sqlmap-users — sqlmap users mailing list

[sqlmap-users] bug report

[m4l1c3 <mal...@gm...>]

sqlmap version: 1.0-dev (r4574)
Python version: 2.6.5
Operating system: posix
Command line: ./sqlmap.py -u ********************* --batch --dbs --forms
--crawl 3 --technique=U --threads 10 --level 3 --risk 2 --smart
--random-agent --tor
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
  File "/pentest/database/sqlmap/lib/core/threads.py", line 123, in
runThreads
    threadFunction()
  File "/pentest/database/sqlmap/lib/utils/crawler.py", line 61, in
crawlThread
    content = Request.getPage(url=current, crawling=True, raise404=False)[0]
  File "/pentest/database/sqlmap/lib/request/connect.py", line 302, in
getPage
    conn = urllib2.urlopen(req)
  File "/usr/lib/python2.6/urllib2.py", line 126, in urlopen
    return _opener.open(url, data, timeout)
  File "/usr/lib/python2.6/urllib2.py", line 391, in open
    response = self._open(req, data)
  File "/usr/lib/python2.6/urllib2.py", line 409, in _open
    '_open', req)
  File "/usr/lib/python2.6/urllib2.py", line 369, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.6/urllib2.py", line 1161, in http_open
    return self.do_open(httplib.HTTPConnection, req)
  File "/usr/lib/python2.6/urllib2.py", line 1133, in do_open
    h.request(req.get_method(), req.get_selector(), req.data, headers)
  File "/usr/lib/python2.6/httplib.py", line 910, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.6/httplib.py", line 947, in _send_request
    self.endheaders()
  File "/usr/lib/python2.6/httplib.py", line 904, in endheaders
    self._send_output()
  File "/usr/lib/python2.6/httplib.py", line 776, in _send_output
    self.send(msg)
  File "/usr/lib/python2.6/httplib.py", line 735, in send
    self.connect()
  File "/usr/lib/python2.6/httplib.py", line 716, in connect
    self.timeout)
  File "/pentest/database/sqlmap/extra/socks/socks.py", line 410, in
create_connection
    except error as _:
NameError: global name 'error' is not defined
[21:37:24] [WARNING] no usable links found (with GET parameters)


Thanks, everyone, for your continued efforts to develop this program.

[sqlmap-users] bug report

[m4l1c3 <mal...@gm...>]

sqlmap version: 1.0-dev (r4574)
Python version: 2.6.5
Operating system: posix
Command line: ./sqlmap.py -u ************* --batch --dbs --forms --crawl 2
--technique=BU --threads 10 --level 3 --risk 2 --smart --random-agent --tor
Technique: None
Back-end DBMS: None (identified)
Traceback (most recent call last):
  File "/pentest/database/sqlmap/_sqlmap.py", line 86, in main
    start()
  File "/pentest/database/sqlmap/lib/controller/controller.py", line 456,
in start
    if not checkDynParam(place, parameter, value):
  File "/pentest/database/sqlmap/lib/controller/checks.py", line 665, in
checkDynParam
    dynResult = Request.queryPage(payload, place, raise404=False)
  File "/pentest/database/sqlmap/lib/request/connect.py", line 711, in
queryPage
    page, headers, code = Connect.getPage(url=uri, get=get, post=post,
cookie=cookie, ua=ua, referer=referer, silent=silent, method=method,
auxHeaders=auxHeaders, response=response, raise404=raise404,
ignoreTimeout=timeBasedCompare)
  File "/pentest/database/sqlmap/lib/request/connect.py", line 373, in
getPage
    return Connect.__getPageProxy(**kwargs)
  File "/pentest/database/sqlmap/lib/request/connect.py", line 80, in
__getPageProxy
    return Connect.getPage(**kwargs)
  File "/pentest/database/sqlmap/lib/request/connect.py", line 302, in
getPage
    conn = urllib2.urlopen(req)
  File "/usr/lib/python2.6/urllib2.py", line 126, in urlopen
    return _opener.open(url, data, timeout)
  File "/usr/lib/python2.6/urllib2.py", line 391, in open
    response = self._open(req, data)
  File "/usr/lib/python2.6/urllib2.py", line 409, in _open
    '_open', req)
  File "/usr/lib/python2.6/urllib2.py", line 369, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.6/urllib2.py", line 1161, in http_open
    return self.do_open(httplib.HTTPConnection, req)
  File "/usr/lib/python2.6/urllib2.py", line 1133, in do_open
    h.request(req.get_method(), req.get_selector(), req.data, headers)
  File "/usr/lib/python2.6/httplib.py", line 910, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.6/httplib.py", line 947, in _send_request
    self.endheaders()
  File "/usr/lib/python2.6/httplib.py", line 904, in endheaders
    self._send_output()
  File "/usr/lib/python2.6/httplib.py", line 776, in _send_output
    self.send(msg)
  File "/usr/lib/python2.6/httplib.py", line 735, in send
    self.connect()
  File "/usr/lib/python2.6/httplib.py", line 716, in connect
    self.timeout)
  File "/pentest/database/sqlmap/extra/socks/socks.py", line 410, in
create_connection
    except error as _:
NameError: global name 'error' is not defined

Re: [sqlmap-users] Test cases

[Miroslav S. <mir...@gm...>]

Hi.

We have few implemented mechanisms  (few non-public switches) and
non-public Debian based and WinXP based VMs for internal tests. This moment
they not available for public as they would represent an unnecessary burden
for storage, maintanence and similar.

Nevertheless, there are many deliberately vulnerable web projects out there
that can give you the similar testing platform for sqlmap.

