sqlmap-users — sqlmap users mailing list

[sqlmap-users] Running sqlmap on Windows platform

[Miroslav S. <mir...@gm...>]

(This is a post just to have it officially somewhere)

In order to run sqlmap under Windows you should do several things:

0) download and unzip sqlmap (latest stable version is located at
http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.zip) to local directory
1) download Python v2.7 for your platform and install it (32-bit version
http://www.python.org/ftp/python/2.7.2/python-2.7.2.msi or 64-bit version
http://www.python.org/ftp/python/2.7.2/python-2.7.2.amd64.msi)
2) setup environment variable PATH to look into installation directory
containing python.exe (
http://showmedo.com/videotutorials/video?name=960000&fromSeriesID=96)
3) click on Command Prompt icon inside Start menu
4) change directory to sqlmap directory containing file sqlmap.py (e.g. cd
D:\Work\sqlmap)
5) run sqlmap by typing: python sqlmap.py

Kind regards,
Miroslav Stampar

p.s. you are advised to checkout latest revision from our SVN repository to
keep up with updates:

A) download & install TortoiseSVN from http://tortoisesvn.net/downloads.html
B) press right mouse button inside Explorer where you want to contain sqlmap
C) choose "SVN Checkout..."
D) use https://svn.sqlmap.org/sqlmap/trunk/sqlmap as the "URL of repository"
E) press OK

Re: [sqlmap-users] [bug] redirection handling

[Bernardo D. A. G. <ber...@gm...>]

Hi,

In your case, --null-connection might have worked (comparison based on
"Content-Length" header). If the body has such a minimal difference
between True and False, sqlmap algorithm is not (yet) able to pick
this up therefore comparison based upon --string or other detection
switches is necessary.
We are working on improving the detection engine.

Bernardo


On 16 March 2012 21:43, buawig <bu...@gm...> wrote:
>> Could you update now and send full output of -v3 -t traffic.log
>> masking sensible data? This would help us to debug this potential
>> comparison issue as we are pretty confident that it is not 302
>> redirect related anymore.
>
> Hi,
> I'm sorry but I no longer have access to the tested system,
> but there where three different possible locations in the response to
> detect the difference:
> 1. 'Location' HTTP header: present but empty vs. present and non-empty
> 2. 'Content-Length' HTTP header: length A vs. length B
> 3. Body"  <a href=""> vs.  <a href="http://...">
>
> hope this helps
>
>
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users



-- 
Bernardo Damele A. G.

Homepage: http://about.me/inquis
E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] target url appears to be UNION injectable with 7 columns

[Miroslav S. <mir...@gm...>]

Hi Bores.

There are two kinds of users and we have to carefully balance between those
two.

First kind is those that like to have everything click-click ready, and
user/password database downloadable by just pressing enter. For those users
messages like "heuristic test shows that paremeter could be injectable" and
"appears to be union injectable" are scary and they either don't want to
see it or they are keen for sqlmap to exploit them out of box.

Other kind are those that know also how to manually tamper with some
parameter and see by themself if something is really injectable or
something just appears to be. Those kind of users like to see those kind of
messages because they know that if there is a smoke there could be a fire.

Now, personally I really do like those second type of users not because
they are "advanced" or similar, but because they'll try by themself
anything (no matter how small the thing) to prove that something is really
wrong.

Now, imagine that we don't put that "appears to be messages" there. Those
from the first group would not be confused anymore, but those from the
second group could probably oversee that something could be (no matter how
small the chance) injectable by maybe using some tamper script or use some
other advanced option.

Hence, that's not a bug. That's just for advanced users. Others can freely
skip it/them.

Kind regards,
Miroslav Stampar

On Sun, Mar 18, 2012 at 1:09 AM, Bores Valum <bor...@ya...> wrote:

> Hi to everyone;
> Working on securing my Java server with oracle database and using sqlmap
> revision r4850. The command I made is : python ./sqlmap.py --forms --risk=3
> --level=2 --threads=2 --banner --union-char=1 --dbms=oracle -u
> http://mywebsite.com:8104/adminlogin.jsp
>
> I got :
> [23:26:57] [INFO] testing if POST parameter 'flag' is dynamic
> [23:27:01] [WARNING] POST parameter 'flag' appears to be not dynamic
> [23:27:04] [WARNING] heuristic test shows that POST parameter 'flag' might
> not be injectable
> [23:27:04] [INFO] testing sql injection on POST parameter 'flag'
> [23:27:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING
> clause'
> [23:29:03] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
> [23:31:48] [INFO] testing 'Generic boolean-based blind - Parameter replace
> (original value)'
> [23:32:07] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause
> (XMLType)'
> [23:32:53] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause
> (utl_inaddr.get_host_address)'
> [23:33:33] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause
> (XMLType)'
> [23:35:00] [INFO] testing 'Oracle AND time-based blind'
> [23:35:46] [INFO] testing 'Oracle AND time-based blind (heavy query)'
> [23:36:25] [INFO] testing 'Generic UNION query (1) - 1 to 10 columns'
> [23:42:02] [INFO] target url appears to be UNION injectable with 7 columns
> [23:46:48] [CRITICAL] connection timed out to the target url or proxy,
> sqlmap is going to retry the request
> [23:46:48] [WARNING] if the problem persists please try to lower the
> number of used threads (--threads)
> [23:47:49] [INFO] testing 'Generic UNION query (1) - 11 to 20 columns'
> [23:56:05] [INFO] testing 'Generic UNION query (NUL comment) (1) - 1 to 10
> columns'
>
>
> I think it is a bug from sqlmap do you ? I have googled and so many people
> got the seem notification that mean there is a sql injection with union
> query number xy columns but sqlmap couldn't exploit the injection. I want
> someone to let me sure that it is only a bug on this framework or there is
> a switch that it missing. I don't know if tamper switches have something to
> do especially I am not sure if those tamper scripts works with oracle dbms.
> Regards and I hope to hear from someone.
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] target url appears to be UNION injectable with 7 columns

