sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] Melhorar o scan

[André S. <and...@gm...>]

Sir,

Keep this kind of things to your self.

Don´t use this mailing list to publicly tools or links. Are you missing the
legal part?

More, you don´t know what you are talking about.

Sqlmap is indeed a great tool.

2012/8/27 Roberto Neves <rc...@ho...>

>  For now the havij is still the best scan sqlinjection.
> SqlMap can not scan the many URLs.
> Example havij the scaneia http://allindiabirdingtours.com/index.php?id=6
> very easily and quickly. The SqlMap not.
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] Melhorar o scan

[Roberto N. <rc...@ho...>]

For now the havij is still the best scan sqlinjection.
SqlMap can not scan the many URLs.
Example havij the scaneia http://allindiabirdingtours.com/index.php?id=6
very easily and quickly. The SqlMap not. 		 	   		  

Re: [sqlmap-users] freebsd9.0/unhandled exception in sqlmap/0.9

[Miroslav S. <mir...@gm...>]

Hi Mao.

Please download the latest revision from our GitHub repository [1] and
retry it again. You are using fairly outdated version right now.

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/zipball/master

On Mon, Aug 27, 2012 at 6:06 AM, milong mao <mil...@gm...> wrote:

> sqlmap is running, please wait..
>
> sqlmap identified the following injection points with a total of 0 HTTP(s)
> requests:
> ---
> Place: GET
> Parameter: id
>     Type: boolean-based blind
>     Title: AND boolean-based blind - WHERE or HAVING clause
>     Payload: id=1 AND 6097=6097
> ---
>
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft Access
> banner:    'None'
>
> current user:    'None'
>
> current database:    'None'
>
> [11:15:53] [CRITICAL] unhandled exception in sqlmap/0.9, retry your run
> with the latest development version from the Subversion repository. If the
> exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the
> bug, fix it accordingly and get back to you.
> sqlmap version: 0.9
> Python version: 2.7.3
> Operating system: posix
> Command line: sqlmap.py --wizard
> Technique: None
> Back-end DBMS: Microsoft Access (fingerprinted)
> Traceback (most recent call last):
>   File "sqlmap.py", line 82, in main
>     start()
>   File
> "/usr/local/lib/python2.7/site-packages/sqlmap/lib/controller/controller.py",
> line 447, in start
>     action()
>   File
> "/usr/local/lib/python2.7/site-packages/sqlmap/lib/controller/action.py",
> line 70, in action
>     conf.dumper.dba(conf.dbmsHandler.isDba())
>   File
> "/usr/local/lib/python2.7/site-packages/sqlmap/plugins/generic/enumeration.py",
> line 149, in isDba
>     query = queries[Backend.getIdentifiedDbms()].is_dba.query
>   File
> "/usr/local/lib/python2.7/site-packages/sqlmap/extra/xmlobject/xmlobject.py",
> line 372, in __getattr__
>     raise AttributeError(attr)
> AttributeError: query
>
> [*] shutting down at: 11:15:53
>
> =================================
> Operating SYSTEM:FreeBSD 9.0-RELEASE-p4
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] freebsd9.0/unhandled exception in sqlmap/0.9

[milong m. <mil...@gm...>]

sqlmap is running, please wait..

sqlmap identified the following injection points with a total of 0 HTTP(s)
requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 6097=6097
---

web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
banner:    'None'

current user:    'None'

current database:    'None'

[11:15:53] [CRITICAL] unhandled exception in sqlmap/0.9, retry your run
with the latest development version from the Subversion repository. If the
exception persists, please send by e-mail to
sql...@li... the following text and any information
required to reproduce the bug. The developers will try to reproduce the
bug, fix it accordingly and get back to you.
sqlmap version: 0.9
Python version: 2.7.3
Operating system: posix
Command line: sqlmap.py --wizard
Technique: None
Back-end DBMS: Microsoft Access (fingerprinted)
Traceback (most recent call last):
  File "sqlmap.py", line 82, in main
    start()
  File
"/usr/local/lib/python2.7/site-packages/sqlmap/lib/controller/controller.py",
line 447, in start
    action()
  File
"/usr/local/lib/python2.7/site-packages/sqlmap/lib/controller/action.py",
line 70, in action
    conf.dumper.dba(conf.dbmsHandler.isDba())
  File
"/usr/local/lib/python2.7/site-packages/sqlmap/plugins/generic/enumeration.py",
line 149, in isDba
    query = queries[Backend.getIdentifiedDbms()].is_dba.query
  File
"/usr/local/lib/python2.7/site-packages/sqlmap/extra/xmlobject/xmlobject.py",
line 372, in __getattr__
    raise AttributeError(attr)
AttributeError: query