Kind regards,
Miroslav Stampar
On Dec 4, 2011 9:16 PM, "Brandon Perry" <bpe...@gm...> wrote:

> Hi,
>
>
> I was curious if you have a set of testcases that you check your
> specific techniques against? Miroslav mentioned in an earlier thread
> he had a VM he were using. Is this code available or can it be?
>
> --
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>

[sqlmap-users] Test cases

[Brandon P. <bpe...@gm...>]

Hi,


I was curious if you have a set of testcases that you check your
specific techniques against? Miroslav mentioned in an earlier thread
he had a VM he were using. Is this code available or can it be?

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

Re: [sqlmap-users] Tor + sqlmap

[Miroslav S. <mir...@gm...>]

Hi.

Could you please update and retry?

Kind regards
On Dec 4, 2011 4:53 PM, "Hans Wurst" <wur...@go...> wrote:

> Hello everyone,
>
> i updated today to the latest rev and now sqlmap stopped working with tor.
>
> [16:46:18] [WARNING] increasing default value for --time-sec to 10 because
> --tor
>  switch was provided
> [16:46:18] [INFO] setting Tor SOCKS proxy settings
> [16:46:18] [INFO] checking Tor connection
> [16:46:22] [INFO] Tor is properly being used
> [16:46:22] [INFO] testing connection to the target url
> [16:46:22] [CRITICAL] unable to connect to the target url or proxy, sqlmap
> is go
> ing to retry the request
> [16:46:22] [WARNING] please make sure that you have Tor installed and
> running so
>  you could successfully use --tor switch (e.g.
> https://www.torproject.org/downlo
> ad/download.html.en)
> [16:46:23] [CRITICAL] unable to connect to the target url or proxy, sqlmap
> is go
> ing to retry the request
> [16:46:24] [CRITICAL] unable to connect to the target url or proxy, sqlmap
> is go
> ing to retry the request
> [16:46:25] [CRITICAL] unable to connect to the target url or proxy
> it is not recommended to continue in this kind of cases. Do you want to
> quit and
>  make sure that everything is set up properly? [Y/n]
>
> [*] shutting down at 16:46:29
>
> ----------------------
> Tor gives me the following log message =>
>  "Your application (using socks5 to port 8118) is giving Tor only an Ip
> adress...."
> "Rejectign SOCKS request for anonymous connection to private adress
> [scrubbed]"
> ---------------------
> privoxy config
> listen-address  127.0.0.1:8118
> forward-socks4a / localhost:9050 .
> --------------------
>
> any has a quick tip for me how to fix this issue ?
>
> thanks in advance
> hans
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] Tor + sqlmap

[Hans W. <wur...@go...>]

Hello everyone,

i updated today to the latest rev and now sqlmap stopped working with tor.

[16:46:18] [WARNING] increasing default value for --time-sec to 10 because
--tor
 switch was provided
[16:46:18] [INFO] setting Tor SOCKS proxy settings
[16:46:18] [INFO] checking Tor connection
[16:46:22] [INFO] Tor is properly being used
[16:46:22] [INFO] testing connection to the target url
[16:46:22] [CRITICAL] unable to connect to the target url or proxy, sqlmap
is go
ing to retry the request
[16:46:22] [WARNING] please make sure that you have Tor installed and
running so
 you could successfully use --tor switch (e.g.
https://www.torproject.org/downlo
ad/download.html.en)
[16:46:23] [CRITICAL] unable to connect to the target url or proxy, sqlmap
is go
ing to retry the request
[16:46:24] [CRITICAL] unable to connect to the target url or proxy, sqlmap
is go
ing to retry the request
[16:46:25] [CRITICAL] unable to connect to the target url or proxy
it is not recommended to continue in this kind of cases. Do you want to
quit and
 make sure that everything is set up properly? [Y/n]

[*] shutting down at 16:46:29

----------------------
Tor gives me the following log message =>
 "Your application (using socks5 to port 8118) is giving Tor only an Ip
adress...."
"Rejectign SOCKS request for anonymous connection to private adress
[scrubbed]"
---------------------
privoxy config
listen-address  127.0.0.1:8118
forward-socks4a / localhost:9050 .
--------------------

any has a quick tip for me how to fix this issue ?

thanks in advance
hans

Re: [sqlmap-users] i think there may be a bug in "Oracle AND error-based - WHERE or HAVING clause (XMLType)" in sqlmap1.0-dev

[Miroslav S. <mir...@gm...>]

Hi.

Could you please send me privately traffic files got by -t traffic.txt
--technique=E --flush-session for both cases (run with v0.9 and v1.0-dev)?

Thing is that everything runs properly on local VM.

Kind regards,
Miroslav Stampar
On Dec 4, 2011 2:30 PM, "CoeTs7" <tm...@ho...> wrote:

>  when i test a injectable point, i found sqlmap0.9 can exploit while
> 1.0-dev(r4567) can not.
>
> 1.0-dev first send
>
> *testf') AND 3339=(SELECT
> UPPER(XMLType(CHR(60)||CHR(58)||CHR(116)||CHR(105)||CHR(102)||CHR(58)||(SELECT
> (CASE WHEN (3339=3339) THEN 1 ELSE 0 END) FROM
> DUAL)||CHR(58)||CHR(120)||CHR(110)||CHR(109)||CHR(58)||CHR(62))) FROM DUAL)
> AND ('QjCL'='QjCL*
>
> to see if the controllable part is in parentheses . the webpage return a
> "query Not properly closed" error.
> so it go on to send
>
> *testf' AND 3339=(SELECT
> UPPER(XMLType(CHR(60)||CHR(58)||CHR(116)||CHR(105)||CHR(102)||CHR(58)||(SELECT
> (CASE WHEN (3339=3339) THEN 1 ELSE 0 END) FROM
> DUAL)||CHR(58)||CHR(120)||CHR(110)||CHR(109)||CHR(58)||CHR(62))) FROM DUAL)
> AND 'ZCna'='ZCn*
>
> the webpage return a error page contained
>
> *ORA-19202: XML 处理
> LPX-00110: Warning: 无效的 QName ":tif:1:xnm:" (不是名称)
> Error at line 1*
>
> when receive this, sqlmap0.9 will tell that this is injectable( this is
> obvious) but sqlmap 1.0 exit and tell me that all parameters appear to be
> not injectable.  i tried to raise risk/level but that didn't work at all.
>
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>

[sqlmap-users] i think there may be a bug in "Oracle AND error-based - WHERE or HAVING clause (XMLType)" in sqlmap1.0-dev

[CoeTs7 <tm...@ho...>]

when i test a injectable point, i found sqlmap0.9 can exploit while 1.0-dev(r4567) can not.