[Bores V. <bor...@ya...>]

Hi to everyone;
Working on securing my Java server with oracle database and using sqlmap revision r4850. The command I made is : python ./sqlmap.py --forms --risk=3 --level=2 --threads=2 --banner --union-char=1 --dbms=oracle -u http://mywebsite.com:8104/adminlogin.jsp

I got :
[23:26:57] [INFO] testing if POST parameter 'flag' is dynamic
[23:27:01] [WARNING] POST parameter 'flag' appears to be not dynamic
[23:27:04] [WARNING] heuristic test shows that POST parameter 'flag' might not be injectable
[23:27:04] [INFO] testing sql injection on POST parameter 'flag'
[23:27:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[23:29:03] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[23:31:48] [INFO] testing 'Generic boolean-based blind - Parameter replace (original value)'
[23:32:07] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[23:32:53] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (utl_inaddr.get_host_address)'
[23:33:33] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'
[23:35:00] [INFO] testing 'Oracle AND time-based blind'
[23:35:46] [INFO] testing 'Oracle AND time-based blind (heavy query)'
[23:36:25] [INFO] testing 'Generic UNION query (1) - 1 to 10 columns'
[23:42:02] [INFO] target url appears to be UNION injectable with 7 columns
[23:46:48] [CRITICAL] connection timed out to the target url or proxy, sqlmap is going to retry the request
[23:46:48] [WARNING] if the problem persists please try to lower the number of used threads (--threads)
[23:47:49] [INFO] testing 'Generic UNION query (1) - 11 to 20 columns'
[23:56:05] [INFO] testing 'Generic UNION query (NUL comment) (1) - 1 to 10 columns'


I think it is a bug from sqlmap do you ? I have googled and so many people got the seem notification that mean there is a sql injection with union query number xy columns but sqlmap couldn't exploit the injection. I want someone to let me sure that it is only a bug on this framework or there is a switch that it missing. I don't know if tamper switches have something to do especially I am not sure if those tamper scripts works with oracle dbms.
Regards and I hope to hear from someone.

Re: [sqlmap-users] [bug] redirection handling

[buawig <bu...@gm...>]

> Could you update now and send full output of -v3 -t traffic.log
> masking sensible data? This would help us to debug this potential
> comparison issue as we are pretty confident that it is not 302
> redirect related anymore.

Hi,
I'm sorry but I no longer have access to the tested system,
but there where three different possible locations in the response to
detect the difference:
1. 'Location' HTTP header: present but empty vs. present and non-empty
2. 'Content-Length' HTTP header: length A vs. length B
3. Body"  <a href=""> vs.  <a href="http://...">

hope this helps

Re: [sqlmap-users] [bug] redirection handling

[Bernardo D. A. G. <ber...@gm...>]

Hi,

Could you update now and send full output of -v3 -t traffic.log
masking sensible data? This would help us to debug this potential
comparison issue as we are pretty confident that it is not 302
redirect related anymore.

Thank you.
Bernardo


On 15 March 2012 23:44, buawig <bu...@gm...> wrote:
> Hi Miroslav,
>
>> Could you please retry it now with the latest r4884? There were few related
>> fixes in the mean time.
>
> I tested r4884, but it still needs --string to retrieve data, if this
> was what you were asking for.
>
> kind regards
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users



-- 
Bernardo Damele A. G.

Homepage: http://about.me/inquis
E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Miroslav S. <mir...@gm...>]

Hi Julia again.

After a through examination I believe that something other is screwed. In
your case "Host" header value is used for establishing origin of request
when the original request hasn't got a full url (server address included).
That's why httplib uses that value to make a full url.

Does this makes sense to you? Do you see any special in your case?

Now, I can't imagine how is this happening. Could you please send me
privately more information? What command line have you used (or
configuration file in your case)? Also, traffic file (or maybe a part of
it) would be great.

