere near the completion, what would be the optimistic timeframe?
>>>>
>>>> I do understand that I'm not a paying customer and you, the developers,
>>>> do it in your free time, but still, it's actually more useful than
>>>> colorizing output.
>>>>
>>>> Just some pointers as to whether to expect this feature to be
>>>> implemented or not would be fine.
>>>>
>>>> Thanks,
>>>> Anton.
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
>>>> much more. Get web development skills now with LearnDevNow -
>>>> 350+ hours of step-by-step video tutorials by Microsoft MVPs and
>>>> experts.
>>>> SALE $99.99 this month only -- learn more at:
>>>> http://p.sf.net/sfu/learnmore_122812
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>> sql...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm

Re: [sqlmap-users] Issue #48

[Miroslav S. <mir...@gm...>]

Hi Anton.

Let me give to you a late Christmas present [1] :)

Bye

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/issues/48

On Fri, Jan 11, 2013 at 8:22 PM, Anton Sazonov <ant...@gm...>wrote:

> Hello Miroslav and tanks for answering,
>
> Never meant to be the pushy one, just felt that once in a half-year
> reminder would stir things up :)
>
> Thanks for an unfortunately fitting analogy though.
>
> Anyway, I'm certainly not in position to push/alter your dev schedule,
> only really wanted to remind you and fellow developers. Just in case. It's
> been a long while, so do kindly understand my meaning. No offence intended
> whatsoever. I'm not paying you, nor do you owe me anything. I'm well aware
> of that. Again, sorry if I offended you or the devteam in some way.
>
> Let's write it off to the weekend and a six-pack.
>
> Cheers,
> Anton (the #48 issue guy).
>
>
> On Fri, Jan 11, 2013 at 11:13 PM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> Hi Anton.
>>
>> I'll just use an analogy here. Everybody knows how (not paid) women react
>> when you are being too pushy :). She'll eventually probably loose interest.
>>
>> Well, this was just an analogy. We'll do it eventually (maybe these days,
>> can't promise).
>>
>> Bye
>> Dana 11.1.2013. 19:41 "Anton Sazonov" <ant...@gm...> je
>> napisao/la:
>>
>>>  Hello there and thanks a lot for a great product.
>>>
>>> I don't mean to be rude and/or insensitive, but is there any hope of
>>> fixing issue #48 (https://github.com/sqlmapproject/sqlmap/issues/48),
>>> specifically the possibility of injection into any HTTP header?
>>>
>>> Considering I likely first reported it half a year ago or so and it's
>>> still nowhere near the completion, what would be the optimistic timeframe?
>>>
>>> I do understand that I'm not a paying customer and you, the developers,
>>> do it in your free time, but still, it's actually more useful than
>>> colorizing output.
>>>
>>> Just some pointers as to whether to expect this feature to be
>>> implemented or not would be fine.
>>>
>>> Thanks,
>>> Anton.
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
>>> much more. Get web development skills now with LearnDevNow -
>>> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
>>> SALE $99.99 this month only -- learn more at:
>>> http://p.sf.net/sfu/learnmore_122812
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Issue #48

[Stephen S. <ss...@ss...>]

If you really want it implemented, you could always learn Python and try
doing it yourself. Good chance to expand your horizons, and if you're doing
any kind of pentesting, knowing how to write scripts in Python probably
isn't a bad skill.

