sqlmap-users Mailing List for sqlmap (Page 60)

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Hi Miroslav / Bernardo,

Just come up against a host that refuses to talk SSL - TLS only :)

It would seem sqlmap does ssl only?

Thanks,
-Patrick

Hi nightman.

Thank you for your report and find it fixed with the latest commit (r5088).

Kind regards,
Miroslav Stampar

On Sun, May 27, 2012 at 11:27 PM, <nig...@em...> wrote:

> [23:19:47] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r5082), retry
> your run with the latest
> development version from the Subversion repository. If the exception
> persists, please send by e-mail
>  to sql...@li... the following text and any
> information required to reproduce
> the bug. The developers will try to reproduce the bug, fix it accordingly
> and get back to you.
> sqlmap version: 1.0-dev (r5082)
> Python version: 2.7.2
> Operating system: nt
> Command line: C:\map3\sqlmap.py -u
> **************************************************** --threads=6
> --random-agent --level 5 --risk 3 --technique=BEUS --dump -D ************
> -T *********** -C ********
> *************************
> Technique: ERROR
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "C:\map3\_sqlmap.py", line 82, in main
>     start()
>   File "C:\map3\lib\controller\controller.py", line 573, in start
>     action()
>   File "C:\map3\lib\controller\action.py", line 109, in action
>     conf.dbmsHandler.dumpTable()
>   File "C:\map3\plugins\generic\enumeration.py", line 1763, in dumpTable
>     attackDumpedTable()
>   File "C:\map3\lib\utils\hash.py", line 375, in attackDumpedTable
>     results = dictionaryAttack(attack_dict)
>   File "C:\map3\lib\utils\hash.py", line 833, in dictionaryAttack
>     fp.write("%s:%s\n" % (user, hash_))
> UnicodeEncodeError: 'ascii' codec can't encode characters in position
> 4-12: ordinal not in range(128
> )
>
> [*] shutting down at 23:19:47
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

-- 
Miroslav Stampar
http://about.me/stamparm

<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>[23:19:47] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r5082), retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail &nbsp;to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you. sqlmap version: 1.0-dev (r5082) Python version: 2.7.2 Operating system: nt Command line: C:\map3\sqlmap.py -u **************************************************** --threads=6 --random-agent --level 5 --risk 3 --technique=BEUS --dump -D ************ -T *********** -C ******** ************************* Technique: ERROR Back-end DBMS: MySQL (fingerprinted) Traceback (most recent call last): &nbsp; File &quot;C:\map3\_sqlmap.py&quot;, line 82, in main &nbsp;&nbsp;&nbsp; start() &nbsp; File &quot;C:\map3\lib\controller\controller.py&quot;, line 573, in start &nbsp;&nbsp;&nbsp; action() &nbsp; File &quot;C:\map3\lib\controller\action.py&quot;, line 109, in action &nbsp;&nbsp;&nbsp; conf.dbmsHandler.dumpTable() &nbsp; File &quot;C:\map3\plugins\generic\enumeration.py&quot;, line 1763, in dumpTable &nbsp;&nbsp;&nbsp; attackDumpedTable() &nbsp; File &quot;C:\map3\lib\utils\hash.py&quot;, line 375, in attackDumpedTable &nbsp;&nbsp;&nbsp; results = dictionaryAttack(attack_dict) &nbsp; File &quot;C:\map3\lib\utils\hash.py&quot;, line 833, in dictionaryAttack &nbsp;&nbsp;&nbsp; fp.write(&quot;%s:%s\n&quot; % (user, hash_)) UnicodeEncodeError: 'ascii' codec can't encode characters in position 4-12: ordinal not in range(128 ) [*] shutting down at 23:19:47 </div></div></body></html>

[15:43:26] [INFO] testing connection to the target url
[15:43:27] [WARNING] unknown web page charset 'utc8'. Please report by
e-mail to sql...@li....
[15:43:28] [INFO] heuristics detected web page charset 'ISO-8859-2'
[15:43:28] [INFO] testing NULL connection to the target url

Hi Anton.