1.0-dev first send 
testf') AND 3339=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(116)||CHR(105)||CHR(102)||CHR(58)||(SELECT (CASE WHEN (3339=3339) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(120)||CHR(110)||CHR(109)||CHR(58)||CHR(62))) FROM DUAL) AND ('QjCL'='QjCL
to see if the controllable part is in parentheses . the webpage return a "query Not properly closed" error.
so it go on to send 
testf' AND 3339=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(116)||CHR(105)||CHR(102)||CHR(58)||(SELECT (CASE WHEN (3339=3339) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(120)||CHR(110)||CHR(109)||CHR(58)||CHR(62))) FROM DUAL) AND 'ZCna'='ZCn

the webpage return a error page contained
ORA-19202: XML 处理
LPX-00110: Warning: 无效的 QName ":tif:1:xnm:" (不是名称)
Error at line 1

when receive this, sqlmap0.9 will tell that this is injectable( this is obvious) but sqlmap 1.0 exit and tell me that all parameters appear to be not injectable.  i tried to raise risk/level but that didn't work at all.

 		 	   		  

Re: [sqlmap-users] check this out

[Miroslav S. <mir...@gm...>]

Hi.

This and similar techniques are of no practical value in real life.

"Network latency" as the author has mentioned is something undeterministic
and in real life you can't just use some fixed predetermined calculated
value for it.

In real life either something is delayed or is not delayed. "Indexing" or
similar time-based techniques that are brought to life once in a month can
be implemented and tested on local, or some non-distant remote computer,
but anything than that is pure science fiction.

I'll repeat, network latency can't be calculated, it's undeterministic and
because of those hard facts the optimal and only real-life scenario for
time-based payloads is: A) something is delayed or B) something is not
delayed (<- this is also a very problematic to "distinguish", so everything
than that, I'll repeat, is pure SciFi)

Kind regards,
Miroslav Stampar

On Sat, Dec 3, 2011 at 6:40 PM, Adi Mutu <adi...@ya...> wrote:

> Hi guys,
>
> I haven't watched very closely sqlmap lately, but i wanted to show you
> this technique:
> http://seclists.org/fulldisclosure/2011/Dec/71
>
> What do you think? I don't think it's already in sqlmap, is it?
>
> Cheers,
> A.
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] check this out

[Adi M. <adi...@ya...>]

Hi guys,

I haven't watched very closely sqlmap lately, but i wanted to show you this technique:
http://seclists.org/fulldisclosure/2011/Dec/71


What do you think? I don't think it's already in sqlmap, is it?

Cheers,
A.

Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?

[zhen z. <zho...@gm...>]

i think use --sql-shell is better,  sqlmap is become bigger and bigger.

On Sat, Dec 3, 2011 at 2:06 AM, Miroslav Stampar <mir...@gm...
> wrote:

> Hi again.
>
> With the r4565 --seach support should be fixed for Oracle (like in your
> case).
>
> Kind regards,
> Miroslav Stampar
>
>
> On Fri, Dec 2, 2011 at 6:34 PM, Miroslav Stampar <
> mir...@gm...> wrote:
>
>> This is a Oracle specific problem. Have to see how to properly deal with
>> it.
>>
>> Kind regards
>>
>>
>> 2011/12/2 CoeTs7 <tm...@ho...>
>>
>>>  hi,
>>> thx for you reply, but  it doesn't seen to work that way on my box:
>>> # proxychains svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmapsqlmap-dev 2>/dev/null
>>> ProxyChains-3.1 (http://proxychains.sf.net)
>>> Checked out revision 4564.
>>> #./sqlmap.py -u 'http://xx.cfm' --data "xx=2&vLoginName=kahao" -p
>>> vLoginName --technique b --text-only  --suffix " -- s" --prefix="' or 1=1 "
>>> --string "<b>" --timeout 100  --proxy 'http://192.168.1.12:8080'  --search
>>> -D 'GVDBA' -C 'PASSWORD'
>>> ........omit..........
>>> do you want sqlmap to consider provided column(s):
>>> [1] as LIKE column names (default)
>>> [2] as exact column names
>>> >
>>> [06:29:01] [INFO] searching columns like 'PASSWORD'
>>> [06:29:01] [INFO] fetching number of tables containing columns like
>>> 'PASSWORD' in database 'USERS'
>>>
>>> i delete ./output/xxx.com and try this again, but it still run this
>>> way. anything wrong with my operation?
>>>
>>> ------------------------------
>>> Date: Fri, 2 Dec 2011 14:27:35 +0100
>>> Subject: Re: [sqlmap-users] how to search for column name in a specific
>>> database using '--search' ?
>>> From: mir...@gm...
>>> To: tm...@ho...
>>> CC: sql...@li...
>>>
>>> Hi.
>>>
>>> First of all you can't use '%PASSWORD%' if you want to search for
>>> identifiers LIKE 'PASSWORD'. In your case just put: -D authdb --search
>>> -C PASSWORD.
>>>
>>> With the last commit (r4563) there is an upgrade in --search mechanism
>>> that will more suite your needs.
>>>
>>> Now the lowest denominator dictates what is going to be searched. So:
>>> --search -D .. -T .. -C .. will search for column(s)
>>> --search -D .. -C .. will search for column(s)
>>> --search -D .. -T .. will search for table(s)
>>> --search -D ..  will search for db(s)
>>> ...
>>>
>>> Kind regards,
>>> Miroslav Stampar
>>>
>>> On Fri, Dec 2, 2011 at 1:50 PM, Miroslav Stampar <
>>> mir...@gm...> wrote:
>>>
>>> Hi.
>>>
>>> You are right. The lowest common denominator should be searched for with
>>> --search (in this case that's column). Going to modify it and report back.
>>>
>>> Kind regards,
>>> Miroslav Stampar
>>>
>>> 2011/12/2 CoeTs7 <tm...@ho...>
>>>
>>>  hi all. i'm wondering if there's a way to search for  column name in a
>>> specific database while using '--search' ?
>>> i've tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that
>>> i'm trying to search a database named "authdb" and a column named like
>>> 'password' . I am sure that the password i want to know is in the database
>>> 'authdb' so i don't want to waste time searching in other dbs.
>>> Is there any way i can do this?
>>> thx a lot.
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> All the data continuously generated in your IT infrastructure
>>> contains a definitive record of customers, application performance,
>>> security threats, fraudulent activity, and more. Splunk takes this
>>> data and makes sense of it. IT sense. And common sense.
>>> http://p.sf.net/sfu/splunk-novd2d
>>> _______________________________________________
>>> sqlmap-users mailing list
>>> sql...@li...
>>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>> http://about.me/stamparm
>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>> http://about.me/stamparm
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>> http://about.me/stamparm
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
zhouzhen