Thanks,
Stephen

On Sat, Jan 12, 2013 at 8:22 AM, Anton Sazonov <ant...@gm...>wrote:

> Hello Miroslav and tanks for answering,
>
> Never meant to be the pushy one, just felt that once in a half-year
> reminder would stir things up :)
>
> Thanks for an unfortunately fitting analogy though.
>
> Anyway, I'm certainly not in position to push/alter your dev schedule,
> only really wanted to remind you and fellow developers. Just in case. It's
> been a long while, so do kindly understand my meaning. No offence intended
> whatsoever. I'm not paying you, nor do you owe me anything. I'm well aware
> of that. Again, sorry if I offended you or the devteam in some way.
>
> Let's write it off to the weekend and a six-pack.
>
> Cheers,
> Anton (the #48 issue guy).
>
>
> On Fri, Jan 11, 2013 at 11:13 PM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> Hi Anton.
>>
>> I'll just use an analogy here. Everybody knows how (not paid) women react
>> when you are being too pushy :). She'll eventually probably loose interest.
>>
>> Well, this was just an analogy. We'll do it eventually (maybe these days,
>> can't promise).
>>
>> Bye
>> Dana 11.1.2013. 19:41 "Anton Sazonov" <ant...@gm...> je
>> napisao/la:
>>
>>>  Hello there and thanks a lot for a great product.
>>>
>>> I don't mean to be rude and/or insensitive, but is there any hope of
>>> fixing issue #48 (https://github.com/sqlmapproject/sqlmap/issues/48),
>>> specifically the possibility of injection into any HTTP header?
>>>
>>> Considering I likely first reported it half a year ago or so and it's
>>> still nowhere near the completion, what would be the optimistic timeframe?
>>>
>>> I do understand that I'm not a paying customer and you, the developers,
>>> do it in your free time, but still, it's actually more useful than
>>> colorizing output.
>>>
>>> Just some pointers as to whether to expect this feature to be
>>> implemented or not would be fine.
>>>
>>> Thanks,
>>> Anton.
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
>>> much more. Get web development skills now with LearnDevNow -
>>> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
>>> SALE $99.99 this month only -- learn more at:
>>> http://p.sf.net/sfu/learnmore_122812
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>
>
> ------------------------------------------------------------------------------
> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
> much more. Get web development skills now with LearnDevNow -
> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122812
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] Issue #48

[Anton S. <ant...@gm...>]

Hello Miroslav and tanks for answering,

Never meant to be the pushy one, just felt that once in a half-year
reminder would stir things up :)

Thanks for an unfortunately fitting analogy though.

Anyway, I'm certainly not in position to push/alter your dev schedule, only
really wanted to remind you and fellow developers. Just in case. It's been
a long while, so do kindly understand my meaning. No offence intended
whatsoever. I'm not paying you, nor do you owe me anything. I'm well aware
of that. Again, sorry if I offended you or the devteam in some way.

Let's write it off to the weekend and a six-pack.

Cheers,
Anton (the #48 issue guy).


On Fri, Jan 11, 2013 at 11:13 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Anton.
>
> I'll just use an analogy here. Everybody knows how (not paid) women react
> when you are being too pushy :). She'll eventually probably loose interest.
>
> Well, this was just an analogy. We'll do it eventually (maybe these days,
> can't promise).
>
> Bye
> Dana 11.1.2013. 19:41 "Anton Sazonov" <ant...@gm...> je
> napisao/la:
>
>>  Hello there and thanks a lot for a great product.
>>
>> I don't mean to be rude and/or insensitive, but is there any hope of
>> fixing issue #48 (https://github.com/sqlmapproject/sqlmap/issues/48),
>> specifically the possibility of injection into any HTTP header?
>>
>> Considering I likely first reported it half a year ago or so and it's
>> still nowhere near the completion, what would be the optimistic timeframe?
>>
>> I do understand that I'm not a paying customer and you, the developers,
>> do it in your free time, but still, it's actually more useful than
>> colorizing output.
>>
>> Just some pointers as to whether to expect this feature to be implemented
>> or not would be fine.
>>
>> Thanks,
>> Anton.
>>
>>
>> ------------------------------------------------------------------------------
>> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
>> much more. Get web development skills now with LearnDevNow -
>> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
>> SALE $99.99 this month only -- learn more at:
>> http://p.sf.net/sfu/learnmore_122812
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>

Re: [sqlmap-users] Issue #48

[Miroslav S. <mir...@gm...>]

Hi Anton.