[*] shutting down at: 11:15:53

=================================
Operating SYSTEM:FreeBSD 9.0-RELEASE-p4

[sqlmap-users] Two problems with sqlmap

[Duarte S. <dua...@se...>]

Hi all,

when sqlmap is dumping a sample of table data I get this:

> Exception AttributeError: AttributeError("'NoneType' object has no attribute
> 'remove'",) in <bound method BigArray.__del__ of ...[' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '',
> ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '
> ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ']> ignored

This tends to happen with big dumps, that error shows for each column 
extracted from the table.

The other problem is that sqlmap heuristics aren't able to identify the 
database correctly. The webpage shows the following error

> Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
> resource in /home/(...) on line 17

> Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
> resource in /home/(...) on line 70

Sqlmap writes unknown DBMS in the heuristics message. I have sqlmap updated up 
to commit 2af1313010c539adb179cbe4bca988c1213cee13.

Regards,
Duarte Silva

Re: [sqlmap-users] Anyone having trouble with --eval?

[Miroslav S. <mir...@gm...>]

Hi Sergio.

Sorry for not responding earlier. Just opened an issue [1] for this bug.
Will try to fix it today.

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/issues/157

On Fri, Aug 17, 2012 at 2:10 PM, Sergio Molina <sm...@wp...> wrote:

> Hi there
>
> Just downloaded latest dev version (actually I did yesterday). I am having
> trouble with --eval, sqlmap complains when running evaluateCode with
> modified parameters (something like pincode=abc123'' stuff). More
> precisely,  the following lines in lib/request/connect.py:
>
> for part in item.split(delimiter):
>   if '=' in part:
>     name, value = part.split('=', 1)
>     evaluateCode(”%s='%s'” % (name, value), variables)
>
> When providing next value for --eval:
>
> --eval "import random;import urllib2;numRequest=random.randint(1,
> 999999999);userId='sq...@wp...'+str(numRequest);headers = {
> 'Accept-Language' : 'en-us,en;q=0.5    '}; req =
> urllib2.Request('${SAFE_UPSELL_URL}&userId='+ userId, None, headers);
> response = urllib2.urlopen(req);"
>
> Just want to do something like --safe-url and --safe-freq combination but
> using same userId fo both related requests while using different userId for
> every other pair of requests.
>
> Sorry I am not good at python. Am I missing anything ? Or is it a bug ?
>
> Thanks in advance !
>
> Regards
> Sergio M
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] UnicodeEncodeError: 'ascii' codec can't encode characters in position 32-47: ordinal not in range(128)

[Miroslav S. <mir...@gm...>]

Hi.

This should (hopefully) being fixed now with the latest commit [1].

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/issues/152

On Sun, Aug 19, 2012 at 10:11 PM, Happy User <rob...@gm...>wrote:

> Traceback (most recent call last):
>    File "D:\Soft\sqlmap-dev\_sqlmap.py", line 72, in main
>      start()
>    File "D:\Soft\sqlmap-dev\lib\controller\controller.py", line 355, in
> start
>      checkNullConnection()
>    File "D:\Soft\sqlmap-dev\lib\controller\checks.py", line 960, in
> checkNullConnection
>      page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD)
>    File "D:\Soft\sqlmap-dev\lib\request\connect.py", line 322, in getPage
>      conn = urllib2.urlopen(req)
>    File "C:\Python27\lib\urllib2.py", line 126, in urlopen
>      return _opener.open(url, data, timeout)
>    File "C:\Python27\lib\urllib2.py", line 400, in open
>      response = self._open(req, data)
>    File "C:\Python27\lib\urllib2.py", line 418, in _open
>      '_open', req)
>    File "C:\Python27\lib\urllib2.py", line 378, in _call_chain
>      result = func(*args)
>    File "C:\Python27\lib\urllib2.py", line 1207, in http_open
>      return self.do_open(httplib.HTTPConnection, req)
>    File "C:\Python27\lib\urllib2.py", line 1174, in do_open
>      h.request(req.get_method(), req.get_selector(), req.data, headers)
>    File "C:\Python27\lib\httplib.py", line 958, in request
>      self._send_request(method, url, body, headers)
>    File "C:\Python27\lib\httplib.py", line 992, in _send_request
>      self.endheaders(body)
>    File "C:\Python27\lib\httplib.py", line 954, in endheaders
>      self._send_output(message_body)
>    File "C:\Python27\lib\httplib.py", line 814, in _send_output
>      self.send(msg)
>    File "C:\Python27\lib\httplib.py", line 790, in send
>      self.sock.sendall(data)
>    File "C:\Python27\lib\socket.py", line 224, in meth
>      return getattr(self._sock,name)(*args)
> UnicodeEncodeError: 'ascii' codec can't encode characters in position
> 32-47: ordinal not in range(128)
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] UnicodeEncodeError: 'ascii' codec can't encode characters in position 32-47: ordinal not in range(128)