http:// <http://zhouzhenster.blogspot.com>www.6code.net

Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?

[Miroslav S. <mir...@gm...>]

Hi again.

With the r4565 --seach support should be fixed for Oracle (like in your
case).

Kind regards,
Miroslav Stampar

On Fri, Dec 2, 2011 at 6:34 PM, Miroslav Stampar <mir...@gm...
> wrote:

> This is a Oracle specific problem. Have to see how to properly deal with
> it.
>
> Kind regards
>
>
> 2011/12/2 CoeTs7 <tm...@ho...>
>
>>  hi,
>> thx for you reply, but  it doesn't seen to work that way on my box:
>> # proxychains svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmapsqlmap-dev 2>/dev/null
>> ProxyChains-3.1 (http://proxychains.sf.net)
>> Checked out revision 4564.
>> #./sqlmap.py -u 'http://xx.cfm' --data "xx=2&vLoginName=kahao" -p
>> vLoginName --technique b --text-only  --suffix " -- s" --prefix="' or 1=1 "
>> --string "<b>" --timeout 100  --proxy 'http://192.168.1.12:8080'  --search
>> -D 'GVDBA' -C 'PASSWORD'
>> ........omit..........
>> do you want sqlmap to consider provided column(s):
>> [1] as LIKE column names (default)
>> [2] as exact column names
>> >
>> [06:29:01] [INFO] searching columns like 'PASSWORD'
>> [06:29:01] [INFO] fetching number of tables containing columns like
>> 'PASSWORD' in database 'USERS'
>>
>> i delete ./output/xxx.com and try this again, but it still run this way.
>> anything wrong with my operation?
>>
>> ------------------------------
>> Date: Fri, 2 Dec 2011 14:27:35 +0100
>> Subject: Re: [sqlmap-users] how to search for column name in a specific
>> database using '--search' ?
>> From: mir...@gm...
>> To: tm...@ho...
>> CC: sql...@li...
>>
>> Hi.
>>
>> First of all you can't use '%PASSWORD%' if you want to search for
>> identifiers LIKE 'PASSWORD'. In your case just put: -D authdb --search
>> -C PASSWORD.
>>
>> With the last commit (r4563) there is an upgrade in --search mechanism
>> that will more suite your needs.
>>
>> Now the lowest denominator dictates what is going to be searched. So:
>> --search -D .. -T .. -C .. will search for column(s)
>> --search -D .. -C .. will search for column(s)
>> --search -D .. -T .. will search for table(s)
>> --search -D ..  will search for db(s)
>> ...
>>
>> Kind regards,
>> Miroslav Stampar
>>
>> On Fri, Dec 2, 2011 at 1:50 PM, Miroslav Stampar <
>> mir...@gm...> wrote:
>>
>> Hi.
>>
>> You are right. The lowest common denominator should be searched for with
>> --search (in this case that's column). Going to modify it and report back.
>>
>> Kind regards,
>> Miroslav Stampar
>>
>> 2011/12/2 CoeTs7 <tm...@ho...>
>>
>>  hi all. i'm wondering if there's a way to search for  column name in a
>> specific database while using '--search' ?
>> i've tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that
>> i'm trying to search a database named "authdb" and a column named like
>> 'password' . I am sure that the password i want to know is in the database
>> 'authdb' so i don't want to waste time searching in other dbs.
>> Is there any way i can do this?
>> thx a lot.
>>
>>
>> ------------------------------------------------------------------------------
>> All the data continuously generated in your IT infrastructure
>> contains a definitive record of customers, application performance,
>> security threats, fraudulent activity, and more. Splunk takes this
>> data and makes sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-novd2d
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>>
>>
>> --
>> Miroslav Stampar
>> http://about.me/stamparm
>>
>>
>>
>>
>> --
>> Miroslav Stampar
>> http://about.me/stamparm
>>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?

[Miroslav S. <mir...@gm...>]

This is a Oracle specific problem. Have to see how to properly deal with it.