Kind regards

On Fri, Mar 16, 2012 at 12:09 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Will "patch" it in an hour or two. HTTP headers should not be url encoded
> but in this case character : from payload needs to be replaced with url
> encoded counterpart to prevent this kind of behavior.
>
> Kind regards,
> Miroslav Stampar
>
>
> On Fri, Mar 16, 2012 at 11:50 AM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> Hi Julia.
>>
>> Thank you for your report and a minor explanation of what is going here.
>> We are doing also an injection of "Host" header on higher levels (e.g.
>> --level=5) and that's causing the problem in your case. Python's library
>> httplib is obviously not happy with that. Have to research a bit what we
>> can be done here.
>>
>> Kind regards,
>> Miroslav Stampar
>>
>>
>> On Fri, Mar 16, 2012 at 1:12 AM, Julia Wolf <ju...@fi...> wrote:
>>
>>>
>>>   Well, here's a bug report crash-thingy... My cursory analysis is that
>>> the SQL PAYLOAD got sucked back up and, for some mysterious reason,
>>> re-parsed as a host:port value. Something like the hostname being
>>> "10.6.1.142) AND 5306=CAST... etc. ...ELSE 0 END))::" which then means
>>> that the port would be "text||CHR(58) ... and stuff"
>>>
>>> Here's some, possibly relevant, options from the config file.
>>>
>>> crawlDepth = 10
>>> forceSSL = True
>>> level = 5
>>> risk = 3
>>> tech = BEUST
>>>
>>>
>>>
>>> [18:28:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
>>> clause'
>>> [18:28:19] [PAYLOAD] 10.6.1.142) AND
>>> 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE
>>> WHEN (5306=5306) THEN 1 ELSE 0
>>> END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
>>> [18:28:19] [TRAFFIC OUT] HTTP request [#13922]:
>>> GET // HTTP/1.1
>>> Accept-Encoding: identity
>>> Accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
>>> Host: 10.6.1.142) AND
>>> 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE
>>> WHEN (5306=5306) THEN 1 ELSE 0
>>> END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
>>> Accept-language: en-us,en;q=0.5
>>> Cookie: _session_id=60273438247a37935d9d37562d6888ba;
>>> Referer: https://10.6.1.142:443//
>>> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
>>> User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1)
>>> Gecko/20100101 Firefox/8.0.1
>>> Connection: close
>>>
>>> [18:28:19] [WARNING] HTTP error codes detected during testing:
>>> 400 (Bad Request) - 62 times, 500 (Internal Server Error) - 35 times,
>>> 404 (Not Found) - 3572 times
>>>
>>> [18:28:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4864),
>>> retry your run with the latest development version from the Subversion
>>> repository. If the exception persists, please send by e-mail to
>>> sql...@li... the following text and any
>>> information required to reproduce the bug. The developers will try to
>>> reproduce the bug, fix it accordingly and get back to you.
>>> sqlmap version: 1.0-dev (r4864)
>>> Python version: 2.7.2
>>> Operating system: posix
>>> Command line: ./sqlmap.py -c test2.conf -l final_url.lst
>>> Technique: UNION
>>> Back-end DBMS: PostgreSQL (identified)
>>> Traceback (most recent call last):
>>>   File "/home/jwolf/Mar_14_12/sqlmap/_sqlmap.py", line 82, in main
>>>     start()
>>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/controller.py", line
>>> 472, in start
>>>     injection = checkSqlInjection(place, parameter, value)
>>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/checks.py", line
>>> 355, in checkSqlInjection
>>>     page, headers = Request.queryPage(reqPayload, place, content=True,
>>> raise404=False)
>>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 719,
>>> in queryPage
>>>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
>>> cookie=cookie, ua=ua, referer=referer, host=host, silent=silent,
>>> method=method, auxHeaders=auxHeaders, response=response, raise404=raise404,
>>> ignoreTimeout=timeBasedCompare)
>>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 294,
>>> in getPage
>>>     conn = urllib2.urlopen(req)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 126, in urlopen
>>>     return _opener.open(url, data, timeout)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 400, in open
>>>     response = meth(req, response)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 513, in http_response
>>>     'http', request, response, code, msg, hdrs)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 432, in error
>>>     result = self._call_chain(*args)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
>>>     result = func(*args)
>>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/redirecthandler.py",
>>> line 108, in http_error_302
>>>     result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp,
>>> code, msg, headers)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 619, in http_error_302
>>>     return self.parent.open(new, timeout=req.timeout)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 394, in open
>>>     response = self._open(req, data)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 412, in _open
>>>     '_open', req)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
>>>     result = func(*args)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 1207, in https_open
>>>     return self.do_open(httplib.HTTPSConnection, req)
>>>   File "/usr/lib64/python2.7/urllib2.py", line 1140, in do_open
>>>     h = http_class(host, timeout=req.timeout) # will parse host:port
>>>   File "/usr/lib64/python2.7/httplib.py", line 1146, in __init__
>>>     source_address)
>>>   File "/usr/lib64/python2.7/httplib.py", line 693, in __init__
>>>     self._set_hostport(host, port)
>>>   File "/usr/lib64/python2.7/httplib.py", line 718, in _set_hostport
>>>     raise InvalidURL("nonnumeric port: '%s'" % host[i+1:])
>>> InvalidURL: nonnumeric port:
>>> 'text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)'
>>>
>>> [*] shutting down at 18:28:19
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> This SF email is sponsosred by:
>>> Try Windows Azure free for 90 days Click Here
>>> http://p.sf.net/sfu/sfd2d-msazure
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>> http://about.me/stamparm
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Miroslav S. <mir...@gm...>]

Will "patch" it in an hour or two. HTTP headers should not be url encoded
but in this case character : from payload needs to be replaced with url
encoded counterpart to prevent this kind of behavior.