ACK and put on TODO list.

Kind regards,
Miroslav Stampar

On Sun, May 27, 2012 at 8:19 PM, Anton Sazonov <ant...@gm...>wrote:

> Thanks for answering, Miroslav.
>
> I must haven't been clear enough in my previous post. What I mean is
> that, say, you got a website under your purview, an example.com.
> There's a vulnerable script at
> http://www.example.com/example.php?id=1&id2=2 and "id" is vulnerable.
>
> Say, there's another SQLi in http://www.example.com/exampe2.asp".
>
> Basically, every time I need to --dbs, --columns or whatever, I have
> to _type in exactly the same URL and parameters_ which are _already
> stored in the log file_. What I'm proposing to do is to add an option
> to specify a domain name and (optionally) select from a number of
> available attacks and go from there. Something like ./sqlmap.py -D
> example.com --dbs.
>
> Otherwise, we, the users, are forced to look up the logs in search of
> the vulnerable script and its settings.
>
> That'd just make things so much simpler for further attacks against
> the "victim" server.
>
> Thanks for your time and the work you put into this,
> Anton Sazonov
>
> On Sun, May 27, 2012 at 6:58 PM, Miroslav Stampar
> <mir...@gm...> wrote:
> > Hi Anton.
> >
> > Maybe I am missing something:
> > "I must be missing something, but shouldn't there be a command line
> > switch to perform the exact same SQLi you did on your target machine"
> >
> > If you are referring to a normal session resumal then it's automatically
> > being done. If you mean that you want to use information of SQLi from one
> > target to another then there is no such option.
> >
> > If you need that first scenario then please tell which version do you
> use?
> >
> > Kind regards,
> > Miroslav Stampar
> >
> > On Sat, May 26, 2012 at 1:32 AM, Anton Sazonov <ant...@gm...>
> > wrote:
> >>
> >> Hello there,
> >>
> >> I must be missing something, but shouldn't there be a command line
> >> switch to perform the exact same SQLi you did on your target machine?
> >> I do realize that the vulnerabilities are stored in
> >> $SQLMAP/output/$HOSTNAME/log and are rather easy to replicate, if
> >> frustrating.
> >>
> >> Wouldn't that be easier for the end-users to just add an option to
> >> specify the already injected and confirmed server in the command line,
> >> as in, for example, ./sqlmap.py -h example.com --dbs?
> >>
> >> Couldn't find it in the documentation for the life of me. Apologies if
> >> it has already been brought up.
> >>
> >> Thanks,
> >> Anton
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Live Security Virtual Conference
> >> Exclusive live event will cover all the ways today's security and
> >> threat landscape has changed and how IT managers can respond.
> Discussions
> >> will include endpoint security, mobile security and the latest in
> malware
> >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> >> _______________________________________________
> >> sqlmap-users mailing list
> >> sql...@li...
> >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >
> >
> >
> >
> > --
> > Miroslav Stampar
> > http://about.me/stamparm
>

-- 
Miroslav Stampar
http://about.me/stamparm

Thanks for answering, Miroslav.

I must haven't been clear enough in my previous post. What I mean is
that, say, you got a website under your purview, an example.com.
There's a vulnerable script at
http://www.example.com/example.php?id=1&id2=2 and "id" is vulnerable.

Say, there's another SQLi in http://www.example.com/exampe2.asp".

Basically, every time I need to --dbs, --columns or whatever, I have
to _type in exactly the same URL and parameters_ which are _already
stored in the log file_. What I'm proposing to do is to add an option
to specify a domain name and (optionally) select from a number of
available attacks and go from there. Something like ./sqlmap.py -D
example.com --dbs.

Otherwise, we, the users, are forced to look up the logs in search of
the vulnerable script and its settings.

That'd just make things so much simpler for further attacks against
the "victim" server.