Kind regards

2011/12/2 CoeTs7 <tm...@ho...>

>  hi,
> thx for you reply, but  it doesn't seen to work that way on my box:
> # proxychains svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmapsqlmap-dev 2>/dev/null
> ProxyChains-3.1 (http://proxychains.sf.net)
> Checked out revision 4564.
> #./sqlmap.py -u 'http://xx.cfm' --data "xx=2&vLoginName=kahao" -p
> vLoginName --technique b --text-only  --suffix " -- s" --prefix="' or 1=1 "
> --string "<b>" --timeout 100  --proxy 'http://192.168.1.12:8080'  --search
> -D 'GVDBA' -C 'PASSWORD'
> ........omit..........
> do you want sqlmap to consider provided column(s):
> [1] as LIKE column names (default)
> [2] as exact column names
> >
> [06:29:01] [INFO] searching columns like 'PASSWORD'
> [06:29:01] [INFO] fetching number of tables containing columns like
> 'PASSWORD' in database 'USERS'
>
> i delete ./output/xxx.com and try this again, but it still run this way.
> anything wrong with my operation?
>
> ------------------------------
> Date: Fri, 2 Dec 2011 14:27:35 +0100
> Subject: Re: [sqlmap-users] how to search for column name in a specific
> database using '--search' ?
> From: mir...@gm...
> To: tm...@ho...
> CC: sql...@li...
>
> Hi.
>
> First of all you can't use '%PASSWORD%' if you want to search for
> identifiers LIKE 'PASSWORD'. In your case just put: -D authdb --search -C
> PASSWORD.
>
> With the last commit (r4563) there is an upgrade in --search mechanism
> that will more suite your needs.
>
> Now the lowest denominator dictates what is going to be searched. So:
> --search -D .. -T .. -C .. will search for column(s)
> --search -D .. -C .. will search for column(s)
> --search -D .. -T .. will search for table(s)
> --search -D ..  will search for db(s)
> ...
>
> Kind regards,
> Miroslav Stampar
>
> On Fri, Dec 2, 2011 at 1:50 PM, Miroslav Stampar <
> mir...@gm...> wrote:
>
> Hi.
>
> You are right. The lowest common denominator should be searched for with
> --search (in this case that's column). Going to modify it and report back.
>
> Kind regards,
> Miroslav Stampar
>
> 2011/12/2 CoeTs7 <tm...@ho...>
>
>  hi all. i'm wondering if there's a way to search for  column name in a
> specific database while using '--search' ?
> i've tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that i'm
> trying to search a database named "authdb" and a column named like
> 'password' . I am sure that the password i want to know is in the database
> 'authdb' so i don't want to waste time searching in other dbs.
> Is there any way i can do this?
> thx a lot.
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>
>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?

[CoeTs7 <tm...@ho...>]

hi,
thx for you reply, but  it doesn't seen to work that way on my box: 
# proxychains svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev 2>/dev/null
ProxyChains-3.1 (http://proxychains.sf.net)
Checked out revision 4564.
#./sqlmap.py
 -u 'http://xx.cfm' --data "xx=2&vLoginName=kahao" -p vLoginName 
--technique b --text-only  --suffix " -- s" --prefix="' or 1=1 " 
--string "<b>" --timeout 100  --proxy 'http://192.168.1.12:8080'  --search -D 'GVDBA' -C 'PASSWORD'
........omit..........
do you want sqlmap to consider provided column(s):
[1] as LIKE column names (default)
[2] as exact column names
> 
[06:29:01] [INFO] searching columns like 'PASSWORD'
[06:29:01] [INFO] fetching number of tables containing columns like 'PASSWORD' in database 'USERS'

i delete ./output/xxx.com and try this again, but it still run this way. anything wrong with my operation?

Date: Fri, 2 Dec 2011 14:27:35 +0100
Subject: Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?
From: mir...@gm...
To: tm...@ho...
CC: sql...@li...

Hi.
First of all you can't use '%PASSWORD%' if you want to search for identifiers LIKE 'PASSWORD'. In your case just put: -D authdb --search -C PASSWORD.

With the last commit (r4563) there is an upgrade in --search mechanism that will more suite your needs.
Now the lowest denominator dictates what is going to be searched. So:
--search -D .. -T .. -C .. will search for column(s)--search -D .. -C .. will search for column(s)--search -D .. -T .. will search for table(s)--search -D ..  will search for db(s)
...
Kind regards,Miroslav Stampar
On Fri, Dec 2, 2011 at 1:50 PM, Miroslav Stampar <mir...@gm...> wrote:

Hi.
You are right. The lowest common denominator should be searched for with --search (in this case that's column). Going to modify it and report back.

Kind regards,
Miroslav Stampar

2011/12/2 CoeTs7 <tm...@ho...>







hi all. i'm wondering if there's a way to search for  column name in a specific database while using '--search' ?
i've
 tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that i'm 
trying to search a database named "authdb" and a column named like 
'password' . I am sure that the password i want to know is in the 
database 'authdb' so i don't want to waste time searching in other dbs.
Is there any way i can do this? 
thx a lot. 		 	   		  

------------------------------------------------------------------------------

All the data continuously generated in your IT infrastructure

contains a definitive record of customers, application performance,

security threats, fraudulent activity, and more. Splunk takes this

data and makes sense of it. IT sense. And common sense.

http://p.sf.net/sfu/splunk-novd2d
_______________________________________________

sqlmap-users mailing list

sql...@li...

https://lists.sourceforge.net/lists/listinfo/sqlmap-users




-- 
Miroslav Stampar
http://about.me/stamparm




-- 
Miroslav Stampar
http://about.me/stamparm

 		 	   		  

Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?

[Miroslav S. <mir...@gm...>]

Hi.