Kind regards,
Miroslav Stampar

On Fri, Mar 16, 2012 at 11:50 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Julia.
>
> Thank you for your report and a minor explanation of what is going here.
> We are doing also an injection of "Host" header on higher levels (e.g.
> --level=5) and that's causing the problem in your case. Python's library
> httplib is obviously not happy with that. Have to research a bit what we
> can be done here.
>
> Kind regards,
> Miroslav Stampar
>
>
> On Fri, Mar 16, 2012 at 1:12 AM, Julia Wolf <ju...@fi...> wrote:
>
>>
>>   Well, here's a bug report crash-thingy... My cursory analysis is that
>> the SQL PAYLOAD got sucked back up and, for some mysterious reason,
>> re-parsed as a host:port value. Something like the hostname being
>> "10.6.1.142) AND 5306=CAST... etc. ...ELSE 0 END))::" which then means
>> that the port would be "text||CHR(58) ... and stuff"
>>
>> Here's some, possibly relevant, options from the config file.
>>
>> crawlDepth = 10
>> forceSSL = True
>> level = 5
>> risk = 3
>> tech = BEUST
>>
>>
>>
>> [18:28:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
>> clause'
>> [18:28:19] [PAYLOAD] 10.6.1.142) AND
>> 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE
>> WHEN (5306=5306) THEN 1 ELSE 0
>> END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
>> [18:28:19] [TRAFFIC OUT] HTTP request [#13922]:
>> GET // HTTP/1.1
>> Accept-Encoding: identity
>> Accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
>> Host: 10.6.1.142) AND
>> 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE
>> WHEN (5306=5306) THEN 1 ELSE 0
>> END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
>> Accept-language: en-us,en;q=0.5
>> Cookie: _session_id=60273438247a37935d9d37562d6888ba;
>> Referer: https://10.6.1.142:443//
>> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
>> User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1)
>> Gecko/20100101 Firefox/8.0.1
>> Connection: close
>>
>> [18:28:19] [WARNING] HTTP error codes detected during testing:
>> 400 (Bad Request) - 62 times, 500 (Internal Server Error) - 35 times, 404
>> (Not Found) - 3572 times
>>
>> [18:28:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4864),
>> retry your run with the latest development version from the Subversion
>> repository. If the exception persists, please send by e-mail to
>> sql...@li... the following text and any
>> information required to reproduce the bug. The developers will try to
>> reproduce the bug, fix it accordingly and get back to you.
>> sqlmap version: 1.0-dev (r4864)
>> Python version: 2.7.2
>> Operating system: posix
>> Command line: ./sqlmap.py -c test2.conf -l final_url.lst
>> Technique: UNION
>> Back-end DBMS: PostgreSQL (identified)
>> Traceback (most recent call last):
>>   File "/home/jwolf/Mar_14_12/sqlmap/_sqlmap.py", line 82, in main
>>     start()
>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/controller.py", line
>> 472, in start
>>     injection = checkSqlInjection(place, parameter, value)
>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/checks.py", line 355,
>> in checkSqlInjection
>>     page, headers = Request.queryPage(reqPayload, place, content=True,
>> raise404=False)
>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 719,
>> in queryPage
>>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
>> cookie=cookie, ua=ua, referer=referer, host=host, silent=silent,
>> method=method, auxHeaders=auxHeaders, response=response, raise404=raise404,
>> ignoreTimeout=timeBasedCompare)
>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 294,
>> in getPage
>>     conn = urllib2.urlopen(req)
>>   File "/usr/lib64/python2.7/urllib2.py", line 126, in urlopen
>>     return _opener.open(url, data, timeout)
>>   File "/usr/lib64/python2.7/urllib2.py", line 400, in open
>>     response = meth(req, response)
>>   File "/usr/lib64/python2.7/urllib2.py", line 513, in http_response
>>     'http', request, response, code, msg, hdrs)
>>   File "/usr/lib64/python2.7/urllib2.py", line 432, in error
>>     result = self._call_chain(*args)
>>   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
>>     result = func(*args)
>>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/redirecthandler.py",
>> line 108, in http_error_302
>>     result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp,
>> code, msg, headers)
>>   File "/usr/lib64/python2.7/urllib2.py", line 619, in http_error_302
>>     return self.parent.open(new, timeout=req.timeout)
>>   File "/usr/lib64/python2.7/urllib2.py", line 394, in open
>>     response = self._open(req, data)
>>   File "/usr/lib64/python2.7/urllib2.py", line 412, in _open
>>     '_open', req)
>>   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
>>     result = func(*args)
>>   File "/usr/lib64/python2.7/urllib2.py", line 1207, in https_open
>>     return self.do_open(httplib.HTTPSConnection, req)
>>   File "/usr/lib64/python2.7/urllib2.py", line 1140, in do_open
>>     h = http_class(host, timeout=req.timeout) # will parse host:port
>>   File "/usr/lib64/python2.7/httplib.py", line 1146, in __init__
>>     source_address)
>>   File "/usr/lib64/python2.7/httplib.py", line 693, in __init__
>>     self._set_hostport(host, port)
>>   File "/usr/lib64/python2.7/httplib.py", line 718, in _set_hostport
>>     raise InvalidURL("nonnumeric port: '%s'" % host[i+1:])
>> InvalidURL: nonnumeric port:
>> 'text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)'
>>
>> [*] shutting down at 18:28:19
>>
>>
>>
>> ------------------------------------------------------------------------------
>> This SF email is sponsosred by:
>> Try Windows Azure free for 90 days Click Here
>> http://p.sf.net/sfu/sfd2d-msazure
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] raise InvalidURL nonnumeric port

