sqlmap-users — sqlmap users mailing list

[sqlmap-users] problems with union injections

[a n. g. <ae9...@to...>]

Hello,

I have some questions regarding union injections that google didn't
answer.
The scenario is the following:

MySQL 5.0 and error messages are shown
"SELECT col1 as val,col2 FROM dummtyable WHERE col3=".$id ." ORDER BY
col2 DESC LIMIT 1"

The outputs of the query are not shown.


Sqlmap detects a error-based vulnerability and the union injection
with two columns but it's unable to exploit the union injection. I
already tried --union-char several times, it's always the same result.
Is there a way to exploit it though there is no output of the query?


kind regards,
a nice guy

Re: [sqlmap-users] Configure Output Directory

[Miroslav S. <mir...@gm...>]

Hi Zaki.

This is implemented for some week(s) under option:
--output-dir=ODIR   Custom output directory path

Kind regards,
Miroslav Stampar

On Thu, Jun 7, 2012 at 10:38 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Zaki.
>
> We can put it on a TODO list (our option/switch list is getting huge :)
> and report back when implemented
>
> Kind regards
>
>
> On Thu, Jun 7, 2012 at 5:47 AM, Zaki Akhmad <zak...@gm...> wrote:
>
>> Danke, Miroslav! Can I issue a ticket for this feature?
>>
>> Regards,
>> --
>> Zaki Akhmad
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

https://github.com/sqlmapproject/sqlmap/issues/71

Kind regards,
Miroslav Stampar

On Thu, Jul 5, 2012 at 10:25 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Marco.
>
> We'll consider this one and maybe put it back on (we had it long time
> before).
>
> Kind regards,
> Miroslav Stampar
>
> On Tue, Jul 3, 2012 at 10:35 PM, Marco Mirandola <mm...@gm...>wrote:
>
>> Hello sqlMap I thought of an improvement, because when you retrieve the
>> databases (or tables or columns) does not enumerate the number of the item?
>>
>> ======================================
>> current sqlMap
>> ======================================
>>
>> [22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
>> web server operating system: Windows 2003
>> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
>> back-end DBMS: Microsoft SQL Server 2005
>> [22:15:39] [INFO] fetching columns for table 'myTable' in database
>> 'mystore'
>> [22:15:49] [WARNING] reflective value(s) found and filtering out
>> [22:15:49] [INFO] the SQL query used returns 253 entries
>> [22:16:00] [INFO] retrieved: citta
>> [22:16:07] [INFO] retrieved: varchar
>> [22:16:13] [INFO] retrieved: cognome
>> [22:16:22] [INFO] retrieved: nvarchar
>> ....
>>
>>
>> ======================================
>> my idea (modify in green)
>> ======================================
>>
>> [22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
>> web server operating system: Windows 2003
>> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
>> back-end DBMS: Microsoft SQL Server 2005
>> [22:15:39] [INFO] fetching columns for table 'myTable' in database
>> 'mystore'
>> [22:15:49] [WARNING] reflective value(s) found and filtering out
>> [22:15:49] [INFO] the SQL query used returns 253 entries
>> [22:16:00] [INFO] retrieved #1: citta
>> [22:16:07] [INFO] retrieved #2: varchar
>> [22:16:13] [INFO] retrieved #3: cognome
>> [22:16:22] [INFO] retrieved #4: nvarchar
>> ....
>>
>> lot a kiss
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] A thought about boolean based injection

[Miroslav S. <mir...@gm...>]

Hi.

We had that one but we removed it (actually I am the one that did it).
Please take a close look at
https://github.com/sqlmapproject/sqlmap/issues/70.

Kind regards,
Miroslav Stampar

On Sat, Jul 7, 2012 at 11:19 AM, <du...@al...> wrote:

> So, I came to think about this scenario, and I haven't been able to
> really get it to work with sqlmap.
>
> You have a page where, when injecting something like ?someparam=1' AND
> 1='1 gives you the "normal expected page" (like a news article or
> something).
> And ?someparam=1' AND 1='2 gives you the exact same page, but with an
> extra line of text saying something (like an error or a debug message
> for example).
>
> So, the first one would give
>
> "This is a news message"
>
> While the second, false statement, would give
>
> "[Debug, something went wrong, blabla etc]
> This is a news message"
>
>
> How would I go about getting sqlmap to recognize that as a regular
> boolean based injection?
> It can use a time based injection in this case, but I want it to see
> the other alternative as well, as I know it is there.
>
> Is this somehow possible?
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] A thought about boolean based injection

[<du...@al...>]

So, I came to think about this scenario, and I haven't been able to 
really get it to work with sqlmap.