Thanks for your time and the work you put into this,
Anton Sazonov

On Sun, May 27, 2012 at 6:58 PM, Miroslav Stampar
<mir...@gm...> wrote:
> Hi Anton.
>
> Maybe I am missing something:
> "I must be missing something, but shouldn't there be a command line
> switch to perform the exact same SQLi you did on your target machine"
>
> If you are referring to a normal session resumal then it's automatically
> being done. If you mean that you want to use information of SQLi from one
> target to another then there is no such option.
>
> If you need that first scenario then please tell which version do you use?
>
> Kind regards,
> Miroslav Stampar
>
> On Sat, May 26, 2012 at 1:32 AM, Anton Sazonov <ant...@gm...>
> wrote:
>>
>> Hello there,
>>
>> I must be missing something, but shouldn't there be a command line
>> switch to perform the exact same SQLi you did on your target machine?
>> I do realize that the vulnerabilities are stored in
>> $SQLMAP/output/$HOSTNAME/log and are rather easy to replicate, if
>> frustrating.
>>
>> Wouldn't that be easier for the end-users to just add an option to
>> specify the already injected and confirmed server in the command line,
>> as in, for example, ./sqlmap.py -h example.com --dbs?
>>
>> Couldn't find it in the documentation for the life of me. Apologies if
>> it has already been brought up.
>>
>> Thanks,
>> Anton
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm

Hi Anton.

Maybe I am missing something:
"I must be missing something, but shouldn't there be a command line
switch to perform the exact same SQLi you did on your target machine"

If you are referring to a normal session resumal then it's automatically
being done. If you mean that you want to use information of SQLi from one
target to another then there is no such option.

If you need that first scenario then please tell which version do you use?

Kind regards,
Miroslav Stampar

On Sat, May 26, 2012 at 1:32 AM, Anton Sazonov <ant...@gm...>wrote:

> Hello there,
>
> I must be missing something, but shouldn't there be a command line
> switch to perform the exact same SQLi you did on your target machine?
> I do realize that the vulnerabilities are stored in
> $SQLMAP/output/$HOSTNAME/log and are rather easy to replicate, if
> frustrating.
>
> Wouldn't that be easier for the end-users to just add an option to
> specify the already injected and confirmed server in the command line,
> as in, for example, ./sqlmap.py -h example.com --dbs?
>
> Couldn't find it in the documentation for the life of me. Apologies if
> it has already been brought up.
>
> Thanks,
> Anton
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

-- 
Miroslav Stampar
http://about.me/stamparm

Hi Bob.

Yes, sqlmap works with MsSQL 2008.

Could you please post traffic file for that run (-t traffic.txt
--current-user --fresh-queries)?

Also, if you could send url that could be good too.

Kind regards

On Sat, May 26, 2012 at 4:38 AM, Bob <sto...@qq...> wrote:

> I meet the problem with sqlmap working with sql server 2008 .  the details
> if below . sometimes can retrieval db,and user ,but sometimes is show below
> .
>
> Place: GET
> Parameter: nclassid
>     Type: boolean-based blind
>     Title: OR boolean-based blind - WHERE or HAVING clause
>     Payload: classid=4&nclassid=-2854 OR (2950=2950)
> ---
>
> [10:31:11] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2008
> [10:31:11] [INFO] fetching current user
> [10:31:12] [WARNING] running in a single-thread mode. Please consider
> usage of option '--threads' for faster data retrieval
> sqlmap got a 302 redirect to 'http://www.xxxxx:80/index.asp'. Do you want
> to follow? [Y/n] n
>
> [10:33:03] [INFO] heuristics detected web page charset 'ascii'
>
> current user:    None
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

-- 
Miroslav Stampar
http://about.me/stamparm

Hi Bob.

Yes, sqlmap works with MsSQL 2008.

Could you please post traffic file for that run (-t traffic.txt
--current-user --fresh-queries)?

Also, if you could send url that could be good too.

Kind regards

On Sat, May 26, 2012 at 4:38 AM, Bob <sto...@qq...> wrote:

> I meet the problem with sqlmap working with sql server 2008 .  the details
> if below . sometimes can retrieval db,and user ,but sometimes is show below
> .
>
> Place: GET
> Parameter: nclassid
>     Type: boolean-based blind
>     Title: OR boolean-based blind - WHERE or HAVING clause
>     Payload: classid=4&nclassid=-2854 OR (2950=2950)
> ---
>
> [10:31:11] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2008
> [10:31:11] [INFO] fetching current user
> [10:31:12] [WARNING] running in a single-thread mode. Please consider
> usage of option '--threads' for faster data retrieval
> sqlmap got a 302 redirect to 'http://www.xxxxx:80/index.asp'. Do you want
> to follow? [Y/n] n
>
> [10:33:03] [INFO] heuristics detected web page charset 'ascii'
>
> current user:    None
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

-- 
Miroslav Stampar
http://about.me/stamparm

I meet the problem with sqlmap working with sql server 2008 .  the details if below . sometimes can retrieval db,and user ,but sometimes is show below .

Place: GET
Parameter: nclassid
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: classid=4&nclassid=-2854 OR (2950=2950)
---

[10:31:11] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2008
[10:31:11] [INFO] fetching current user
[10:31:12] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
sqlmap got a 302 redirect to 'http://www.xxxxx:80/index.asp'. Do you want to follow? [Y/n] n

[10:33:03] [INFO] heuristics detected web page charset 'ascii'

current user:    None
Hello there,

I must be missing something, but shouldn't there be a command line
switch to perform the exact same SQLi you did on your target machine?
I do realize that the vulnerabilities are stored in
$SQLMAP/output/$HOSTNAME/log and are rather easy to replicate, if
frustrating.

Wouldn't that be easier for the end-users to just add an option to
specify the already injected and confirmed server in the command line,
as in, for example, ./sqlmap.py -h example.com --dbs?

Couldn't find it in the documentation for the life of me. Apologies if
it has already been brought up.

Thanks,
Anton

Hello All,

Is it possible to make injection in Basic Auth information ?
I am  in this situation :
On the Basic Auth login if i put :
x' AND 1=(SELECT COUNT(*) FROM users); --

I have as reply :

*You have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near '--' AND pass =
'test'' at line 1*

On the Basic Auth Pass if i put  the same :
x' AND 1=(SELECT COUNT(*) FROM users); --

I have as reply :

*You have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near '--'' at line 1*

As I am kind of bad in SQL Query, I try to automate with SQLMap with this
command :
./sqlmap.py -u http://test.com/folder/file.php --auth-type=Basic
--auth-cred=*:admin --level=5 --risk=3  --user-agent="Mozilla/4.0
(compatible; MSIE 7.0; Windows NT 5.1)"

It stop on : not authorized, try to provide right HTTP authentication type
and valid credentials (401)
Is there a way to make it anyway ?

Regards

DNC

Miroslav, great! Makes me and my customer happy!

Thomas

Von: Miroslav Stampar [mailto:mir...@gm...] 
Gesendet: Freitag, 25. Mai 2012 01:12
An: Thomas Schreiber
Cc: sql...@li...
Betreff: Re: [sqlmap-users] Not url-encoding POST-data possible?

Hi Thomas.

With the latest r5076 you'll get a new switch '--skip-urlencode' which tells
sqlmap to skip URL encoding of POST data.

Kind regards,

Miroslav Stampar

On Thu, May 24, 2012 at 11:56 AM, Miroslav Stampar
<mir...@gm...> wrote:

Hi.

There is no such option, but something will be done (e.g. --skip-urlencode).
Will keep you updated.

Kind regards

On May 23, 2012 9:56 PM, "Thomas Schreiber" <ts...@go...> wrote:

Hi,

can I tell sqlmap to not url-encode POST-data?

In my case a php webservice complains about not getting a '<' as first
character:

Warning: simplexml_load_string(): Entity: line 1: parser error : Start
tag expected, '<' not found in...
 Warning: simplexml_load_string(): %3Crequest...

The reason is, that sqlmap sends the payload url-encoded:

  %3CRequest%3E%3CID%3E111*%3C/ID>%3C%2FRequest%3E

Trying the same request in burp without urlencoding like this:

  <Request><ID>111*</ID></Request>

does not produce the error

Thanks!

Thomas

----------------------------------------------------------------------------
--
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
sqlmap-users mailing list
sql...@li...
https://lists.sourceforge.net/lists/listinfo/sqlmap-users

-- 
Miroslav Stampar
http://about.me/stamparm

Hi Devon

With the latest commit (r5077) you won't be asked any more for that "you've
probably...tainted..." in "multiple target mode".

That simply means that check will be only conducted if user has explicitly
used -u parameter and not in those more advanced modes (-g, -m,...)

Kind regards,
Miroslav Stampar

On Thu, May 24, 2012 at 5:22 PM, Devon <dev...@ao...> wrote:

> Hello,
>
> I encountered a situation where --batch ended up prematurely ending a scan
> of a website.  The reason is because there was an invalid link on the
> site's HTML document, that confused sqlmap into exiting.  Here's the output
> which I think should explain it better:
>
> root@apj351:~# ./sqlmap.py --random-agent --threads=5 -u '
> http://XXXXXXXXXXXXXXXXXX/' --crawl=5 --batch
>
>     sqlmap/1.0-dev (r5058) - automatic SQL injection and database takeover
> tool
>     http://www.sqlmap.org
>
> [!] legal disclaimer: usage of sqlmap for attacking targets without prior
> mutual consent is illegal. It is the end user's responsibility to obey all
> applicable local, state and federal laws. Authors assume no liability and
> are not responsible for any misuse or damage caused by this program
>
> [*] starting at 08:06:59
>
> [08:06:59] [INFO] fetched random HTTP User-Agent header from file
> '/opt/sqlmap/txt/user-agents.txt': Opera/9.80 (X11; Linux x86_64; U; en-GB)
> Presto/2.2.15 Version/10.01
> [08:06:59] [INFO] starting crawler
> [08:06:59] [INFO] searching for links with depth 1
> [08:07:00] [INFO] heuristics detected web page charset 'ascii'
> [08:07:00] [INFO] searching for links with depth 2
> [08:07:00] [INFO] starting 5 threads
> [08:07:02] [INFO] 3/57 links visited (5%)
> [08:07:02] [INFO] heuristics detected web page charset 'utf-8'
> [08:07:12] [INFO] 28/57 links visited (49%)
> [08:07:12] [INFO] heuristics detected web page charset 'ISO-8859-2'
> [08:07:22] [INFO] searching for links with depth 3
> [08:07:22] [INFO] starting 5 threads
> [08:07:47] [INFO] searching for links with depth 4
> [08:07:47] [INFO] starting 5 threads
> [08:08:14] [INFO] searching for links with depth 5
> [08:08:14] [INFO] starting 5 threads
> [08:08:41] [INFO] sqlmap got a total of 20 targets
> [08:08:41] [INFO] url 1:
> GET http:/XXXXXXXXXXXXXXXXXX/YYYYYYYYYYY.aspx?selected=03. Something
> somsething something (Yadda yadda)
> do you want to test this url? [Y/n/q]
> > Y
> [08:08:41] [INFO] testing url
> http:/XXXXXXXXXXXXXXXXXX/YYYYYYYYYYY.aspx?selected=03. Something somsething
> something (Yadda yadda)
> [08:08:41] [WARNING] it appears that you have provided tainted parameter
> values ('selected=03. Something somsething something (Yadda yadda)') with
> most probably leftover chars from manual sql injection tests (;()') or
> non-valid numerical value. Please, always use only valid parameter values
> so sqlmap could be able to properly run
> [08:08:41] [INFO] Are you sure you want to continue? [y/N] N
>
> [*] shutting down at 08:08:41
>
>
> I think in addition to --batch, it would be useful to have something like
> --yes which just assumes "yes" for any prompt that comes up.  It is just an
> idea, but I thought it might be useful since --batch is most often used in
> non-interactive scripts where the user might not catch what happened.
>
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

-- 
Miroslav Stampar
http://about.me/stamparm

That feature comes in handy for me as well. Great work guys, as always!