First of all you can't use '%PASSWORD%' if you want to search for
identifiers LIKE 'PASSWORD'. In your case just put: -D authdb --search -C
PASSWORD.

With the last commit (r4563) there is an upgrade in --search mechanism that
will more suite your needs.

Now the lowest denominator dictates what is going to be searched. So:
--search -D .. -T .. -C .. will search for column(s)
--search -D .. -C .. will search for column(s)
--search -D .. -T .. will search for table(s)
--search -D ..  will search for db(s)
...

Kind regards,
Miroslav Stampar

On Fri, Dec 2, 2011 at 1:50 PM, Miroslav Stampar <mir...@gm...
> wrote:

> Hi.
>
> You are right. The lowest common denominator should be searched for with
> --search (in this case that's column). Going to modify it and report back.
>
> Kind regards,
> Miroslav Stampar
>
> 2011/12/2 CoeTs7 <tm...@ho...>
>
>>  hi all. i'm wondering if there's a way to search for  column name in a
>> specific database while using '--search' ?
>> i've tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that
>> i'm trying to search a database named "authdb" and a column named like
>> 'password' . I am sure that the password i want to know is in the database
>> 'authdb' so i don't want to waste time searching in other dbs.
>> Is there any way i can do this?
>> thx a lot.
>>
>>
>> ------------------------------------------------------------------------------
>> All the data continuously generated in your IT infrastructure
>> contains a definitive record of customers, application performance,
>> security threats, fraudulent activity, and more. Splunk takes this
>> data and makes sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-novd2d
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] how to search for column name in a specific database using '--search' ?

[Miroslav S. <mir...@gm...>]

Hi.

You are right. The lowest common denominator should be searched for with
--search (in this case that's column). Going to modify it and report back.

Kind regards,
Miroslav Stampar

2011/12/2 CoeTs7 <tm...@ho...>

>  hi all. i'm wondering if there's a way to search for  column name in a
> specific database while using '--search' ?
> i've tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that i'm
> trying to search a database named "authdb" and a column named like
> 'password' . I am sure that the password i want to know is in the database
> 'authdb' so i don't want to waste time searching in other dbs.
> Is there any way i can do this?
> thx a lot.
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] how to search for column name in a specific database using '--search' ?

[CoeTs7 <tm...@ho...>]

hi all. i'm wondering if there's a way to search for  column name in a specific database while using '--search' ?
i've
 tried '-D authdb --search -C "%PASSWORD%"'  but sqlmap think that i'm 
trying to search a database named "authdb" and a column named like 
'password' . I am sure that the password i want to know is in the 
database 'authdb' so i don't want to waste time searching in other dbs.
Is there any way i can do this? 
thx a lot. 		 	   		  

Re: [sqlmap-users] Dump delimiter

[Miroslav S. <mir...@gm...>]

Hi again.

With the latest commit (r4559) for your case you can use --csv-del="\t"

Kind regards,
Miroslav Stampar

On Wed, Nov 30, 2011 at 6:32 PM, Miroslav Stampar <
mir...@gm...> wrote:

> Hi Ad.
>
> With the latest commit (r4557) there is a switch --csv-del where you'll be
> able to set yourself the CSV delimiting character (default is ofcourse ",")
>
> As of "sanitization of delimiter" there is such mechanism in sqlmap for
> sure. There was a request for this few times till now and it's implemented
> inside the current version for quite some time. Are you using latest
> v1.0-dev?
>
> It's sanitized as described here: http://tools.ietf.org/html/rfc4180
>
> Kind regards,
> Miroslav Stampar
>
> On Wed, Nov 30, 2011 at 2:52 PM, Ad <fak...@gm...> wrote:
>
>> How can I change the column delimiter from comma to tab? Another thing,
>> there is no sanitization of the delimiter? Example: If the delimiter is ','
>> and the dump data contain ',', this character should somehow be sanitized,
>> not to be construed as a delimiter, right?
>>
>> Regards,
>>
>> Ad.
>>
>>
>> ------------------------------------------------------------------------------
>> All the data continuously generated in your IT infrastructure
>> contains a definitive record of customers, application performance,
>> security threats, fraudulent activity, and more. Splunk takes this
>> data and makes sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-novd2d
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Miroslav Stampar
> http://about.me/stamparm
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] Dump delimiter

[Miroslav S. <mir...@gm...>]

Hi Ad.

With the latest commit (r4557) there is a switch --csv-del where you'll be
able to set yourself the CSV delimiting character (default is ofcourse ",")

As of "sanitization of delimiter" there is such mechanism in sqlmap for
sure. There was a request for this few times till now and it's implemented
inside the current version for quite some time. Are you using latest
v1.0-dev?

It's sanitized as described here: http://tools.ietf.org/html/rfc4180

Kind regards,
Miroslav Stampar

On Wed, Nov 30, 2011 at 2:52 PM, Ad <fak...@gm...> wrote:

> How can I change the column delimiter from comma to tab? Another thing,
> there is no sanitization of the delimiter? Example: If the delimiter is ','
> and the dump data contain ',', this character should somehow be sanitized,
> not to be construed as a delimiter, right?
>
> Regards,
>
> Ad.
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Dump delimiter

[Ad <fak...@gm...>]

How can I change the column delimiter from comma to tab? Another thing,
there is no sanitization of the delimiter? Example: If the delimiter is ','
and the dump data contain ',', this character should somehow be sanitized,
not to be construed as a delimiter, right?

Regards,

Ad.