I'll just use an analogy here. Everybody knows how (not paid) women react
when you are being too pushy :). She'll eventually probably loose interest.

Well, this was just an analogy. We'll do it eventually (maybe these days,
can't promise).

Bye
Dana 11.1.2013. 19:41 "Anton Sazonov" <ant...@gm...> je
napisao/la:

> Hello there and thanks a lot for a great product.
>
> I don't mean to be rude and/or insensitive, but is there any hope of
> fixing issue #48 (https://github.com/sqlmapproject/sqlmap/issues/48),
> specifically the possibility of injection into any HTTP header?
>
> Considering I likely first reported it half a year ago or so and it's
> still nowhere near the completion, what would be the optimistic timeframe?
>
> I do understand that I'm not a paying customer and you, the developers, do
> it in your free time, but still, it's actually more useful than colorizing
> output.
>
> Just some pointers as to whether to expect this feature to be implemented
> or not would be fine.
>
> Thanks,
> Anton.
>
>
> ------------------------------------------------------------------------------
> Master HTML5, CSS3, ASP.NET, MVC, AJAX, Knockout.js, Web API and
> much more. Get web development skills now with LearnDevNow -
> 350+ hours of step-by-step video tutorials by Microsoft MVPs and experts.
> SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122812
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] Issue #48

[Anton S. <ant...@gm...>]

Hello there and thanks a lot for a great product.

I don't mean to be rude and/or insensitive, but is there any hope of fixing
issue #48 (https://github.com/sqlmapproject/sqlmap/issues/48), specifically
the possibility of injection into any HTTP header?

Considering I likely first reported it half a year ago or so and it's still
nowhere near the completion, what would be the optimistic timeframe?

I do understand that I'm not a paying customer and you, the developers, do
it in your free time, but still, it's actually more useful than colorizing
output.

Just some pointers as to whether to expect this feature to be implemented
or not would be fine.

Thanks,
Anton.

Re: [sqlmap-users] testing SQLi in cookies

[Bernardo D. A. G. <ber...@gm...>]

Add to your command line --level 3. Refer to user's manual for further
details on --level and --risk.

Bernardo


On 10 January 2013 00:27, Mr X0rcist <mr....@gm...> wrote:
> Hi,
>
> I am trying to test SQLi in one of the cookie.  I know it is in there.
>
> I have tried to run it like  -u "https://url.com/?p1"&p2&p3 --cookie="c1;=v2
> c2=v2" -p c2
>
> but it is giving me error something like no parameter in get string.
>
> I also tried to pass on whole get request loaded from file like
>
> -r file -p=c2  but still same kind of error.
>
> I dont want to waste time will sqlmap is testing against 8-10 GET
> parameters, required by application to avoid error or redirection while SQLi
> is in the cookie
>
>
> Any advise will be appreciated.
>
> Thanks
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122712
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

[sqlmap-users] testing SQLi in cookies

[Mr X. <mr....@gm...>]

Hi,

I am trying to test SQLi in one of the cookie.  I know it is in there.

I have tried to run it like  -u "https://url.com/?p1"&p2&p3
--cookie="c1;=v2 c2=v2" -p c2

but it is giving me error something like no parameter in get string.

I also tried to pass on whole get request loaded from file like

-r file -p=c2  but still same kind of error.

I dont want to waste time will sqlmap is testing against 8-10 GET
parameters, required by application to avoid error or redirection while
SQLi is in the cookie


Any advise will be appreciated.

Thanks

Re: [sqlmap-users] SQLMAP bug

[Bernardo D. A. G. <ber...@gm...>]

Fixed now.