Cheers,
Dennis

Am 25.05.2012 01:47, schrieb Miroslav Stampar:
> ;)
>
> On Fri, May 25, 2012 at 1:34 AM, André Silva <and...@gm...
> <mailto:and...@gm...>> wrote:
>
>     Bernado / Miroslav,
>
>     The SqlMap is indeed an amazing open source sotware.
>
>     Bug fixes, implementation of new features....
>
>     Thanks guys
>
>
>
>
> -- 
> Miroslav Stampar
> http://about.me/stamparm
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>
>
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users

;)

On Fri, May 25, 2012 at 1:34 AM, André Silva <and...@gm...> wrote:

> Bernado / Miroslav,
>
> The SqlMap is indeed an amazing open source sotware.
>
> Bug fixes, implementation of new features....
>
> Thanks guys
>

-- 
Miroslav Stampar
http://about.me/stamparm

Bernado / Miroslav,

The SqlMap is indeed an amazing open source sotware.

Bug fixes, implementation of new features....

Thanks guys

Hi Thomas.

With the latest r5076 you'll get a new switch '--skip-urlencode' which
tells sqlmap to skip URL encoding of POST data.

Kind regards,
Miroslav Stampar

On Thu, May 24, 2012 at 11:56 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi.
>
> There is no such option, but something will be done (e.g.
> --skip-urlencode). Will keep you updated.
>
> Kind regards
> On May 23, 2012 9:56 PM, "Thomas Schreiber" <ts...@go...> wrote:
>
>> Hi,
>>
>> can I tell sqlmap to not url-encode POST-data?
>>
>> In my case a php webservice complains about not getting a '<' as first
>> character:
>>
>>   Warning: simplexml_load_string(): Entity: line 1: parser error : Start
>> tag expected, '<' not found in...
>>   Warning: simplexml_load_string(): %3Crequest...
>>
>> The reason is, that sqlmap sends the payload url-encoded:
>>
>>   %3CRequest%3E%3CID%3E111*%3C/ID>%3C%2FRequest%3E
>>
>> Trying the same request in burp without urlencoding like this:
>>
>>   <Request><ID>111*</ID></Request>
>>
>> does not produce the error
>>
>> Thanks!
>>
>> Thomas
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>

-- 
Miroslav Stampar
http://about.me/stamparm

Hi.

IPv6 support is now up and running with the latest r5075.

Kind regards,
Miroslav Stampar

On Thu, May 24, 2012 at 12:00 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi.
>
> To be honest, we haven't tried usage of IPv6 addresses, but you are the
> messenger that we should start :)
>
> We'll see what can be done and keep you posted.
>
> Kind regards,
> Miroslav Stampar
> On May 23, 2012 8:15 PM, "rmillet" <rmi...@us...>
> wrote:
>
>> Hi all,
>>
>> sqlmap hangs when using with an IPv6 address:
>>  ./sqlmap.py -u 'http://[::1]/?p=42'
>>
>>
>> Here is the traceback displayed on keyboard interrupt:
>>
>> Traceback (most recent call last):
>>   File "./sqlmap.py", line 19, in <module>
>>     main()
>>   File "/sqlmap/_sqlmap.py", line 110, in main
>>     errMsg = unhandledExceptionMessage()
>>   File "/sqlmap/lib/core/common.py", line 2557, in
>> unhandledExceptionMessage
>>     return maskSensitiveData(errMsg)
>>   File "/sqlmap/lib/core/common.py", line 2568, in maskSensitiveData
>>     while extractRegexResult(regex, retVal):
>>   File "/sqlmap/lib/core/common.py", line 2159, in extractRegexResult
>>     retVal = match.group("result")
>> KeyboardInterrupt
>>
>>
>>
>> Regards,
>>
>> rmillet42
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Live Security Virtual Conference
>> Exclusive live event will cover all the ways today's security and
>> threat landscape has changed and how IT managers can respond. Discussions
>> will include endpoint security, mobile security and the latest in malware
>> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>

-- 
Miroslav Stampar
http://about.me/stamparm

Hi nightman.

Thank you again and find it fixed with the latest commit

Kind regards

On Thu, May 24, 2012 at 1:07 PM, <nig...@em...> wrote:

> [12:53:20] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r5067), retry
> your run with the latest
> development version from the Subversion repository. If the exception
> persists, please send by e-mail
>  to sql...@li... the following text and any
> information required to reproduce
> the bug. The developers will try to reproduce the bug, fix it accordingly
> and get back to you.
> sqlmap version: 1.0-dev (r5067)
> Python version: 2.7.2
> Operating system: nt
> Command line: C:\map2\sqlmap.py -u
> ************************************************* --threads=6 --r
> andom-agent --level 5 --risk 3 --technique=BEUS --file-read=/etc/passwd
> Technique: BOOLEAN
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "C:\map2\_sqlmap.py", line 82, in main
>     start()
>   File "C:\map2\lib\controller\controller.py", line 573, in start
>     action()
>   File "C:\map2\lib\controller\action.py", line 129, in action
>     conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
>   File "C:\map2\plugins\generic\filesystem.py", line 201, in readFile
>     fileContent = self.stackedReadFile(rFile)
>   File "C:\map2\plugins\dbms\mysql\filesystem.py", line 62, in
> stackedReadFile
>     if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
> NameError: global name 'PAYLOAD' is not defined
>
> [*] shutting down at 12:53:20
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

-- 
Miroslav Stampar
http://about.me/stamparm

Hello,

I encountered a situation where --batch ended up prematurely ending a scan of a website.  The reason is because there was an invalid link on the site's HTML document, that confused sqlmap into exiting.  Here's the output which I think should explain it better:

root@apj351:~# ./sqlmap.py --random-agent --threads=5 -u 'http://XXXXXXXXXXXXXXXXXX/' --crawl=5 --batch

    sqlmap/1.0-dev (r5058) - automatic SQL injection and database takeover tool
    http://www.sqlmap.org

[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 08:06:59

[08:06:59] [INFO] fetched random HTTP User-Agent header from file '/opt/sqlmap/txt/user-agents.txt': Opera/9.80 (X11; Linux x86_64; U; en-GB) Presto/2.2.15 Version/10.01
[08:06:59] [INFO] starting crawler
[08:06:59] [INFO] searching for links with depth 1
[08:07:00] [INFO] heuristics detected web page charset 'ascii'
[08:07:00] [INFO] searching for links with depth 2
[08:07:00] [INFO] starting 5 threads
[08:07:02] [INFO] 3/57 links visited (5%)
[08:07:02] [INFO] heuristics detected web page charset 'utf-8'
[08:07:12] [INFO] 28/57 links visited (49%)
[08:07:12] [INFO] heuristics detected web page charset 'ISO-8859-2'
[08:07:22] [INFO] searching for links with depth 3
[08:07:22] [INFO] starting 5 threads
[08:07:47] [INFO] searching for links with depth 4
[08:07:47] [INFO] starting 5 threads
[08:08:14] [INFO] searching for links with depth 5
[08:08:14] [INFO] starting 5 threads
[08:08:41] [INFO] sqlmap got a total of 20 targets
[08:08:41] [INFO] url 1:
GET http:/XXXXXXXXXXXXXXXXXX/YYYYYYYYYYY.aspx?selected=03. Something somsething something (Yadda yadda)
do you want to test this url? [Y/n/q]
> Y
[08:08:41] [INFO] testing url http:/XXXXXXXXXXXXXXXXXX/YYYYYYYYYYY.aspx?selected=03. Something somsething something (Yadda yadda)
[08:08:41] [WARNING] it appears that you have provided tainted parameter values ('selected=03. Something somsething something (Yadda yadda)') with most probably leftover chars from manual sql injection tests (;()') or non-valid numerical value. Please, always use only valid parameter values so sqlmap could be able to properly run
[08:08:41] [INFO] Are you sure you want to continue? [y/N] N

[*] shutting down at 08:08:41

I think in addition to --batch, it would be useful to have something like --yes which just assumes "yes" for any prompt that comes up.  It is just an idea, but I thought it might be useful since --batch is most often used in non-interactive scripts where the user might not catch what happened.

<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>[12:53:20] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r5067), retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail &nbsp;to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you. sqlmap version: 1.0-dev (r5067) Python version: 2.7.2 Operating system: nt Command line: C:\map2\sqlmap.py -u ************************************************* --threads=6 --r andom-agent --level 5 --risk 3 --technique=BEUS --file-read=/etc/passwd Technique: BOOLEAN Back-end DBMS: MySQL (fingerprinted) Traceback (most recent call last): &nbsp; File &quot;C:\map2\_sqlmap.py&quot;, line 82, in main &nbsp;&nbsp;&nbsp; start() &nbsp; File &quot;C:\map2\lib\controller\controller.py&quot;, line 573, in start &nbsp;&nbsp;&nbsp; action() &nbsp; File &quot;C:\map2\lib\controller\action.py&quot;, line 129, in action &nbsp;&nbsp;&nbsp; conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile)) &nbsp; File &quot;C:\map2\plugins\generic\filesystem.py&quot;, line 201, in readFile &nbsp;&nbsp;&nbsp; fileContent = self.stackedReadFile(rFile) &nbsp; File &quot;C:\map2\plugins\dbms\mysql\filesystem.py&quot;, line 62, in stackedReadFile &nbsp;&nbsp;&nbsp; if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): NameError: global name 'PAYLOAD' is not defined [*] shutting down at 12:53:20 </div></div></body></html>

Hi.

To be honest, we haven't tried usage of IPv6 addresses, but you are the
messenger that we should start :)

We'll see what can be done and keep you posted.

Kind regards,
Miroslav Stampar
On May 23, 2012 8:15 PM, "rmillet" <rmi...@us...> wrote:

> Hi all,
>
> sqlmap hangs when using with an IPv6 address:
>  ./sqlmap.py -u 'http://[::1]/?p=42'
>
>
> Here is the traceback displayed on keyboard interrupt:
>
> Traceback (most recent call last):
>   File "./sqlmap.py", line 19, in <module>
>     main()
>   File "/sqlmap/_sqlmap.py", line 110, in main
>     errMsg = unhandledExceptionMessage()
>   File "/sqlmap/lib/core/common.py", line 2557, in
> unhandledExceptionMessage
>     return maskSensitiveData(errMsg)
>   File "/sqlmap/lib/core/common.py", line 2568, in maskSensitiveData
>     while extractRegexResult(regex, retVal):
>   File "/sqlmap/lib/core/common.py", line 2159, in extractRegexResult
>     retVal = match.group("result")
> KeyboardInterrupt
>
>
>
> Regards,
>
> rmillet42
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Hi.

There is no such option, but something will be done (e.g.
--skip-urlencode). Will keep you updated.

Kind regards
On May 23, 2012 9:56 PM, "Thomas Schreiber" <ts...@go...> wrote:

> Hi,
>
> can I tell sqlmap to not url-encode POST-data?
>
> In my case a php webservice complains about not getting a '<' as first
> character:
>
>   Warning: simplexml_load_string(): Entity: line 1: parser error : Start
> tag expected, '<' not found in...
>   Warning: simplexml_load_string(): %3Crequest...
>
> The reason is, that sqlmap sends the payload url-encoded:
>
>   %3CRequest%3E%3CID%3E111*%3C/ID>%3C%2FRequest%3E
>
> Trying the same request in burp without urlencoding like this:
>
>   <Request><ID>111*</ID></Request>
>
> does not produce the error
>
> Thanks!
>
> Thomas
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

Hi,