You have a page where, when injecting something like ?someparam=1' AND 
1='1 gives you the "normal expected page" (like a news article or 
something).
And ?someparam=1' AND 1='2 gives you the exact same page, but with an 
extra line of text saying something (like an error or a debug message 
for example).

So, the first one would give

"This is a news message"

While the second, false statement, would give

"[Debug, something went wrong, blabla etc]
This is a news message"


How would I go about getting sqlmap to recognize that as a regular 
boolean based injection?
It can use a time based injection in this case, but I want it to see 
the other alternative as well, as I know it is there.

Is this somehow possible?

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

Hi Marco.

We'll consider this one and maybe put it back on (we had it long time
before).

Kind regards,
Miroslav Stampar

On Tue, Jul 3, 2012 at 10:35 PM, Marco Mirandola <mm...@gm...> wrote:

> Hello sqlMap I thought of an improvement, because when you retrieve the
> databases (or tables or columns) does not enumerate the number of the item?
>
> ======================================
> current sqlMap
> ======================================
>
> [22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2005
> [22:15:39] [INFO] fetching columns for table 'myTable' in database
> 'mystore'
> [22:15:49] [WARNING] reflective value(s) found and filtering out
> [22:15:49] [INFO] the SQL query used returns 253 entries
> [22:16:00] [INFO] retrieved: citta
> [22:16:07] [INFO] retrieved: varchar
> [22:16:13] [INFO] retrieved: cognome
> [22:16:22] [INFO] retrieved: nvarchar
> ....
>
>
> ======================================
> my idea (modify in green)
> ======================================
>
> [22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2005
> [22:15:39] [INFO] fetching columns for table 'myTable' in database
> 'mystore'
> [22:15:49] [WARNING] reflective value(s) found and filtering out
> [22:15:49] [INFO] the SQL query used returns 253 entries
> [22:16:00] [INFO] retrieved #1: citta
> [22:16:07] [INFO] retrieved #2: varchar
> [22:16:13] [INFO] retrieved #3: cognome
> [22:16:22] [INFO] retrieved #4: nvarchar
> ....
>
> lot a kiss
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] updating sqlmap is not working?

[Miroslav S. <mir...@gm...>]

Hi.

Please first read this:
http://article.gmane.org/gmane.comp.security.sqlmap/2247

You can see there that our SVN subversion server went down at the end of
previous month.

One big change also is that we don't use SVN any more for control
versioning but GIT. Please follow instructions from there to have it
working again.

"after running that command and changing into the sqlmap-dev directory i
noticed that there is no .svn file to update
sqlmap?" - there is no more .svn but .git now

"Also from the new sqlmap-dev directory i tried running the command "python
sqlmap.py --update" and it did not work as well?" - do you have "git"
installed? If you do (as I could tell from your mail) could you please tell
me what is the output of: "python sqlmap.py --update" this moment?

Kind regards,
Miroslav Stampar

On Wed, Jul 4, 2012 at 11:29 PM, anonymous <nig...@gm...> wrote:

> hello dev team and sqlmap mailing list,
>
> I just recently the other day tried to update sqlmap and i noticed that it
> just stopped working which is weird because it worked
> fine just a few days ago.
>
> Here is a copy of error I am getting when i try running the command "svn
> update" in the sqlmap directory".
>
> root@bt:/pentest/database/sqlmap# svn update
> svn: OPTIONS of 'https://svn.sqlmap.org/sqlmap/trunk/sqlmap': 200 OK (
> https://svn.sqlmap.org)
>
> as you can see i am using backtrack 5r2 with a current update version of
> sqlmap
>
> Here is a copy of an error when trying to use the command: "python
> sqlmap.py --update"
>
> [14:22:13] [INFO] updating sqlmap to latest development version from the
> subversion repository
> [14:22:16] [ERROR] unable to update sqlmap from subversion: 'OPTIONS of '
> https://svn.sqlmap.org/sqlmap/trunk/sqlmap': 200 OK (
> https://svn.sqlmap.org)'. You are strongly advised to checkout the clean
> copy from repository manually (e.g. "svn checkout
> https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev")
>
> [*] shutting down at 14:22:16
>
>
> Then when i tried getting a new version of sqlmap from "svn co" as
> recommend above that did not work as well.
>
> So after visiting the sqlmap.org website i see now that they are using
> git clone which i am not that familiar with...
>
> so i ran the command and downloaded sqlmap by running this command:
>
> git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
>
>
> after running that command and changing into the sqlmap-dev directory i noticed that there is no .svn file to update
> sqlmap?
>
> Also from the new sqlmap-dev directory i tried running the command "python sqlmap.py --update" and it did not work as well?
>
> I didn't see anything on the site about the subversion server being down? Are we no longer going to be able to update
> sqlmap or am i doing something wrong?
>
> I thank you all for your time and your help..
>
> -NightHawk
>
>
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] proxy usage capabilities

[Miroslav S. <mir...@gm...>]

Hi Henry.

If I understood you well you want to supply proxy list to sqlmap?

Kind regards,
Miroslav Stampar
On Jul 4, 2012 11:13 AM, "Henry Waves" <mic...@gm...> wrote:

> Thanks for all the great job that You've already done guys. The reason
> why i decided to compose this letter is that we all know that proxy
> server is a thing that will eventually 'die' with a very high
> probability and this fact leads us to fair logical conclusion - there
> should be proxy list usage implementation. Not that sqlmap lacks of
> stability to resume its' sessions, but such thing could help much.
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

Re: [sqlmap-users] (no subject)

[Iago S. <146...@gm...>]

If you know python you can modify and submit to github, then the developers
will analize.

On Tue, Jul 3, 2012 at 5:35 PM, Marco Mirandola <mm...@gm...> wrote:

> Hello sqlMap I thought of an improvement, because when you retrieve the
> databases (or tables or columns) does not enumerate the number of the item?
>
> ======================================
> current sqlMap
> ======================================
>
> [22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2005
> [22:15:39] [INFO] fetching columns for table 'myTable' in database
> 'mystore'
> [22:15:49] [WARNING] reflective value(s) found and filtering out
> [22:15:49] [INFO] the SQL query used returns 253 entries
> [22:16:00] [INFO] retrieved: citta
> [22:16:07] [INFO] retrieved: varchar
> [22:16:13] [INFO] retrieved: cognome
> [22:16:22] [INFO] retrieved: nvarchar
> ....
>
>
> ======================================
> my idea (modify in green)
> ======================================
>
> [22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2005
> [22:15:39] [INFO] fetching columns for table 'myTable' in database
> 'mystore'
> [22:15:49] [WARNING] reflective value(s) found and filtering out
> [22:15:49] [INFO] the SQL query used returns 253 entries
> [22:16:00] [INFO] retrieved #1: citta
> [22:16:07] [INFO] retrieved #2: varchar
> [22:16:13] [INFO] retrieved #3: cognome
> [22:16:22] [INFO] retrieved #4: nvarchar
> ....
>
> lot a kiss
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 

          Regards, Iago Sousa
  Webdesigner at Radar Topografia
Programmer and Security Researcher

[sqlmap-users] proxy usage capabilities

[Henry W. <mic...@gm...>]

Thanks for all the great job that You've already done guys. The reason 
why i decided to compose this letter is that we all know that proxy 
server is a thing that will eventually 'die' with a very high 
probability and this fact leads us to fair logical conclusion - there 
should be proxy list usage implementation. Not that sqlmap lacks of 
stability to resume its' sessions, but such thing could help much.

[sqlmap-users] (no subject)

[Marco M. <mm...@gm...>]

Hello sqlMap I thought of an improvement, because when you retrieve the
databases (or tables or columns) does not enumerate the number of the item?