Re: [sqlmap-users] Unusual URL Syntax

[Bernardo D. A. G. <ber...@gm...>]

Hi Chris,
Append an asterisk where you want sqlmap to inject. For
instance:http://www.example.co.uk/blah/blah.php/foo=bar*&bar=foo*
Bernardo
On 30 November 2011 11:20, Chris Oakley <chr...@gm...> wrote:
> Hi All
>
> I have a URL that looks like this:
>
> http://www.example.co.uk/blah/blah.php/foo=bar&bar=foo
>
> Because of the unusual syntax, sqlmap tells me that there are no GET or POST
> parameters to be tested.  Is there a way around this?
>
> Regards
>
> Chris
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: Unavailable

[sqlmap-users] Unusual URL Syntax

[Chris O. <chr...@gm...>]

Hi All

I have a URL that looks like this:

http://www.example.co.uk/blah/blah.php/foo=bar&bar=foo


Because of the unusual syntax, sqlmap tells me that there are no GET or
POST parameters to be tested.  Is there a way around this?


Regards


Chris

Re: [sqlmap-users] general socks server failure (tunk r4552)

[Miroslav S. <mir...@gm...>]

Hi.

Have you tried like this:
--sql-query="bla bla 'quoted' bla bla"

Kind regards

On Mon, Nov 28, 2011 at 11:14 PM, Iago Sousa <146...@gm...> wrote:

> You can add quote mark in sql-query
>
> On Mon, Nov 28, 2011 at 3:29 PM, Jacco van Tuijl <jac...@gm...>wrote:
>
>> [13:27:26] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4552),
>> retry your run with the latest development version from the Subversion
>> repository. If the exception persists, please send by e-mail to
>> sql...@li... the following text and any
>> information required to reproduce the bug. The developers will try to
>> reproduce the bug, fix it accordingly and get back to you.
>> sqlmap version: 1.0-dev (r4552)
>> Python version: 2.6.5
>> Operating system: posix
>> Command line: sqlmap.py -u *********************************************
>> --tor --random-agent --exclude-sysdb --dbms=mysql --level=5 --risk=5
>> --technique=B -o --sql-query=select name,password from abc_user
>> Technique: BOOLEAN
>> Back-end DBMS: MySQL (identified)
>> Traceback (most recent call last):
>>   File "/pentest/database/sqlmap/sqlmap/_sqlmap.py", line 86, in main
>>     start()
>>   File "/pentest/database/sqlmap/sqlmap/lib/controller/controller.py",
>> line 478, in start
>>     injection = checkSqlInjection(place, parameter, value)
>>   File "/pentest/database/sqlmap/sqlmap/lib/controller/checks.py", line
>> 344, in checkSqlInjection
>>     trueResult = Request.queryPage(reqPayload, place, raise404=False)
>>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line
>> 709, in queryPage
>>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
>> cookie=cookie, ua=ua, referer=referer, silent=silent, method=method,
>> auxHeaders=auxHeaders, response=response, raise404=raise404,
>> ignoreTimeout=timeBasedCompare)
>>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line
>> 301, in getPage
>>     conn = urllib2.urlopen(req)
>>   File "/usr/lib/python2.6/urllib2.py", line 126, in urlopen
>>     return _opener.open(url, data, timeout)
>>   File "/usr/lib/python2.6/urllib2.py", line 391, in open
>>     response = self._open(req, data)
>>   File "/usr/lib/python2.6/urllib2.py", line 409, in _open
>>     '_open', req)
>>   File "/usr/lib/python2.6/urllib2.py", line 369, in _call_chain
>>     result = func(*args)
>>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
>> line 209, in http_open
>>     return self.do_open(HTTPConnection, req)
>>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
>> line 182, in do_open
>>     self._start_connection(h, req)
>>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
>> line 141, in _start_connection
>>     h.endheaders()
>>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
>> line 336, in endheaders
>>     self._send_output()
>>   File "/usr/lib/python2.6/httplib.py", line 776, in _send_output
>>     self.send(msg)
>>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
>> line 339, in send
>>     httplib.HTTPConnection.send(self, unicodeencode(str, kb.pageEncoding))
>>   File "/usr/lib/python2.6/httplib.py", line 735, in send
>>     self.connect()
>>   File "/usr/lib/python2.6/httplib.py", line 716, in connect
>>     self.timeout)
>>   File "/usr/lib/python2.6/socket.py", line 507, in create_connection
>>     sock.connect(sa)
>>   File "/pentest/database/sqlmap/sqlmap/extra/socks/socks.py", line 369,
>> in connect
>>     self.__negotiatesocks5(destpair[0], destpair[1])
>>   File "/pentest/database/sqlmap/sqlmap/extra/socks/socks.py", line 236,
>> in __negotiatesocks5
>>     raise Socks5Error((ord(resp[1:2]), _socks5errors[ord(resp[1:2])]))
>> Socks5Error: (1, 'general SOCKS server failure')
>>
>>
>> ------------------------------------------------------------------------------
>> All the data continuously generated in your IT infrastructure
>> contains a definitive record of customers, application performance,
>> security threats, fraudulent activity, and more. Splunk takes this
>> data and makes sense of it. IT sense. And common sense.
>> http://p.sf.net/sfu/splunk-novd2d
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>>
>
>
> --
> Iago Sousa
>
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] general socks server failure (tunk r4552)

[Miroslav S. <mir...@gm...>]

Hi Jacco.

Thank you for your report. It should be fixed now.

Kind regards

p.s. if you see any other connection problem regarding this case please
contact me privately

On Mon, Nov 28, 2011 at 7:29 PM, Jacco van Tuijl <jac...@gm...>wrote:

> [13:27:26] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4552), retry
> your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the
> bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4552)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py -u *********************************************
> --tor --random-agent --exclude-sysdb --dbms=mysql --level=5 --risk=5
> --technique=B -o --sql-query=select name,password from abc_user
> Technique: BOOLEAN
> Back-end DBMS: MySQL (identified)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/sqlmap/_sqlmap.py", line 86, in main
>     start()
>   File "/pentest/database/sqlmap/sqlmap/lib/controller/controller.py",
> line 478, in start
>     injection = checkSqlInjection(place, parameter, value)
>   File "/pentest/database/sqlmap/sqlmap/lib/controller/checks.py", line
> 344, in checkSqlInjection
>     trueResult = Request.queryPage(reqPayload, place, raise404=False)
>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line 709,
> in queryPage
>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
> cookie=cookie, ua=ua, referer=referer, silent=silent, method=method,
> auxHeaders=auxHeaders, response=response, raise404=raise404,
> ignoreTimeout=timeBasedCompare)
>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line 301,
> in getPage
>     conn = urllib2.urlopen(req)
>   File "/usr/lib/python2.6/urllib2.py", line 126, in urlopen
>     return _opener.open(url, data, timeout)
>   File "/usr/lib/python2.6/urllib2.py", line 391, in open
>     response = self._open(req, data)
>   File "/usr/lib/python2.6/urllib2.py", line 409, in _open
>     '_open', req)
>   File "/usr/lib/python2.6/urllib2.py", line 369, in _call_chain
>     result = func(*args)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 209, in http_open
>     return self.do_open(HTTPConnection, req)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 182, in do_open
>     self._start_connection(h, req)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 141, in _start_connection
>     h.endheaders()
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 336, in endheaders
>     self._send_output()
>   File "/usr/lib/python2.6/httplib.py", line 776, in _send_output
>     self.send(msg)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 339, in send
>     httplib.HTTPConnection.send(self, unicodeencode(str, kb.pageEncoding))
>   File "/usr/lib/python2.6/httplib.py", line 735, in send
>     self.connect()
>   File "/usr/lib/python2.6/httplib.py", line 716, in connect
>     self.timeout)
>   File "/usr/lib/python2.6/socket.py", line 507, in create_connection
>     sock.connect(sa)
>   File "/pentest/database/sqlmap/sqlmap/extra/socks/socks.py", line 369,
> in connect
>     self.__negotiatesocks5(destpair[0], destpair[1])
>   File "/pentest/database/sqlmap/sqlmap/extra/socks/socks.py", line 236,
> in __negotiatesocks5
>     raise Socks5Error((ord(resp[1:2]), _socks5errors[ord(resp[1:2])]))
> Socks5Error: (1, 'general SOCKS server failure')
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] general socks server failure (tunk r4552)

[Iago S. <146...@gm...>]

You can add quote mark in sql-query

On Mon, Nov 28, 2011 at 3:29 PM, Jacco van Tuijl <jac...@gm...>wrote:

> [13:27:26] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4552), retry
> your run with the latest development version from the Subversion
> repository. If the exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the
> bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4552)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py -u *********************************************
> --tor --random-agent --exclude-sysdb --dbms=mysql --level=5 --risk=5
> --technique=B -o --sql-query=select name,password from abc_user
> Technique: BOOLEAN
> Back-end DBMS: MySQL (identified)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/sqlmap/_sqlmap.py", line 86, in main
>     start()
>   File "/pentest/database/sqlmap/sqlmap/lib/controller/controller.py",
> line 478, in start
>     injection = checkSqlInjection(place, parameter, value)
>   File "/pentest/database/sqlmap/sqlmap/lib/controller/checks.py", line
> 344, in checkSqlInjection
>     trueResult = Request.queryPage(reqPayload, place, raise404=False)
>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line 709,
> in queryPage
>     page, headers, code = Connect.getPage(url=uri, get=get, post=post,
> cookie=cookie, ua=ua, referer=referer, silent=silent, method=method,
> auxHeaders=auxHeaders, response=response, raise404=raise404,
> ignoreTimeout=timeBasedCompare)
>   File "/pentest/database/sqlmap/sqlmap/lib/request/connect.py", line 301,
> in getPage
>     conn = urllib2.urlopen(req)
>   File "/usr/lib/python2.6/urllib2.py", line 126, in urlopen
>     return _opener.open(url, data, timeout)
>   File "/usr/lib/python2.6/urllib2.py", line 391, in open
>     response = self._open(req, data)
>   File "/usr/lib/python2.6/urllib2.py", line 409, in _open
>     '_open', req)
>   File "/usr/lib/python2.6/urllib2.py", line 369, in _call_chain
>     result = func(*args)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 209, in http_open
>     return self.do_open(HTTPConnection, req)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 182, in do_open
>     self._start_connection(h, req)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 141, in _start_connection
>     h.endheaders()
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 336, in endheaders
>     self._send_output()
>   File "/usr/lib/python2.6/httplib.py", line 776, in _send_output
>     self.send(msg)
>   File "/pentest/database/sqlmap/sqlmap/extra/keepalive/keepalive.py",
> line 339, in send
>     httplib.HTTPConnection.send(self, unicodeencode(str, kb.pageEncoding))
>   File "/usr/lib/python2.6/httplib.py", line 735, in send
>     self.connect()
>   File "/usr/lib/python2.6/httplib.py", line 716, in connect
>     self.timeout)
>   File "/usr/lib/python2.6/socket.py", line 507, in create_connection
>     sock.connect(sa)
>   File "/pentest/database/sqlmap/sqlmap/extra/socks/socks.py", line 369,
> in connect
>     self.__negotiatesocks5(destpair[0], destpair[1])
>   File "/pentest/database/sqlmap/sqlmap/extra/socks/socks.py", line 236,
> in __negotiatesocks5
>     raise Socks5Error((ord(resp[1:2]), _socks5errors[ord(resp[1:2])]))
> Socks5Error: (1, 'general SOCKS server failure')
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure
> contains a definitive record of customers, application performance,
> security threats, fraudulent activity, and more. Splunk takes this
> data and makes sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-novd2d
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
Iago Sousa