[Miroslav S. <mir...@gm...>]

Hi Julia.

Thank you for your report and a minor explanation of what is going here. We
are doing also an injection of "Host" header on higher levels (e.g.
--level=5) and that's causing the problem in your case. Python's library
httplib is obviously not happy with that. Have to research a bit what we
can be done here.

Kind regards,
Miroslav Stampar

On Fri, Mar 16, 2012 at 1:12 AM, Julia Wolf <ju...@fi...> wrote:

>
>   Well, here's a bug report crash-thingy... My cursory analysis is that
> the SQL PAYLOAD got sucked back up and, for some mysterious reason,
> re-parsed as a host:port value. Something like the hostname being
> "10.6.1.142) AND 5306=CAST... etc. ...ELSE 0 END))::" which then means
> that the port would be "text||CHR(58) ... and stuff"
>
> Here's some, possibly relevant, options from the config file.
>
> crawlDepth = 10
> forceSSL = True
> level = 5
> risk = 3
> tech = BEUST
>
>
>
> [18:28:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING
> clause'
> [18:28:19] [PAYLOAD] 10.6.1.142) AND
> 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE
> WHEN (5306=5306) THEN 1 ELSE 0
> END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
> [18:28:19] [TRAFFIC OUT] HTTP request [#13922]:
> GET // HTTP/1.1
> Accept-Encoding: identity
> Accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
> Host: 10.6.1.142) AND
> 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE
> WHEN (5306=5306) THEN 1 ELSE 0
> END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
> Accept-language: en-us,en;q=0.5
> Cookie: _session_id=60273438247a37935d9d37562d6888ba;
> Referer: https://10.6.1.142:443//
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1)
> Gecko/20100101 Firefox/8.0.1
> Connection: close
>
> [18:28:19] [WARNING] HTTP error codes detected during testing:
> 400 (Bad Request) - 62 times, 500 (Internal Server Error) - 35 times, 404
> (Not Found) - 3572 times
>
> [18:28:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4864), retry
> your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the
> bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4864)
> Python version: 2.7.2
> Operating system: posix
> Command line: ./sqlmap.py -c test2.conf -l final_url.lst
> Technique: UNION
> Back-end DBMS: PostgreSQL (identified)
> Traceback (most recent call last):
>   File "/home/jwolf/Mar_14_12/sqlmap/_sqlmap.py", line 82, in main
>     start()
>   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/controller.py", line
> 472, in start
>     injection = checkSqlInjection(place, parameter, value)
>   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/checks.py", line 355,
> in checkSqlInjection
>     page, headers = Request.queryPage(reqPayload, place, content=True,
> raise404=False)
>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 719, in
> queryPage
>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
> cookie=cookie, ua=ua, referer=referer, host=host, silent=silent,
> method=method, auxHeaders=auxHeaders, response=response, raise404=raise404,
> ignoreTimeout=timeBasedCompare)
>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 294, in
> getPage
>     conn = urllib2.urlopen(req)
>   File "/usr/lib64/python2.7/urllib2.py", line 126, in urlopen
>     return _opener.open(url, data, timeout)
>   File "/usr/lib64/python2.7/urllib2.py", line 400, in open
>     response = meth(req, response)
>   File "/usr/lib64/python2.7/urllib2.py", line 513, in http_response
>     'http', request, response, code, msg, hdrs)
>   File "/usr/lib64/python2.7/urllib2.py", line 432, in error
>     result = self._call_chain(*args)
>   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
>     result = func(*args)
>   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/redirecthandler.py", line
> 108, in http_error_302
>     result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp,
> code, msg, headers)
>   File "/usr/lib64/python2.7/urllib2.py", line 619, in http_error_302
>     return self.parent.open(new, timeout=req.timeout)
>   File "/usr/lib64/python2.7/urllib2.py", line 394, in open
>     response = self._open(req, data)
>   File "/usr/lib64/python2.7/urllib2.py", line 412, in _open
>     '_open', req)
>   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
>     result = func(*args)
>   File "/usr/lib64/python2.7/urllib2.py", line 1207, in https_open
>     return self.do_open(httplib.HTTPSConnection, req)
>   File "/usr/lib64/python2.7/urllib2.py", line 1140, in do_open
>     h = http_class(host, timeout=req.timeout) # will parse host:port
>   File "/usr/lib64/python2.7/httplib.py", line 1146, in __init__
>     source_address)
>   File "/usr/lib64/python2.7/httplib.py", line 693, in __init__
>     self._set_hostport(host, port)
>   File "/usr/lib64/python2.7/httplib.py", line 718, in _set_hostport
>     raise InvalidURL("nonnumeric port: '%s'" % host[i+1:])
> InvalidURL: nonnumeric port:
> 'text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)'
>
> [*] shutting down at 18:28:19
>
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] raise InvalidURL nonnumeric port