======================================
current sqlMap
======================================

[22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
[22:15:39] [INFO] fetching columns for table 'myTable' in database 'mystore'
[22:15:49] [WARNING] reflective value(s) found and filtering out
[22:15:49] [INFO] the SQL query used returns 253 entries
[22:16:00] [INFO] retrieved: citta
[22:16:07] [INFO] retrieved: varchar
[22:16:13] [INFO] retrieved: cognome
[22:16:22] [INFO] retrieved: nvarchar
....


======================================
my idea (modify in green)
======================================

[22:15:39] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
[22:15:39] [INFO] fetching columns for table 'myTable' in database 'mystore'
[22:15:49] [WARNING] reflective value(s) found and filtering out
[22:15:49] [INFO] the SQL query used returns 253 entries
[22:16:00] [INFO] retrieved #1: citta
[22:16:07] [INFO] retrieved #2: varchar
[22:16:13] [INFO] retrieved #3: cognome
[22:16:22] [INFO] retrieved #4: nvarchar
....

lot a kiss

Re: [sqlmap-users] another bug....

[Miroslav S. <mir...@gm...>]

Hi Pedrito.

Thank you for your report. Apparently --page-rank was not working properly
for some time because Google changed some logic behind it.

With the latest commit (40fc648) everything should be up and running (no
more crashes).

Kind regards,
Miroslav Stampar

On Mon, Jul 2, 2012 at 11:36 PM, Pedrito Perez <0ar...@gm...> wrote:

>
>     sqlmap/1.0-dev - automatic SQL injection and database takeover tool
>     http://www.sqlmap.org
>
> [!] legal disclaimer: usage of sqlmap for attacking targets without prior
> mutual
>  consent is illegal. It is the end user's responsibility to obey all
> applicable
> local, state and federal laws. Authors assume no liability and are not
> responsib
> le for any misuse or damage caused by this program
>
> [*] starting at 16:35:06
>
> [16:35:06] [INFO] setting file for logging HTTP traffic
> [16:35:06] [INFO] first request to Google to get the session cookie
> [16:35:07] [INFO] using Google result page #1
> [16:35:16] [INFO] heuristics detected web page charset 'ISO-8859-2'
> do you want to scan only results containing GET parameters? [Y/n]
>
> [16:35:18] [INFO] sqlmap got 104 results for your Google dork expression,
> 28 of
> them are testable targets
> [16:35:18] [INFO] sqlmap got a total of 28 targets
>
> [16:35:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your
> run with
>  the latest development version from the Subversion repository. If the
> exception
>  persists, please send by e-mail to sql...@li...the follo
> wing text and any information required to reproduce the bug. The
> developers will
>  try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev
> Python version: 2.7.2
> Operating system: nt
> Command line: C:\Users\Andrea\Desktop\sqlmap\sqlmap.py -g ******
> main.php?id= -p
>  --random-agent -o --keep-alive --null-connection --threads=10
> --dbms=access --p
> refix= --suffix= --os= --dbs --parse-errors -t ./SQM/TRAFFIC/trafico.txt
> --beep
> --page-rank --smart
> Technique: None
> Back-end DBMS: Microsoft Access (identified)
> Traceback (most recent call last):
>   File "C:\Users\Andrea\Desktop\sqlmap\_sqlmap.py", line 81, in main
>     start()
>   File "C:\Users\Andrea\Desktop\sqlmap\lib\controller\controller.py", line
> 294,
> in start
>     message = "url %d:\n%s %s%s" % (hostCount, conf.method or
> HTTPMETHOD.GET, ta
> rgetUrl,  " (PageRank: %s)" % get_pagerank(targetUrl) if conf.googleDork
> and con
> f.pageRank else "")
> UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 784:
> ordina
> l not in range(128)
>
> [*] shutting down at 16:35:19
>
>
> C:\Users\Andrea\Desktop\sqlmap>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] ms sql database names' enum

[Miroslav S. <mir...@gm...>]

Hi Henry.

Find "SELECT DB_NAME(i++)" mechanism implemented with the latest commit
(27fdccc) as a fallback in case that standard one fails.