[Happy U. <rob...@gm...>]

Traceback (most recent call last):
   File "D:\Soft\sqlmap-dev\_sqlmap.py", line 72, in main
     start()
   File "D:\Soft\sqlmap-dev\lib\controller\controller.py", line 355, in 
start
     checkNullConnection()
   File "D:\Soft\sqlmap-dev\lib\controller\checks.py", line 960, in 
checkNullConnection
     page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD)
   File "D:\Soft\sqlmap-dev\lib\request\connect.py", line 322, in getPage
     conn = urllib2.urlopen(req)
   File "C:\Python27\lib\urllib2.py", line 126, in urlopen
     return _opener.open(url, data, timeout)
   File "C:\Python27\lib\urllib2.py", line 400, in open
     response = self._open(req, data)
   File "C:\Python27\lib\urllib2.py", line 418, in _open
     '_open', req)
   File "C:\Python27\lib\urllib2.py", line 378, in _call_chain
     result = func(*args)
   File "C:\Python27\lib\urllib2.py", line 1207, in http_open
     return self.do_open(httplib.HTTPConnection, req)
   File "C:\Python27\lib\urllib2.py", line 1174, in do_open
     h.request(req.get_method(), req.get_selector(), req.data, headers)
   File "C:\Python27\lib\httplib.py", line 958, in request
     self._send_request(method, url, body, headers)
   File "C:\Python27\lib\httplib.py", line 992, in _send_request
     self.endheaders(body)
   File "C:\Python27\lib\httplib.py", line 954, in endheaders
     self._send_output(message_body)
   File "C:\Python27\lib\httplib.py", line 814, in _send_output
     self.send(msg)
   File "C:\Python27\lib\httplib.py", line 790, in send
     self.sock.sendall(data)
   File "C:\Python27\lib\socket.py", line 224, in meth
     return getattr(self._sock,name)(*args)
UnicodeEncodeError: 'ascii' codec can't encode characters in position 
32-47: ordinal not in range(128)

[sqlmap-users] Anyone having trouble with --eval?

[Sergio M. <sm...@wp...>]

Hi there

Just downloaded latest dev version (actually I did yesterday). I am having
trouble with --eval, sqlmap complains when running evaluateCode with
modified parameters (something like pincode=abc123'' stuff). More
precisely,  the following lines in lib/request/connect.py:

for part in item.split(delimiter):
  if '=' in part:
    name, value = part.split('=', 1)
    evaluateCode(”%s='%s'” % (name, value), variables)

When providing next value for --eval:

--eval "import random;import urllib2;numRequest=random.randint(1,
999999999);userId='sq...@wp...'+str(numRequest);headers = {
'Accept-Language' : 'en-us,en;q=0.5    '}; req =
urllib2.Request('${SAFE_UPSELL_URL}&userId='+ userId, None, headers);
response = urllib2.urlopen(req);"

Just want to do something like --safe-url and --safe-freq combination but
using same userId fo both related requests while using different userId for
every other pair of requests.

Sorry I am not good at python. Am I missing anything ? Or is it a bug ?

Thanks in advance !

Regards
Sergio M

Re: [sqlmap-users] Rieqy Erysya

[Miroslav S. <mir...@gm...>]

Hi.

Find it fixed now [1].

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/issues/59

On Thu, Aug 16, 2012 at 7:35 AM, root rieqy <roo...@gm...> wrote:

> Hello sqlmap team :D
> i had download new version of sqlmap(sqlmap version 1.0)
> and i have always get error when every i write :
> [code]F:\sqlmap>sqlmap.py -g "inurl:view.php?id=23"[/code]
> it syntax giving error like this:
> [code][12:21:35] [CRITICAL] unable to find results for your Google dork
> expression[/code]
>
> why it happened ? whereas I've download new version of sqlmap
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Rieqy Erysya

[root r. <roo...@gm...>]

Hello sqlmap team :D
i had download new version of sqlmap(sqlmap version 1.0)
and i have always get error when every i write :
[code]F:\sqlmap>sqlmap.py -g "inurl:view.php?id=23"[/code]
it syntax giving error like this:
[code][12:21:35] [CRITICAL] unable to find results for your Google dork
expression[/code]

why it happened ? whereas I've download new version of sqlmap

Re: [sqlmap-users] tag FORM not supported

[Miroslav S. <mir...@gm...>]

Hi.

This is solely coming from a 3rd party library ClientForm [1] and we don't
like to change anything inside those. Nevertheless, find it "patched" with
the latest commit [2].

Kind regards,
Miroslav Stampar

[1] http://pypi.python.org/pypi/ClientForm/0.2.10
[2] https://github.com/sqlmapproject/sqlmap/issues/143

On Thu, Aug 9, 2012 at 12:42 PM, Chris Oakley
<chr...@gm...>wrote:

> Even though it's wrong to use GET with this enctype, I think it will still
> work:
>
> http://oi49.tinypic.com/2yn2r9w.jpg
>
> So if this is interacting with a database, there could still be an
> injection.  Perhaps the check that sqlmap does is too simplistic?
>
> Regards
>
> Chris
>
> On 9 August 2012 11:23, Marco Mirandola <mm...@gm...> wrote:
>
>> But rather than check enctype = "multipart / form-data", which in my case
>> does not include any upload (see attached html), because not only excludes
>> only the possible upload?
>> we are in the attached example:
>>
>> 2 select (combobox)
>> 3 checkboxes
>>
>> both valid for the injection ...
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] tag FORM not supported

[Chris O. <chr...@gm...>]

Even though it's wrong to use GET with this enctype, I think it will still
work:

http://oi49.tinypic.com/2yn2r9w.jpg

So if this is interacting with a database, there could still be an
injection.  Perhaps the check that sqlmap does is too simplistic?

Regards

Chris

On 9 August 2012 11:23, Marco Mirandola <mm...@gm...> wrote:

> But rather than check enctype = "multipart / form-data", which in my case
> does not include any upload (see attached html), because not only excludes
> only the possible upload?
> we are in the attached example:
>
> 2 select (combobox)
> 3 checkboxes
>
> both valid for the injection ...
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] tag FORM not supported

[Marco M. <mm...@gm...>]

But rather than check enctype = "multipart / form-data", which in my case
does not include any upload (see attached html), because not only excludes
only the possible upload?
we are in the attached example:

2 select (combobox)
3 checkboxes

both valid for the injection ...

Re: [sqlmap-users] tag FORM not supported

[Miroslav S. <mir...@gm...>]

Hi all.

Timon is right. I don't have anything more to say.

Kind regards,
Miroslav Stampar

On Thu, Aug 9, 2012 at 10:06 AM, Timon Wang <tim...@gm...> wrote:

> So special...
> Form method is get ,and enctype equals multipart/form-data. That's not
> a valid form, you can't use this to upload file or submit data I
> think.
>
> On Thu, Aug 9, 2012 at 3:53 PM, Marco Mirandola <mm...@gm...> wrote:
> > Hi Sqlmap team :-)
> >
> > This is the error:
> >
> > =====================================================================
> > [09:40:35] [INFO] testing connection to the target url
> > [09:40:36] [INFO] searching for forms
> > [09:40:37] [CRITICAL] there has been a problem while processing page
> forms
> > ('unk
> > nown GET form encoding type 'multipart/form-data'')
> > =====================================================================
> >
> > And this is the stub of html page
> > =====================================================================
> >
> > <form name="choice" enctype="multipart/form-data" method="GET"
> > action="/result.php" style="display:inline;">
> > <select style="margin-bottom:10px;" name="categoria" id="categoria">
> > <option value="">Tutti</option>
> > <option selected="selected" >Coppie</option>
> > <option value="a">a</option>
> > <option  value="b">b</option>
> > <option  value="c">c</option>
> > <option  value="d">d</option>
> > <option >e</option>
> > <option >f</option>
> > <option >g</option>
> > <option >h</option>
> > <option  value="i">i</option>
> > </select>
> > <br>
> > <select name="regione" id="regione" style="margin-top:8px;
> > margin-bottom:8px;">
> > <option selected="selected"></option>
> > <option></option>
> > <option value="Abruzzo" >Abruzzo</option>
> > <option value="Basilicata"  >Basilicata</option>
> > <option value="Calabria" >Calabria</option>
> > <option value="Campania" >Campania</option>
> > <option value="Emilia Romagna" >Emilia Romagna</option>
> > <option value="Friuli" >Friuli</option>
> > <option value="Lazio">Lazio</option>
> > <option value="Liguria" >Liguria</option>
> > <option value="Lombardia" >Lombardia</option>
> > <option value="Marche" >Marche</option>
> > <option value="Molise" >Molise</option>
> > <option value="Piemonte" >Piemonte</option>
> > <option value="Puglia" >Puglia</option>
> > <option value="Sardegna" >Sardegna</option>
> > <option value="Sicilia" >Sicilia</option>
> > <option value="Toscana" >Toscana</option>
> > <option value="Trentino" >Trentino</option>
> > <option value="Umbria" >Umbria</option>
> > <option value="ValleAosta" >Valle d'Aosta</option>
> > <option value="Veneto" >Veneto</option>
> > <option value="estero" >...all'estero</option>
> > </select><br />
> > <input name="check1" type="checkbox" value="1" />
> > <input name="check1" type="checkbox" value="1" />
> > <input name="check1" type="checkbox" value="1" />
> > <br />
> > <input type="Image" name="Invia" img
> > src="
> http://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/img/go.gif
> "
> > width="55" height="19">
> > </div>
> > </form>
> >
> > =====================================================================
> >
> > Best regards
> >
> > Marco Mirandola
> >
> >
> >
> ------------------------------------------------------------------------------
> > Live Security Virtual Conference
> > Exclusive live event will cover all the ways today's security and
> > threat landscape has changed and how IT managers can respond. Discussions
> > will include endpoint security, mobile security and the latest in malware
> > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> > _______________________________________________
> > sqlmap-users mailing list
> > sql...@li...
> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >
>
>
>
> --
> Focus on: Network security,Scanner,NodeJS,JAVA,WWW
> Blog: http://www.nohouse.net
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] tag FORM not supported

[Timon W. <tim...@gm...>]

So special...
Form method is get ,and enctype equals multipart/form-data. That's not
a valid form, you can't use this to upload file or submit data I
think.

On Thu, Aug 9, 2012 at 3:53 PM, Marco Mirandola <mm...@gm...> wrote:
> Hi Sqlmap team :-)
>
> This is the error:
>
> =====================================================================
> [09:40:35] [INFO] testing connection to the target url
> [09:40:36] [INFO] searching for forms
> [09:40:37] [CRITICAL] there has been a problem while processing page forms
> ('unk
> nown GET form encoding type 'multipart/form-data'')
> =====================================================================
>
> And this is the stub of html page
> =====================================================================
>
> <form name="choice" enctype="multipart/form-data" method="GET"
> action="/result.php" style="display:inline;">
> <select style="margin-bottom:10px;" name="categoria" id="categoria">
> <option value="">Tutti</option>
> <option selected="selected" >Coppie</option>
> <option value="a">a</option>
> <option  value="b">b</option>
> <option  value="c">c</option>
> <option  value="d">d</option>
> <option >e</option>
> <option >f</option>
> <option >g</option>
> <option >h</option>
> <option  value="i">i</option>
> </select>
> <br>
> <select name="regione" id="regione" style="margin-top:8px;
> margin-bottom:8px;">
> <option selected="selected"></option>
> <option></option>
> <option value="Abruzzo" >Abruzzo</option>
> <option value="Basilicata"  >Basilicata</option>
> <option value="Calabria" >Calabria</option>
> <option value="Campania" >Campania</option>
> <option value="Emilia Romagna" >Emilia Romagna</option>
> <option value="Friuli" >Friuli</option>
> <option value="Lazio">Lazio</option>
> <option value="Liguria" >Liguria</option>
> <option value="Lombardia" >Lombardia</option>
> <option value="Marche" >Marche</option>
> <option value="Molise" >Molise</option>
> <option value="Piemonte" >Piemonte</option>
> <option value="Puglia" >Puglia</option>
> <option value="Sardegna" >Sardegna</option>
> <option value="Sicilia" >Sicilia</option>
> <option value="Toscana" >Toscana</option>
> <option value="Trentino" >Trentino</option>
> <option value="Umbria" >Umbria</option>
> <option value="ValleAosta" >Valle d'Aosta</option>
> <option value="Veneto" >Veneto</option>
> <option value="estero" >...all'estero</option>
> </select><br />
> <input name="check1" type="checkbox" value="1" />
> <input name="check1" type="checkbox" value="1" />
> <input name="check1" type="checkbox" value="1" />
> <br />
> <input type="Image" name="Invia" img
> src="http://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/img/go.gif"
> width="55" height="19">
> </div>
> </form>
>
> =====================================================================
>
> Best regards
>
> Marco Mirandola
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Focus on: Network security,Scanner,NodeJS,JAVA,WWW
Blog: http://www.nohouse.net

[sqlmap-users] tag FORM not supported

[Marco M. <mm...@gm...>]

Hi Sqlmap team :-)

This is the error:

=====================================================================
[09:40:35] [INFO] testing connection to the target url
[09:40:36] [INFO] searching for forms
[09:40:37] [CRITICAL] there has been a problem while processing page forms
('unk
nown GET form encoding type 'multipart/form-data'')
=====================================================================

And this is the stub of html page
=====================================================================

<form name="choice" enctype="multipart/form-data" method="GET"
action="/result.php" style="display:inline;">
<select style="margin-bottom:10px;" name="categoria" id="categoria">
<option value="">Tutti</option>
<option selected="selected" >Coppie</option>
<option value="a">a</option>
<option  value="b">b</option>
<option  value="c">c</option>
<option  value="d">d</option>
<option >e</option>
<option >f</option>
<option >g</option>
<option >h</option>
<option  value="i">i</option>
</select>
<br>
<select name="regione" id="regione" style="margin-top:8px;
margin-bottom:8px;">
<option selected="selected"></option>
<option></option>
<option value="Abruzzo" >Abruzzo</option>
<option value="Basilicata"  >Basilicata</option>
<option value="Calabria" >Calabria</option>
<option value="Campania" >Campania</option>
<option value="Emilia Romagna" >Emilia Romagna</option>
<option value="Friuli" >Friuli</option>
<option value="Lazio">Lazio</option>
<option value="Liguria" >Liguria</option>
<option value="Lombardia" >Lombardia</option>
<option value="Marche" >Marche</option>
<option value="Molise" >Molise</option>
<option value="Piemonte" >Piemonte</option>
<option value="Puglia" >Puglia</option>
<option value="Sardegna" >Sardegna</option>
<option value="Sicilia" >Sicilia</option>
<option value="Toscana" >Toscana</option>
<option value="Trentino" >Trentino</option>
<option value="Umbria" >Umbria</option>
<option value="ValleAosta" >Valle d'Aosta</option>
<option value="Veneto" >Veneto</option>
<option value="estero" >...all'estero</option>
</select><br />
<input name="check1" type="checkbox" value="1" />
<input name="check1" type="checkbox" value="1" />
<input name="check1" type="checkbox" value="1" />
<br />
<input type="Image" name="Invia" img src="
http://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/img/go.gif"
width="55" height="19">
</div>
</form>

=====================================================================

Best regards

Marco Mirandola

Re: [sqlmap-users] ask error in sqlmap

[Brandon P. <bpe...@gm...>]

This isn't an error. It is telling you all params in the query are not
injectable.
On Aug 8, 2012 9:48 AM, "muhammad husaini harun" <hus...@ya...> wrote:

> hello i get error when scan using sqlmap
>
> [08:17:12] [CRITICAL] all parameters appear to be not injectable. Try to
> increase '--level'/'--risk' values to perform more tests. Also, you can try
> to rerun by providing a valid value for option '--regexp' as perhaps the
> regular expression that you have choosen does not match exclusively True
> responses
>
> [*] shutting down at 08:17:12
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] Disable output coloring

[Peter T. <pe...@ha...>]

Thanks Miroslav,

Feature / bug fix completed in under 4hours. Nice work!


On Tue, Aug 7, 2012 at 6:59 PM, Miroslav Stampar
<mir...@gm...> wrote:
> Hi.
>
> This should be fixed now [1]. sqlmap should handle this recognition of
> redirected output automatically from now on.
>
> Kind regards,
> Miroslav Stampar
>
> [1] https://github.com/sqlmapproject/sqlmap/issues/140
>
> On Tue, Aug 7, 2012 at 6:24 AM, Peter Thomas <pe...@ha...> wrote:
>>
>> I agree that it would be handy to have a way to disable the color output.
>>
>> We also output to text for sending in our automated email reports.
>>
>> The other alternative is to use sed.
>>
>> sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g"
>>
>>
>> --
>> Regards,
>>
>> Peter
>> --------------------------------------------------
>> Security Scanning Tools On-line
>> Web: http://hackertarget.com/
>> --------------------------------------------------
>>
>> > [sqlmap-users] Disable output coloring
>> > From: M Zverev <roberthacksley@gm...> - 2012-08-02 11:18
>> >
>> > I often redirect sqlmap output to a text file with the command >, and
>> > that leave annoying marks like
>> > [0m
>>  > [31m
>> > at the beginning and the end of lines, and I have to clean that out.
>> > Is there a way to disable output coloring?
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm



-- 
Regards,

Peter
--------------------------------------------------
Security Scanning Tools On-line
Web: http://hackertarget.com/
--------------------------------------------------

Re: [sqlmap-users] Disable output coloring

[Miroslav S. <mir...@gm...>]

Hi.