[Julia W. <ju...@fi...>]

   Well, here's a bug report crash-thingy... My cursory analysis is that 
the SQL PAYLOAD got sucked back up and, for some mysterious reason, 
re-parsed as a host:port value. Something like the hostname being 
"10.6.1.142) AND 5306=CAST... etc. ...ELSE 0 END))::" which then means 
that the port would be "text||CHR(58) ... and stuff"

Here's some, possibly relevant, options from the config file.

crawlDepth = 10
forceSSL = True
level = 5
risk = 3
tech = BEUST



[18:28:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[18:28:19] [PAYLOAD] 10.6.1.142) AND 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE WHEN (5306=5306) THEN 1 ELSE 0 END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
[18:28:19] [TRAFFIC OUT] HTTP request [#13922]:
GET // HTTP/1.1
Accept-Encoding: identity
Accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Host: 10.6.1.142) AND 5306=CAST(CHR(58)||CHR(105)||CHR(105)||CHR(121)||CHR(58)||(SELECT (CASE WHEN (5306=5306) THEN 1 ELSE 0 END))::text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)
Accept-language: en-us,en;q=0.5
Cookie: _session_id=60273438247a37935d9d37562d6888ba;
Referer: https://10.6.1.142:443//
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1
Connection: close

[18:28:19] [WARNING] HTTP error codes detected during testing:
400 (Bad Request) - 62 times, 500 (Internal Server Error) - 35 times, 404 (Not Found) - 3572 times

[18:28:19] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4864), retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r4864)
Python version: 2.7.2
Operating system: posix
Command line: ./sqlmap.py -c test2.conf -l final_url.lst
Technique: UNION
Back-end DBMS: PostgreSQL (identified)
Traceback (most recent call last):
   File "/home/jwolf/Mar_14_12/sqlmap/_sqlmap.py", line 82, in main
     start()
   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/controller.py", line 472, in start
     injection = checkSqlInjection(place, parameter, value)
   File "/home/jwolf/Mar_14_12/sqlmap/lib/controller/checks.py", line 355, in checkSqlInjection
     page, headers = Request.queryPage(reqPayload, place, content=True, raise404=False)
   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 719, in queryPage
     page, headers, code = Connect.getPage(url=uri, get=get, post=post, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, method=method, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCompare)
   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/connect.py", line 294, in getPage
     conn = urllib2.urlopen(req)
   File "/usr/lib64/python2.7/urllib2.py", line 126, in urlopen
     return _opener.open(url, data, timeout)
   File "/usr/lib64/python2.7/urllib2.py", line 400, in open
     response = meth(req, response)
   File "/usr/lib64/python2.7/urllib2.py", line 513, in http_response
     'http', request, response, code, msg, hdrs)
   File "/usr/lib64/python2.7/urllib2.py", line 432, in error
     result = self._call_chain(*args)
   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
     result = func(*args)
   File "/home/jwolf/Mar_14_12/sqlmap/lib/request/redirecthandler.py", line 108, in http_error_302
     result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp, code, msg, headers)
   File "/usr/lib64/python2.7/urllib2.py", line 619, in http_error_302
     return self.parent.open(new, timeout=req.timeout)
   File "/usr/lib64/python2.7/urllib2.py", line 394, in open
     response = self._open(req, data)
   File "/usr/lib64/python2.7/urllib2.py", line 412, in _open
     '_open', req)
   File "/usr/lib64/python2.7/urllib2.py", line 372, in _call_chain
     result = func(*args)
   File "/usr/lib64/python2.7/urllib2.py", line 1207, in https_open
     return self.do_open(httplib.HTTPSConnection, req)
   File "/usr/lib64/python2.7/urllib2.py", line 1140, in do_open
     h = http_class(host, timeout=req.timeout) # will parse host:port
   File "/usr/lib64/python2.7/httplib.py", line 1146, in __init__
     source_address)
   File "/usr/lib64/python2.7/httplib.py", line 693, in __init__
     self._set_hostport(host, port)
   File "/usr/lib64/python2.7/httplib.py", line 718, in _set_hostport
     raise InvalidURL("nonnumeric port: '%s'" % host[i+1:])
InvalidURL: nonnumeric port: 'text||CHR(58)||CHR(112)||CHR(112)||CHR(107)||CHR(58) AS NUMERIC)'

[*] shutting down at 18:28:19

Re: [sqlmap-users] [bug] redirection handling

[buawig <bu...@gm...>]

Hi Miroslav,

> Could you please retry it now with the latest r4884? There were few related
> fixes in the mean time.

I tested r4884, but it still needs --string to retrieve data, if this
was what you were asking for.

kind regards

Re: [sqlmap-users] [bug] redirection handling

[Miroslav S. <mir...@gm...>]

Hi again.