Kind regards,
Miroslav Stampar

On Tue, Jul 3, 2012 at 2:01 AM, Henry Waves <mic...@gm...> wrote:

> I've met dozens of practical cases when --dbs switch becomes useless
> with --dbms=mssql (can't say precisely, but maybe <2008 versions). The
> only workaround proved itself useful is retrieval of db_name(i++) using
> --sql-shell while other standart techniques were totally useless.
> Another reason i decided to compose this miserable letter is that i
> would like to see debug information on how page is being parsed in order
> to determine exact string or regexp or whatever sqlmap uses to pick up
> context output or to determine the boolean value for positive logical
> answer. Uploading specific files for mssql would be great too, because
> currently i choose another commercial products which are ugly, heavy,
> gui and windows only in order to execute os commands (that thing
> appeared to be broken in almost every semi-complicated case while worked
> fine on some fucking retarded pangolin\webcruiser\e.t.c. tools) or
> upload something over designed and accessible routines of ms sql in
> certain cases. Maybe i'm missing some concepts , but the first thing
> i've mentioned above deserves your attention for sure. Thanks :*
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] ERROR SQLMAPge

[diego s. <die...@ho...>]

Hi Bernado.
It's working well, you hear an error when I send to support.
Thank you very much.
> Date: Tue, 3 Jul 2012 10:53:05 +0100
> Subject: Re: [sqlmap-users] ERROR SQLMAPge
> From: ber...@gm...
> To: die...@ho...
> CC: sql...@li...; dav...@un...
> 
> Hi Diego,
> 
> Can you please rerun your command using sqlmap latest development
> version from Git[1]?
> If the bug persists, let us know.
> 
> [1] https://github.com/sqlmapproject/sqlmap
> 
> Cheers,
> Bernardo
> 
> 
> On 30 June 2012 07:20, diego system <die...@ho...> wrote:
> > Dear.
> >
> > I have a doubt time to do an audit the following error appeared and I do not
> > know how to solve it I need your help to clarify the error that happened
> > when I was studying and doing a test here in the company, which has prompted
> > me.
> >
> > I am forwarding you the error in TXT if possible send me a position as you.
> >
> > Thank you all and I look forward to.
> >
> > att,
> >
> >
> > Diego R. Pereira
> >
> > ------------------------------------------------------------------------------
> > Live Security Virtual Conference
> > Exclusive live event will cover all the ways today's security and
> > threat landscape has changed and how IT managers can respond. Discussions
> > will include endpoint security, mobile security and the latest in malware
> > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> > _______________________________________________
> > sqlmap-users mailing list
> > sql...@li...
> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >
> 
> 
> 
> -- 
> Bernardo Damele A. G.
> 
> E-mail / Jabber: bernardo.damele (at) gmail.com
> Mobile: +447788962949 (UK 07788962949)
 		 	   		  

Re: [sqlmap-users] ERROR SQLMAPge

[Bernardo D. A. G. <ber...@gm...>]

Hi Diego,

Can you please rerun your command using sqlmap latest development
version from Git[1]?
If the bug persists, let us know.

[1] https://github.com/sqlmapproject/sqlmap

Cheers,
Bernardo


On 30 June 2012 07:20, diego system <die...@ho...> wrote:
> Dear.
>
> I have a doubt time to do an audit the following error appeared and I do not
> know how to solve it I need your help to clarify the error that happened
> when I was studying and doing a test here in the company, which has prompted
> me.
>
> I am forwarding you the error in TXT if possible send me a position as you.
>
> Thank you all and I look forward to.
>
> att,
>
>
> Diego R. Pereira
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] ms sql database names' enum

[Bernardo D. A. G. <ber...@gm...>]

Hi Henry,

On 3 July 2012 01:01, Henry Waves <mic...@gm...> wrote:
> I've met dozens of practical cases when --dbs switch becomes useless
> with --dbms=mssql (can't say precisely, but maybe <2008 versions). The
> only workaround proved itself useful is retrieval of db_name(i++) using
> --sql-shell while other standart techniques were totally useless.

We have been notified already that there might be a bug with --dbs and
--tables on MSSQL (particularly version 2008). We will look closely in
the upcoming weeks into reproducing this bug, if any, across all MSSQL
versions. I have opened issue #55[1] for the time being and will keep
you posted there with comments.

> Another reason i decided to compose this miserable letter is that i
> would like to see debug information on how page is being parsed in order
> to determine exact string or regexp or whatever sqlmap uses to pick up
> context output or to determine the boolean value for positive logical
> answer.

If you run sqlmap with -v 3 not only you see all injected SQLi
payloads, but following detection, it shows you also the exact vector
used to identify the vulnerable and exploitable SQLi technique.

> Uploading specific files for mssql would be great too, because
> currently i choose another commercial products which are ugly, heavy,
> gui and windows only in order to execute os commands (that thing
> appeared to be broken in almost every semi-complicated case while worked
> fine on some fucking retarded pangolin\webcruiser\e.t.c. tools) or
> upload something over designed and accessible routines of ms sql in
> certain cases. Maybe i'm missing some concepts , but the first thing
> i've mentioned above deserves your attention for sure. Thanks :*

We have got support to interact with the underlying file system since
2009. Relevant switches are --file-read, --file-write and --file-dest.
--tmp-path might also be of use here, check the user's manual for
details and examples.
I am not aware at the moment of any bug related to these switches, but
please go ahead and open an issue[2] with details to reproduce the
bug, if any. I have recently retested all these switched across all
three supported DBMS (MSSQL, PgSQL and MySQL) and they all worked
fine.

[1] https://github.com/sqlmapproject/sqlmap/issues/55
[2] https://github.com/sqlmapproject/sqlmap/issues/new


-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] SQL Injection Pointer *

[Miroslav S. <mir...@gm...>]

Hi Ulisses.

It's on a TODO list along with custom header injections. We'll inform you
when it will be available. Until then cheers :)

Kind regards,
Miroslav Stampar

On Tue, Jul 3, 2012 at 6:42 AM, Ulisses Castro <uss...@gm...> wrote:

> Hello my friends,
>
> I'm looking for SQL injection pointer like in GET/POST with "*", but
> this time in Cookie, injection pointer works with Cookie injection??
>
> Thanks and keep the good work!
>
> Best wishes,
> Ulisses
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] SQL Injection Pointer *

[Ulisses C. <uss...@gm...>]

Hello my friends,

I'm looking for SQL injection pointer like in GET/POST with "*", but
this time in Cookie, injection pointer works with Cookie injection??

Thanks and keep the good work!

Best wishes,
Ulisses

[sqlmap-users] ms sql database names' enum

[Henry W. <mic...@gm...>]

I've met dozens of practical cases when --dbs switch becomes useless 
with --dbms=mssql (can't say precisely, but maybe <2008 versions). The 
only workaround proved itself useful is retrieval of db_name(i++) using 
--sql-shell while other standart techniques were totally useless. 
Another reason i decided to compose this miserable letter is that i 
would like to see debug information on how page is being parsed in order 
to determine exact string or regexp or whatever sqlmap uses to pick up 
context output or to determine the boolean value for positive logical 
answer. Uploading specific files for mssql would be great too, because 
currently i choose another commercial products which are ugly, heavy, 
gui and windows only in order to execute os commands (that thing 
appeared to be broken in almost every semi-complicated case while worked 
fine on some fucking retarded pangolin\webcruiser\e.t.c. tools) or 
upload something over designed and accessible routines of ms sql in 
certain cases. Maybe i'm missing some concepts , but the first thing 
i've mentioned above deserves your attention for sure. Thanks :*

Re: [sqlmap-users] MySQL Comment Injection Question

[Miroslav S. <mir...@gm...>]

Hi.

As Iago said, you'll need to play with tamper scripts.

I would recommend for that case of yours:
--tamper=versionedkeywords
or
--tamper=versionedmorekeywords
or
--tamper=halfversionedmorekeywords

Kind regards,
Miroslav Stampar

On Mon, Jul 2, 2012 at 11:29 PM, Iago Sousa <146...@gm...> wrote:

> Use --tamper=tamper/space2comment.py
>
>
> On Mon, Jul 2, 2012 at 6:02 PM, cats <du...@al...> wrote:
>
>> Hello there! :-)
>>
>> Just a quick question.
>> Does sqlmap currently handle injections like this?
>>
>> http://example.com?someparam=1/*!and 1=1*/
>>
>> That is, if there is a filter that prevents a more common injection like
>> someparam=1 AND 1=1 from working, then using this type of commenting
>> would execute it and sometimes bypass the filter.
>>
>> Reason I ask is because I was recently testing out a new web application
>> using sqlmap, and it didn't seem to detect this injection even though I
>> know it's there (The server doesn't respond if it detects an injection,
>> thus sqlmap keeps timing out).
>>
>> Thanks for any response in advance :-)
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Regards,
> Iago Sousa
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] another bug....

[Pedrito P. <0ar...@gm...>]

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://www.sqlmap.org

[!] legal disclaimer: usage of sqlmap for attacking targets without prior
mutual
 consent is illegal. It is the end user's responsibility to obey all
applicable
local, state and federal laws. Authors assume no liability and are not
responsib
le for any misuse or damage caused by this program

[*] starting at 16:35:06

[16:35:06] [INFO] setting file for logging HTTP traffic
[16:35:06] [INFO] first request to Google to get the session cookie
[16:35:07] [INFO] using Google result page #1
[16:35:16] [INFO] heuristics detected web page charset 'ISO-8859-2'
do you want to scan only results containing GET parameters? [Y/n]

[16:35:18] [INFO] sqlmap got 104 results for your Google dork expression,
28 of
them are testable targets
[16:35:18] [INFO] sqlmap got a total of 28 targets

[16:35:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run
with
 the latest development version from the Subversion repository. If the
exception
 persists, please send by e-mail to sql...@li... the
follo
wing text and any information required to reproduce the bug. The developers
will
 try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.2
Operating system: nt
Command line: C:\Users\Andrea\Desktop\sqlmap\sqlmap.py -g ******
main.php?id= -p
 --random-agent -o --keep-alive --null-connection --threads=10
--dbms=access --p
refix= --suffix= --os= --dbs --parse-errors -t ./SQM/TRAFFIC/trafico.txt
--beep
--page-rank --smart
Technique: None
Back-end DBMS: Microsoft Access (identified)
Traceback (most recent call last):
  File "C:\Users\Andrea\Desktop\sqlmap\_sqlmap.py", line 81, in main
    start()
  File "C:\Users\Andrea\Desktop\sqlmap\lib\controller\controller.py", line
294,
in start
    message = "url %d:\n%s %s%s" % (hostCount, conf.method or
HTTPMETHOD.GET, ta
rgetUrl,  " (PageRank: %s)" % get_pagerank(targetUrl) if conf.googleDork
and con
f.pageRank else "")
UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 784:
ordina
l not in range(128)

[*] shutting down at 16:35:19


C:\Users\Andrea\Desktop\sqlmap>

Re: [sqlmap-users] MySQL Comment Injection Question

[Iago S. <146...@gm...>]

Use --tamper=tamper/space2comment.py

On Mon, Jul 2, 2012 at 6:02 PM, cats <du...@al...> wrote:

> Hello there! :-)
>
> Just a quick question.
> Does sqlmap currently handle injections like this?
>
> http://example.com?someparam=1/*!and 1=1*/
>
> That is, if there is a filter that prevents a more common injection like
> someparam=1 AND 1=1 from working, then using this type of commenting
> would execute it and sometimes bypass the filter.
>
> Reason I ask is because I was recently testing out a new web application
> using sqlmap, and it didn't seem to detect this injection even though I
> know it's there (The server doesn't respond if it detects an injection,
> thus sqlmap keeps timing out).
>
> Thanks for any response in advance :-)
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Regards,
Iago Sousa

[sqlmap-users] MySQL Comment Injection Question

[cats <du...@al...>]

Hello there! :-)

Just a quick question.
Does sqlmap currently handle injections like this?

http://example.com?someparam=1/*!and 1=1*/

That is, if there is a filter that prevents a more common injection like
someparam=1 AND 1=1 from working, then using this type of commenting
would execute it and sometimes bypass the filter.

Reason I ask is because I was recently testing out a new web application
using sqlmap, and it didn't seem to detect this injection even though I
know it's there (The server doesn't respond if it detects an injection,
thus sqlmap keeps timing out).

Thanks for any response in advance :-)

Re: [sqlmap-users] bug

[Miroslav S. <mir...@gm...>]

Hi Ahmed.

Thank you for your report and find it fixed with the latest commit.

Kind regards,
MIroslav Stampar

On Sun, Jul 1, 2012 at 4:57 AM, Ahmed Shawky <ah...@is...> wrote:

> sqlmap version: 1.0-dev
> Python version: 2.7.2+
> Operating system: posix
> Command line: ./sqlmap.py -u ************************* --data
> username=&password=&priv=null&submit=Login+to+the+matrix -p priv
> --technique U --union-col 8 --dbms mysql --random-agent -v 3 --batch
> Technique: UNION
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "/home/lnxg33k/pentest/database/sqlmap/_sqlmap.py", line 79, in main
>     start()
>   File
> "/home/lnxg33k/pentest/database/sqlmap/lib/controller/controller.py", line
> 556, in start
>     __showInjections()
>   File
> "/home/lnxg33k/pentest/database/sqlmap/lib/controller/controller.py", line
> 150, in __showInjections
>     conf.dumper.technic(header, data)
>   File "/home/lnxg33k/pentest/database/sqlmap/lib/core/dump.py", line 111,
> in technic
>     self.string(header, data)
>   File "/home/lnxg33k/pentest/database/sqlmap/lib/core/dump.py", line 77,
> in string
>     data = self._formatString(getUnicode(data))
>   File "/home/lnxg33k/pentest/database/sqlmap/lib/core/dump.py", line 64,
> in _formatString
>     return restoreDumpMarkedChars(getUnicode(inpStr))
>   File "/home/lnxg33k/pentest/database/sqlmap/lib/core/common.py", line
> 840, in restoreDumpMarkedChars
>     retVal = retVal.replace(DUMP_NEWLINE_MARKER,
> "\n").replace(DUMP_CR_MARKER, "\r").replace(DUMP_TAB_MARKER, "\t")
> NameError: global name 'DUMP_NEWLINE_MARKER' is not defined
>
>
> --
> lnxg33k@lnxg33k(~/pentest/database/sqlmap(master)):$ git rev-parse
> --verify HEAD
> 21d9ae0a2c09e418b8430306cf134adfac46f4a5
>
> --
>
>    - Ahmed Shawky El-Antry
>    - lnxg33k owner "http://lnxg33k.wordpress.com"
>    - Isecur1ty team member"http://www.isecur1ty.org"
>    - Twitter @lnxg33k
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] bug

[Ahmed S. <ah...@is...>]

sqlmap version: 1.0-dev
Python version: 2.7.2+
Operating system: posix
Command line: ./sqlmap.py -u ************************* --data
username=&password=&priv=null&submit=Login+to+the+matrix -p priv
--technique U --union-col 8 --dbms mysql --random-agent -v 3 --batch
Technique: UNION
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "/home/lnxg33k/pentest/database/sqlmap/_sqlmap.py", line 79, in main
    start()
  File
"/home/lnxg33k/pentest/database/sqlmap/lib/controller/controller.py", line
556, in start
    __showInjections()
  File
"/home/lnxg33k/pentest/database/sqlmap/lib/controller/controller.py", line
150, in __showInjections
    conf.dumper.technic(header, data)
  File "/home/lnxg33k/pentest/database/sqlmap/lib/core/dump.py", line 111,
in technic
    self.string(header, data)
  File "/home/lnxg33k/pentest/database/sqlmap/lib/core/dump.py", line 77,
in string
    data = self._formatString(getUnicode(data))
  File "/home/lnxg33k/pentest/database/sqlmap/lib/core/dump.py", line 64,
in _formatString
    return restoreDumpMarkedChars(getUnicode(inpStr))
  File "/home/lnxg33k/pentest/database/sqlmap/lib/core/common.py", line
840, in restoreDumpMarkedChars
    retVal = retVal.replace(DUMP_NEWLINE_MARKER,
"\n").replace(DUMP_CR_MARKER, "\r").replace(DUMP_TAB_MARKER, "\t")
NameError: global name 'DUMP_NEWLINE_MARKER' is not defined


--
lnxg33k@lnxg33k(~/pentest/database/sqlmap(master)):$ git rev-parse --verify
HEAD
21d9ae0a2c09e418b8430306cf134adfac46f4a5

-- 

   - Ahmed Shawky El-Antry
   - lnxg33k owner "http://lnxg33k.wordpress.com"
   - Isecur1ty team member"http://www.isecur1ty.org"
   - Twitter @lnxg33k