Bernardo & Miroslav


On 7 January 2013 17:20, Bernardo Damele A. G.
<ber...@gm...> wrote:
> Hi Yuri,
>
> I noticed this too[1] few minutes ago.
> We're working on a fix as I type.
>
> [1] https://github.com/sqlmapproject/sqlmap/issues/305#issuecomment-11960592
>
> Bernardo
>
>
> On 7 January 2013 16:50, Jerzy Yuri Kramarz <JY...@65...> wrote:
>> Hi Guys,
>>
>> Great tool but for the first time ever I've managed to see the following
>> error when testing oracle DB:
>>
>> sqlmap version: 1.0-dev-74552be
>> Python version: 2.6.6
>> Operating system: posix
>> Command line: ./sqlmap.py
>> *****************************************************************
>> --cookie=*********************************************************************
>> --dbms=oracle --level=5 --risk=5 --force-ssl --thread=1 --technique=T -p
>> param --sql-query=SELECT UTL_INADDR.get_host_name FROM dual;
>> Technique: TIME
>> Back-end DBMS: Oracle (fingerprinted)
>> Traceback (most recent call last):
>>   File "/opt/sqlmap-dev/_sqlmap.py", line 73, in main
>>     start()
>>   File "/opt/sqlmap-dev/lib/controller/controller.py", line 567, in start
>>     action()
>>   File "/opt/sqlmap-dev/lib/controller/action.py", line 135, in action
>>     conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
>>   File "/opt/sqlmap-dev/plugins/generic/custom.py", line 46, in sqlQuery
>>     output = inject.getValue(query, fromUser=True)
>>   File "/opt/sqlmap-dev/lib/request/inject.py", line 390, in getValue
>>     value = _goInferenceProxy(query, fromUser, batch, unpack,
>> charsetType, firstChar, lastChar, dump)
>>   File "/opt/sqlmap-dev/lib/request/inject.py", line 269, in
>> _goInferenceProxy
>>     outputs = _goInferenceFields(expression, expressionFields,
>> expressionFieldsList, payload, charsetType=charsetType,
>> firstChar=firstChar, lastChar=lastChar, dump=dump)
>>   File "/opt/sqlmap-dev/lib/request/inject.py", line 117, in
>> _goInferenceFields
>>     output = _goInference(payload, expressionReplaced, charsetType,
>> firstChar, lastChar, dump, field)
>>   File "/opt/sqlmap-dev/lib/request/inject.py", line 89, in _goInference
>>     count, value = bisection(payload, expression, length, charsetType,
>> firstChar, lastChar, dump)
>>   File "/opt/sqlmap-dev/lib/techniques/blind/inference.py", line 120, in
>> bisection
>>     length = min(length, lastChar or length) - firstChar
>> TypeError: unsupported operand type(s) for -: 'NoneType' and 'int'
>>
>>
>> ------------------------------------------------------------------------------
>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>> MVPs and experts. SALE $99.99 this month only -- learn more at:
>> http://p.sf.net/sfu/learnmore_122412
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
>
> --
> Bernardo Damele A. G.
>
> E-mail / Jabber: bernardo.damele (at) gmail.com
> Mobile: +447788962949 (UK 07788962949)



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] SQLMAP bug

[Bernardo D. A. G. <ber...@gm...>]

Hi Yuri,

I noticed this too[1] few minutes ago.
We're working on a fix as I type.

[1] https://github.com/sqlmapproject/sqlmap/issues/305#issuecomment-11960592

Bernardo


On 7 January 2013 16:50, Jerzy Yuri Kramarz <JY...@65...> wrote:
> Hi Guys,
>
> Great tool but for the first time ever I've managed to see the following
> error when testing oracle DB:
>
> sqlmap version: 1.0-dev-74552be
> Python version: 2.6.6
> Operating system: posix
> Command line: ./sqlmap.py
> *****************************************************************
> --cookie=*********************************************************************
> --dbms=oracle --level=5 --risk=5 --force-ssl --thread=1 --technique=T -p
> param --sql-query=SELECT UTL_INADDR.get_host_name FROM dual;
> Technique: TIME
> Back-end DBMS: Oracle (fingerprinted)
> Traceback (most recent call last):
>   File "/opt/sqlmap-dev/_sqlmap.py", line 73, in main
>     start()
>   File "/opt/sqlmap-dev/lib/controller/controller.py", line 567, in start
>     action()
>   File "/opt/sqlmap-dev/lib/controller/action.py", line 135, in action
>     conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
>   File "/opt/sqlmap-dev/plugins/generic/custom.py", line 46, in sqlQuery
>     output = inject.getValue(query, fromUser=True)
>   File "/opt/sqlmap-dev/lib/request/inject.py", line 390, in getValue
>     value = _goInferenceProxy(query, fromUser, batch, unpack,
> charsetType, firstChar, lastChar, dump)
>   File "/opt/sqlmap-dev/lib/request/inject.py", line 269, in
> _goInferenceProxy
>     outputs = _goInferenceFields(expression, expressionFields,
> expressionFieldsList, payload, charsetType=charsetType,
> firstChar=firstChar, lastChar=lastChar, dump=dump)
>   File "/opt/sqlmap-dev/lib/request/inject.py", line 117, in
> _goInferenceFields
>     output = _goInference(payload, expressionReplaced, charsetType,
> firstChar, lastChar, dump, field)
>   File "/opt/sqlmap-dev/lib/request/inject.py", line 89, in _goInference
>     count, value = bisection(payload, expression, length, charsetType,
> firstChar, lastChar, dump)
>   File "/opt/sqlmap-dev/lib/techniques/blind/inference.py", line 120, in
> bisection
>     length = min(length, lastChar or length) - firstChar
> TypeError: unsupported operand type(s) for -: 'NoneType' and 'int'
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. SALE $99.99 this month only -- learn more at:
> http://p.sf.net/sfu/learnmore_122412
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

[sqlmap-users] SQLMAP bug

[Jerzy Y. K. <JY...@65...>]

Hi Guys,

Great tool but for the first time ever I've managed to see the following
error when testing oracle DB:

sqlmap version: 1.0-dev-74552be
Python version: 2.6.6
Operating system: posix
Command line: ./sqlmap.py
*****************************************************************
--cookie=*********************************************************************
--dbms=oracle --level=5 --risk=5 --force-ssl --thread=1 --technique=T -p
param --sql-query=SELECT UTL_INADDR.get_host_name FROM dual;
Technique: TIME
Back-end DBMS: Oracle (fingerprinted)
Traceback (most recent call last):
  File "/opt/sqlmap-dev/_sqlmap.py", line 73, in main
    start()
  File "/opt/sqlmap-dev/lib/controller/controller.py", line 567, in start
    action()
  File "/opt/sqlmap-dev/lib/controller/action.py", line 135, in action
    conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
  File "/opt/sqlmap-dev/plugins/generic/custom.py", line 46, in sqlQuery
    output = inject.getValue(query, fromUser=True)
  File "/opt/sqlmap-dev/lib/request/inject.py", line 390, in getValue
    value = _goInferenceProxy(query, fromUser, batch, unpack,
charsetType, firstChar, lastChar, dump)
  File "/opt/sqlmap-dev/lib/request/inject.py", line 269, in
_goInferenceProxy
    outputs = _goInferenceFields(expression, expressionFields,
expressionFieldsList, payload, charsetType=charsetType,
firstChar=firstChar, lastChar=lastChar, dump=dump)
  File "/opt/sqlmap-dev/lib/request/inject.py", line 117, in
_goInferenceFields
    output = _goInference(payload, expressionReplaced, charsetType,
firstChar, lastChar, dump, field)
  File "/opt/sqlmap-dev/lib/request/inject.py", line 89, in _goInference
    count, value = bisection(payload, expression, length, charsetType,
firstChar, lastChar, dump)
  File "/opt/sqlmap-dev/lib/techniques/blind/inference.py", line 120, in
bisection
    length = min(length, lastChar or length) - firstChar
TypeError: unsupported operand type(s) for -: 'NoneType' and 'int'