Could you please retry it now with the latest r4884? There were few related
fixes in the mean time.

Kind regards,
Miroslav Stampar

On Thu, Mar 15, 2012 at 7:54 PM, buawig <bu...@gm...> wrote:

> Hi Miroslav,
>
> > Could you please retry it now with the latest revision (r4874)?
>
> now with r4882, sqlmap doesn't make any follow up requests anymore when
> choosing [3] Ignore.
> It is not able to retrieve data (blind), but when providing info via the
>  --string option data retrieval works fine.
>
> thanks!
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] [bug] redirection handling

[buawig <bu...@gm...>]

Hi Miroslav,

> Could you please retry it now with the latest revision (r4874)?

now with r4882, sqlmap doesn't make any follow up requests anymore when
choosing [3] Ignore.
It is not able to retrieve data (blind), but when providing info via the
 --string option data retrieval works fine.

thanks!

Re: [sqlmap-users] feature request // csrf-token detection for forms

[Bernardo D. A. G. <ber...@gm...>]

CSRF protection bypass is in the TODO list, it will be implement at some point.

Bernardo


On 14 March 2012 18:57, a nice guy <ae9...@to...> wrote:
> Hello,
>
> I think it would great if sqlmap could detect which post-parameter
> contains the csrf-token, if any,
> or select the toke manually.
>
> kind regards,
> a nice guy
>
> ------------------------------------------------------------------------------
> Virtualization & Cloud Management Using Capacity Planning
> Cloud computing makes use of virtualization - but cloud computing
> also focuses on allowing computing to be delivered as a service.
> http://www.accelacomm.com/jaw/sfnl/114/51521223/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users



-- 
Bernardo Damele A. G.

Homepage: http://about.me/inquis
E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] feature request // specific targets for post/cookie/agent/referrer

[Bernardo D. A. G. <ber...@gm...>]

You can provide cookies and POST parameters to -p already as well as
"ua" for User-Agent.

Bernardo


On 14 March 2012 18:54, a nice guy <ae9...@to...> wrote:
>
> Hello,
>
> It would be very nice if it would be possible to specify the targeted
> value directly for
> post/cookie/agent/referrer, as it is possible for get with -p.
>
> And may be, there should be a list shown before the injection starts,
> where you can
> choose "All" or "Number of parameter".
>
> kind regards,
> a nice guy
>
> ------------------------------------------------------------------------------
> Virtualization & Cloud Management Using Capacity Planning
> Cloud computing makes use of virtualization - but cloud computing
> also focuses on allowing computing to be delivered as a service.
> http://www.accelacomm.com/jaw/sfnl/114/51521223/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users




--
Bernardo Damele A. G.

Homepage: http://about.me/inquis
E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] [bug] redirection handling

[Miroslav S. <mir...@gm...>]

Hi buawig.

Could you please retry it now with the latest revision (r4874)?

Kind regards,
Miroslav Stampar

On Wed, Mar 14, 2012 at 8:26 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Found a problematic part. Will fix it tomorrow.
>
> Kind regards,
> Miroslav Stampar
>
> On Wed, Mar 14, 2012 at 6:42 PM, buawig <bu...@gm...> wrote:
>
>> > Also, "Ignore" should be suitable for your
>> > case when you don't want sqlmap to follow the redirection.
>>
>> This still does not work for me.
>> If I choose "[3] Ignore". sqlmap still sends requests to the redirection
>> Location.
>> There are even scenarios where sqlmap doesn't detect an sqli due to this
>> behaviour, if the content on redirecton site A is the same as the
>> content on redirection site B.
>> I worked around this issue by creating a static DNS entry for site B +
>> putting some random stuff on the requested redirection page (just that
>> sqlmap sees a difference between A and B).
>>
>> I'm using r4864.
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] feature request // specific targets for post/cookie/agent/referrer

[a n. g. <ae9...@to...>]

Hello,

It would be very nice if it would be possible to specify the targeted 
value directly for
post/cookie/agent/referrer, as it is possible for get with -p.

And may be, there should be a list shown before the injection starts, 
where you can
choose "All" or "Number of parameter".

kind regards,
a nice guy

[sqlmap-users] feature request // csrf-token detection for forms

[a n. g. <ae9...@to...>]

Hello,

I think it would great if sqlmap could detect which post-parameter 
contains the csrf-token, if any,
or select the toke manually.

kind regards,
a nice guy

Re: [sqlmap-users] [bug] redirection handling

[Miroslav S. <mir...@gm...>]

Found a problematic part. Will fix it tomorrow.

Kind regards,
Miroslav Stampar

On Wed, Mar 14, 2012 at 6:42 PM, buawig <bu...@gm...> wrote:

> > Also, "Ignore" should be suitable for your
> > case when you don't want sqlmap to follow the redirection.
>
> This still does not work for me.
> If I choose "[3] Ignore". sqlmap still sends requests to the redirection
> Location.
> There are even scenarios where sqlmap doesn't detect an sqli due to this
> behaviour, if the content on redirecton site A is the same as the
> content on redirection site B.
> I worked around this issue by creating a static DNS entry for site B +
> putting some random stuff on the requested redirection page (just that
> sqlmap sees a difference between A and B).
>
> I'm using r4864.
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] [bug] redirection handling

[buawig <bu...@gm...>]

> Also, "Ignore" should be suitable for your
> case when you don't want sqlmap to follow the redirection.