This should be fixed now [1]. sqlmap should handle this recognition of
redirected output automatically from now on.

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/issues/140

On Tue, Aug 7, 2012 at 6:24 AM, Peter Thomas <pe...@ha...> wrote:

> I agree that it would be handy to have a way to disable the color output.
>
> We also output to text for sending in our automated email reports.
>
> The other alternative is to use sed.
>
> sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g"
>
>
> --
> Regards,
>
> Peter
> --------------------------------------------------
> Security Scanning Tools On-line
> Web: http://hackertarget.com/
> --------------------------------------------------
>
> > [sqlmap-users] Disable output coloring
> > From: M Zverev <roberthacksley@gm...> - 2012-08-02 11:18
> >
> > I often redirect sqlmap output to a text file with the command >, and
> > that leave annoying marks like
> > [0m
>  > [31m
> > at the beginning and the end of lines, and I have to clean that out.
> > Is there a way to disable output coloring?
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Disable output coloring

[Peter T. <pe...@ha...>]

I agree that it would be handy to have a way to disable the color output.

We also output to text for sending in our automated email reports.

The other alternative is to use sed.

sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g"


-- 
Regards,

Peter
--------------------------------------------------
Security Scanning Tools On-line
Web: http://hackertarget.com/
--------------------------------------------------

> [sqlmap-users] Disable output coloring
> From: M Zverev <roberthacksley@gm...> - 2012-08-02 11:18
>
> I often redirect sqlmap output to a text file with the command >, and
> that leave annoying marks like 
> [0m
> [31m
> at the beginning and the end of lines, and I have to clean that out.
> Is there a way to disable output coloring?

Re: [sqlmap-users] MemoryError

[Miroslav S. <mir...@gm...>]

Hi.

This should be "patched" now [1], but nevertheless, it's interesting that
you are getting such large response immediately in such early phase. If you
don't mind you could send me more info privately.

Kind regards,
Miroslav Stampar

[1] https://github.com/sqlmapproject/sqlmap/issues/139

On Sun, Aug 5, 2012 at 12:06 PM, Happy User <rob...@gm...>wrote:

> [*] starting at 14:00:21
>
> [14:00:22] [INFO] testing connection to the target url
> [14:00:23] [INFO] testing if the url is stable, wait a few seconds
> [14:00:24] [INFO] url is stable
> [14:00:24] [INFO] testing if GET parameter 'block' is dynamic
> [14:00:25] [INFO] confirming that GET parameter 'block' is dynamic
> [14:00:27] [INFO] GET parameter 'block' is dynamic
> [14:00:36] [WARNING] large response detected. This could take a while
>
> [14:02:56] [CRITICAL] unhandled exception in sqlmap/1.0-dev-b483710,
> retry your run with the latest development version from the G
> itHub repository. If the exception persists, please send by e-mail to
> 'sql...@li...' or open a new issue at
> 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following
> text and any information required to reproduce the bug. Th
> e developers will try to reproduce the bug, fix it accordingly and get
> back to you.
> sqlmap version: 1.0-dev-b483710
> Python version: 2.7.3
> Operating system: nt
> Command line: D:\Soft\sqlmap-dev\sqlmap.py -u
> ************************************ --current-user --current-db
> --is-dba --tables -
> -dbs -c bulk
> Technique: None
> Back-end DBMS: None (identified)
> Traceback (most recent call last):
>    File "D:\Soft\sqlmap-dev\_sqlmap.py", line 72, in main
>      start()
>    File "D:\Soft\sqlmap-dev\lib\controller\controller.py", line 458, in
> start
>      check = heuristicCheckSqlInjection(place, parameter)
>    File "D:\Soft\sqlmap-dev\lib\controller\checks.py", line 627, in
> heuristicCheckSqlInjection
>      page, _ = Request.queryPage(payload, place, content=True,
> raise404=False)
>    File "D:\Soft\sqlmap-dev\lib\request\connect.py", line 732, in queryPage
>      page, headers, code = Connect.getPage(url=uri, get=get, post=post,
> cookie=cookie, ua=ua, referer=referer, host=host, silent=si
> lent, method=method, auxHeaders=auxHeaders, response=response,
> raise404=raise404, ignoreTimeout=timeBasedCompare)
>    File "D:\Soft\sqlmap-dev\lib\request\connect.py", line 498, in getPage
>      page = page if isinstance(page, unicode) else getUnicode(page)
>    File "D:\Soft\sqlmap-dev\lib\core\common.py", line 1861, in getUnicode
>      return unicode(value, UNICODE_ENCODING, "replace")
>    File "C:\Python27\lib\encodings\utf_8.py", line 16, in decode
>      return codecs.utf_8_decode(input, errors, True)
> MemoryError
>
> [*] shutting down at 14:02:56
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] sqlmap error

[Miroslav S. <mir...@gm...>]

Hi.

Metasploit's module sqlmap(.rb) is obsolete.

Kind regards,
Miroslav Stampar

On Fri, Aug 3, 2012 at 6:37 PM, D Atkin <je...@ho...> wrote:

>  hi
>
> im try to run sqlmap from msf but i keep getting this error
>
> the sqlmap script could not be found:
>
> iv already had sqlmap path to system Path envirounment put im still
> getting this error.
>
> can u tell me what i can do from here.
>
> Thank you!
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] MemoryError

[Happy U. <rob...@gm...>]

[*] starting at 14:00:21

[14:00:22] [INFO] testing connection to the target url
[14:00:23] [INFO] testing if the url is stable, wait a few seconds
[14:00:24] [INFO] url is stable
[14:00:24] [INFO] testing if GET parameter 'block' is dynamic
[14:00:25] [INFO] confirming that GET parameter 'block' is dynamic
[14:00:27] [INFO] GET parameter 'block' is dynamic
[14:00:36] [WARNING] large response detected. This could take a while

[14:02:56] [CRITICAL] unhandled exception in sqlmap/1.0-dev-b483710, 
retry your run with the latest development version from the G
itHub repository. If the exception persists, please send by e-mail to 
'sql...@li...' or open a new issue at
'https://github.com/sqlmapproject/sqlmap/issues/new' with the following 
text and any information required to reproduce the bug. Th
e developers will try to reproduce the bug, fix it accordingly and get 
back to you.
sqlmap version: 1.0-dev-b483710
Python version: 2.7.3
Operating system: nt
Command line: D:\Soft\sqlmap-dev\sqlmap.py -u 
************************************ --current-user --current-db 
--is-dba --tables -
-dbs -c bulk
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
   File "D:\Soft\sqlmap-dev\_sqlmap.py", line 72, in main
     start()
   File "D:\Soft\sqlmap-dev\lib\controller\controller.py", line 458, in 
start
     check = heuristicCheckSqlInjection(place, parameter)
   File "D:\Soft\sqlmap-dev\lib\controller\checks.py", line 627, in 
heuristicCheckSqlInjection
     page, _ = Request.queryPage(payload, place, content=True, 
raise404=False)
   File "D:\Soft\sqlmap-dev\lib\request\connect.py", line 732, in queryPage
     page, headers, code = Connect.getPage(url=uri, get=get, post=post, 
cookie=cookie, ua=ua, referer=referer, host=host, silent=si
lent, method=method, auxHeaders=auxHeaders, response=response, 
raise404=raise404, ignoreTimeout=timeBasedCompare)
   File "D:\Soft\sqlmap-dev\lib\request\connect.py", line 498, in getPage
     page = page if isinstance(page, unicode) else getUnicode(page)
   File "D:\Soft\sqlmap-dev\lib\core\common.py", line 1861, in getUnicode
     return unicode(value, UNICODE_ENCODING, "replace")
   File "C:\Python27\lib\encodings\utf_8.py", line 16, in decode
     return codecs.utf_8_decode(input, errors, True)
MemoryError

[*] shutting down at 14:02:56

[sqlmap-users] ask error in sqlmap

[muhammad h. h. <hus...@ya...>]

hello i get error when scan using sqlmap 

[08:17:12] [CRITICAL] all parameters appear to be not injectable. Try to increase '--level'/'--risk' values to perform more tests. Also, you can try to rerun by providing a valid value for option '--regexp' as perhaps the regular expression that you have choosen does not match exclusively True responses

[*] shutting down at 08:17:12