This still does not work for me.
If I choose "[3] Ignore". sqlmap still sends requests to the redirection
Location.
There are even scenarios where sqlmap doesn't detect an sqli due to this
behaviour, if the content on redirecton site A is the same as the
content on redirection site B.
I worked around this issue by creating a static DNS entry for site B +
putting some random stuff on the requested redirection page (just that
sqlmap sees a difference between A and B).

I'm using r4864.

Re: [sqlmap-users] redirection handling

[Miroslav S. <mir...@gm...>]

Hi.

To sum things up here:

1) "Follow the redirection" should be clear what it does
2) "Stay on the original page" uses the original URL and jumps there
(useful if there were some changes resulting in changes on the original
page - e.g. some session cookie was set resulting in "differentiation" of
the original page)
3) "Ignore" uses the redirection page itself (usually blank or simple one
with few lines) as the one for extracting the results (useful for boolean
based injections as those pages are usually dramatically different than the
originals)

About the "no follow up requests". There are indeed lots of cases when it's
useful to just imitate what browser does - follow the redirection to
whatever destination it goes. Also, "Ignore" should be suitable for your
case when you don't want sqlmap to follow the redirection.

Also, with the latest revision (r4864), -t traffic.txt should work properly
with that [3] Ignore option (no more non-existing requests)

Kind regards,
Miroslav Stampar

On Tue, Mar 13, 2012 at 6:07 PM, buawig <bu...@gm...> wrote:

> Hi,
>
> when testing URLs that result in redirects sqlmap offers three
> possibilities:
>
> [1] Follow the redirection (default)
> [2] Stay on the original page
> [3] Ignore
>
> If I answer with
> > 2
> or with
> > 3
>
> it still sends requests to the URL found in the Location: header.
>
> Is there a way to prevent these requests to the URL specified in the
> Location: header?
>
> Sqlmap should only query the url specified in -u parameter and analyze
> the responses - no follow up requests.
>
> thanks,
> buawig
>
>
> ------------------------------------------------------------------------------
> Keep Your Developer Skills Current with LearnDevNow!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Union select

[Bernardo D. A. G. <ber...@gm...>]

I don't know how you have got it working, but the right way is with
--union-cols switch and that is documented in the user's manual.
Increasing --level will also do by the way.

Bernardo Damele A. G.

This message was sent from a smartphone

On 14 Mar 2012, at 03:36, Rob Fuller <jd....@gm...> wrote:

> disregard, got it working, thanks ;-)
>
> --
> Rob Fuller | Mubix
> Certified Checkbox Unchecker
> Room362.com | Hak5.org
>
>
>
> On Tue, Mar 13, 2012 at 11:09 PM, Rob Fuller <jd....@gm...> wrote:
>> Trying to exploit a union select vuln that only actually shows row 23,
>> is there a way to get sqlmap to select a column to use?
>>
>> --
>> Rob Fuller | Mubix
>> Certified Checkbox Unchecker
>> Room362.com | Hak5.org
>
> ------------------------------------------------------------------------------
> Virtualization & Cloud Management Using Capacity Planning
> Cloud computing makes use of virtualization - but cloud computing
> also focuses on allowing computing to be delivered as a service.
> http://www.accelacomm.com/jaw/sfnl/114/51521223/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] Union select

[Rob F. <jd....@gm...>]

disregard, got it working, thanks ;-)

--
Rob Fuller | Mubix
Certified Checkbox Unchecker
Room362.com | Hak5.org



On Tue, Mar 13, 2012 at 11:09 PM, Rob Fuller <jd....@gm...> wrote:
> Trying to exploit a union select vuln that only actually shows row 23,
> is there a way to get sqlmap to select a column to use?
>
> --
> Rob Fuller | Mubix
> Certified Checkbox Unchecker
> Room362.com | Hak5.org

[sqlmap-users] Union select

[Rob F. <jd....@gm...>]

Trying to exploit a union select vuln that only actually shows row 23,
is there a way to get sqlmap to select a column to use?

--
Rob Fuller | Mubix
Certified Checkbox Unchecker
Room362.com | Hak5.org

Re: [sqlmap-users] --keep-alive with --proxy

[Miroslav S. <mir...@gm...>]

Hi.

Keep-alive feature is suspended in combination with --proxy. You should be
warned about it like this:
"...[WARNING] persistent HTTP(s) connections, Keep-Alive, has been disabled
because of it's incompatibility with HTTP(s) proxy"

Kind regards,
Miroslav Stampar

On Tue, Mar 13, 2012 at 10:05 PM, buawig <bu...@gm...> wrote:

> Hi,
>
> regardless whether --keep-alive is used or not
> the 'Connection:' header field is always set to 'close'.
>
> I'm using --keep-alive in conjunction with --proxy=..
>
>
> regards,
> buawig
>
>
>
>
> ------------------------------------------------------------------------------
> Keep Your Developer Skills Current with LearnDevNow!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-d2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm