sqlmap-users — sqlmap users mailing list

[sqlmap-users] Multipart POST requests

[Paule P. <ko...@gm...>]

Hello list!

First off: Thanks for the great tool!

I'm trying to run sqlmap on a multipart/form-data POST request which I'm passing to the tool with the '-l' option. I was using the 0.9 packaged version, which didn't work at all, then checked out yesterdays dev-version and retried. This time sqlmap ran its tests against the request's first parameter and then stopped, stating that no parameter is injectable.

Is it currently supported to inject multipart POST requests and I'm doing something wrong, or is this a bug? Thanks in advance!

Cheers,
Dennis
-- 
NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!		
Jetzt informieren: http://www.gmx.net/de/go/freephone

Re: [sqlmap-users] 0.9 vs 1.0 r4395 - Injection point lost ?

[Miroslav S. <mir...@gm...>]

Hi Kafeine.

Thing is that we here and there put some "new attribute" into stored
injection info making it (unfortunately) unusable in later revisions,
but this is the point of "development". Nobody is forced to use "dev"
revision as there will be constantly things like this one :(

In your case it would be good if you could contact me privately with
the further details so we could somehow "fix" (if there is something
to fix) the latest "dev" revision to find the injection point too.

Kind regards,
Miroslav Stampar

On Fri, Oct 7, 2011 at 3:02 AM, Kafeine <sq...@hu...> wrote:
> Hello all,
> I used Sqlmap (sourceforge file 0.9) to test a lab botnet C&C control panel
> page.
> Sqlmap found an injection.
> [09:30:15] [INFO] testing connection to the target url
> sqlmap identified the following injection points with a total of 10993
> HTTP(s) requests:
> ---
> Place: Referer
> Parameter: Referer
>     Type: boolean-based blind
>     Title: AND boolean-based blind - WHERE or HAVING clause
>     Payload: http://192.168.186.166:80/mypage.php) AND 1234=1234
> ---
> I was not able to send a payload file on the server, after trying to create
> a writeable folder, etc.., i checked related problem on internet.
> Look like sqlmap saw a Linux where it was a windows (even when i forced
> --os="Windows") I read that this was an issue that was solved... i updated
> to SVN version. 1.0 r4395
> After that the session was not usable anymore...so i run the scan again from
> scratch and it look like it can't find this injection point anymore.
> How is this possible ?
> How can i make it find/validate this injection again ?
> Regards
> (sorry for my english...)
> Kafeine
>
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2dcopy2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] 0.9 vs 1.0 r4395 - Injection point lost ?

[Kafeine <sq...@hu...>]

Hello all,

I used Sqlmap (sourceforge file 0.9) to test a lab botnet C&C control panel
page.
Sqlmap found an injection.

[09:30:15] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 10993
HTTP(s) requests:
---
Place: Referer
Parameter: Referer
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://192.168.186.166:80/mypage.php) AND 1234=1234
---

I was not able to send a payload file on the server, after trying to create
a writeable folder, etc.., i checked related problem on internet.
Look like sqlmap saw a Linux where it was a windows (even when i forced
--os="Windows") I read that this was an issue that was solved... i updated
to SVN version. 1.0 r4395

After that the session was not usable anymore...so i run the scan again from
scratch and it look like it can't find this injection point anymore.
How is this possible ?
How can i make it find/validate this injection again ?

Regards
(sorry for my english...)

Kafeine

Re: [sqlmap-users] Semicolon in URL

[Miroslav S. <mir...@gm...>]

Hi Anastasios.

As ";" (semicolon) is not a standard character used for splitting
parameter values inside GET string (there could be ambiguities in case
of containment of both characters & and ;), introduction of explicit
option was needed.

Good thing is that there was already a parameter named --cookie-del,
and now with the latest commit it was upgraded to a more generic form
(--param-del).

Hence, in your case, you should be able to "deal" with your case by
using --param-del=";".

Kind regards,
Miroslav Stampar

On Thu, Oct 6, 2011 at 8:24 AM, Anastasios Monachos
<ana...@gm...> wrote:
> Hello guys, recently came accross the following
>
> $ ./sqlmap.py -u
> "http://site/cgi-bin/abc.cgi?action=view_a;id=18;aid=1" -p aid
> --dbms=mysql --is-dba
>
>    sqlmap/1.0-dev (r4395) - automatic SQL injection and database takeover tool
>    http://www.sqlmap.org
>
> [!] legal disclaimer: usage of sqlmap for attacking targets without
> prior mutual consent is illegal. It is the end user's responsibility
> to obey all applicable local, state and federal laws. Authors assume
> no liability and are not responsible for any misuse or damage caused
> by this program
>
> [*] starting at 04:12:54
>
> [04:12:54] [WARNING] the testable parameter 'aid' you provided is not
> inside the GET
> [04:12:54] [CRITICAL] all testable parameters you provided are not
> present within the GET, POST and Cookie parameters
>
> [*] shutting down at 04:12:54
>
>
> sqlmap executed successfully when substituted ";" with "&":
>
> $ ./sqlmap.py -u
> "http://site/cgi-bin/abc.cgi?action=view_a&id=18&aid=1" -p aid
> --dbms=mysql --is-dba
>
>
> Trust you will fix this :)
> thanks
>
>
> --
> AM (secuid0)
> Key ID: 0x5EB17EE7
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Semicolon in URL

[Anastasios M. <ana...@gm...>]

Hello guys, recently came accross the following

$ ./sqlmap.py -u
"http://site/cgi-bin/abc.cgi?action=view_a;id=18;aid=1" -p aid
--dbms=mysql --is-dba

    sqlmap/1.0-dev (r4395) - automatic SQL injection and database takeover tool
    http://www.sqlmap.org

[!] legal disclaimer: usage of sqlmap for attacking targets without
prior mutual consent is illegal. It is the end user's responsibility
to obey all applicable local, state and federal laws. Authors assume
no liability and are not responsible for any misuse or damage caused
by this program

[*] starting at 04:12:54

[04:12:54] [WARNING] the testable parameter 'aid' you provided is not
inside the GET
[04:12:54] [CRITICAL] all testable parameters you provided are not
present within the GET, POST and Cookie parameters

[*] shutting down at 04:12:54


sqlmap executed successfully when substituted ";" with "&":

$ ./sqlmap.py -u
"http://site/cgi-bin/abc.cgi?action=view_a&id=18&aid=1" -p aid
--dbms=mysql --is-dba


Trust you will fix this :)
thanks


-- 
AM (secuid0)
Key ID: 0x5EB17EE7

Re: [sqlmap-users] is this really exploitable?

[Adi M. <adi...@ya...>]

Hi Miroslav,

Thanks for taking a look. I looked deeper, to where the start variable is actually used and i couldn't see any vulnerability....

Thanks,
A.


________________________________
From: Miroslav Stampar <mir...@gm...>
To: Adi Mutu <adi...@ya...>
Cc: "sql...@li..." <sql...@li...>
Sent: Thursday, September 29, 2011 12:51 AM
Subject: Re: [sqlmap-users] is this really exploitable?

hi Adi.

you are basically right from my point of view.

just went through source code for v1.1.12 which should be vulnerable:
http://mirror.ord.simplemachines.org/downloads/smf_1-1-12_install.zip

and the official patch mentioned in that report:
http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip

they've put some extra ("just in case") filtering, but from that
patch, source code of the "should be vulnerable version" and the info
from report ("...related to the cleanRequest function in
QueryString.php and the constructPageIndex function in Subs.php...")
there is nothing SQLi vulnerable related there.

these are just my observations related to the report. won't go into
detailed review of the whole code as it's tl;dr :)

kind regards,
Miroslav Stampar

On Wed, Sep 28, 2011 at 8:13 PM, Adi Mutu <adi...@ya...> wrote:
> Hello,
> probably this is not the type of questions you get, but i  was just curious
> if anybody has encounterd this before:
> http://www.cvedetails.com/cve/CVE-2011-1130/
>
> it's suppose to be an sql injection in SMF 1.1.13 and bellow.....i'm looking
> at the source code of the forum and i don't see this as being exploitable.
> Anybody ever exploited this?
> Thanks,
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar
http://about.me/stamparm

Re: [sqlmap-users] is this really exploitable?

[Miroslav S. <mir...@gm...>]

hi Adi.

you are basically right from my point of view.

just went through source code for v1.1.12 which should be vulnerable:
http://mirror.ord.simplemachines.org/downloads/smf_1-1-12_install.zip

and the official patch mentioned in that report:
http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip

they've put some extra ("just in case") filtering, but from that
patch, source code of the "should be vulnerable version" and the info
from report ("...related to the cleanRequest function in
QueryString.php and the constructPageIndex function in Subs.php...")
there is nothing SQLi vulnerable related there.

these are just my observations related to the report. won't go into
detailed review of the whole code as it's tl;dr :)

kind regards,
Miroslav Stampar

On Wed, Sep 28, 2011 at 8:13 PM, Adi Mutu <adi...@ya...> wrote:
> Hello,
> probably this is not the type of questions you get, but i  was just curious
> if anybody has encounterd this before:
> http://www.cvedetails.com/cve/CVE-2011-1130/
>
> it's suppose to be an sql injection in SMF 1.1.13 and bellow.....i'm looking
> at the source code of the forum and i don't see this as being exploitable.
> Anybody ever exploited this?
> Thanks,
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] is this really exploitable?

[Adi M. <adi...@ya...>]

Hello,

probably this is not the type of questions you get, but i  was just curious if anybody has encounterd this before:

http://www.cvedetails.com/cve/CVE-2011-1130/


it's suppose to be an sql injection in SMF 1.1.13 and bellow.....i'm looking at the source code of the forum and i don't see this as being exploitable.
Anybody ever exploited this?

Thanks,

[sqlmap-users] oracle problem

[m K. <jet...@ya...>]

using sql map on windows testing an oracle db, it cant dump anything with @ in it like an email, i tested the same db with witool and it finds it fine, tested in the browser it finds it fine but when trying to dump with sqlmap it produces 'none'. its updated to the latest version using tortoise svn too.

thanks

[sqlmap-users] UNION disabled

[null 0. <etc...@gm...>]

Hi,

I'm checking that sqlmap can't work with this injection, or maybe I can't
see the correct option.

Injection is like this:

Original URL:
http://10.0.17.252/stat.php?id=534&key=a4d80eac9ab26a4a2da04125bc2c096a

Injection:
http://10.0.17.252/stat.php?id=534' AND
'1'='1&key=a4d80eac9ab26a4a2da04125bc2c096a

The problem is that mysql user can't run UNION SELECT, so if I run sqlmap
detect injection but shows nothing.

Maybe is a good idea implement a bruteforce attack to retrieve columns.

Example:
http://10.0.17.252/stat.php?id=534' AND `name` LIKE
'%&key=a4d80eac9ab26a4a2da04125bc2c096a => Shows normal page, then `name`
columns exist.
http://10.0.17.252/stat.php?id=534' AND `name2` LIKE
'%&key=a4d80eac9ab26a4a2da04125bc2c096a => Shows "Wrong query", so this
columns don't exist.

I tried with --common-columns, but needs the name of the table, and we don't
know this value.

It's only a idea.

Thanks for all.

Re: [sqlmap-users] Error

[Miroslav S. <mir...@gm...>]

hi Olu.

thank you for your report and find it fixed in the latest commit.

kind regards,
Miroslav Stampar

On Sat, Sep 24, 2011 at 10:14 PM, Oluseyi Akindeinde
<sey...@gm...> wrote:
> Hi,
>
> Just received this error trying to dump a sybase db.
>
> 21:13:02] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4384), retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r4384)
> Python version: 2.7.1
> Operating system: posix
> Command line: ./sqlmap.py -u ************************************************************** -D ********* -T USER -C ***************************************** --text-only --dbms=sybase --batch --parse-errors --threads=10 --start=1 --stop=10 --dump
> Technique: ERROR
> Back-end DBMS: Sybase (fingerprinted)
> Traceback (most recent call last):
>  File "/Users/fx0ne/sqlmap/_sqlmap.py", line 86, in main
>    start()
>  File "/Users/fx0ne/sqlmap/lib/controller/controller.py", line 577, in start
>    action()
>  File "/Users/fx0ne/sqlmap/lib/controller/action.py", line 109, in action
>    conf.dbmsHandler.dumpTable()
>  File "/Users/fx0ne/sqlmap/plugins/generic/enumeration.py", line 1611, in dumpTable
>    retVal = self.__pivotDumpTable(table, colList, blind=False)
>  File "/Users/fx0ne/sqlmap/plugins/generic/enumeration.py", line 1446, in __pivotDumpTable
>    for i in xrange(int(count)):
> ValueError: invalid literal for int() with base 10: 'None'
>
> [*] shutting down at 21:13:02
>
>
> Kind regards,
> Olu
>
> ------------------------------------------------------------------------------
> All of the data generated in your IT infrastructure is seriously valuable.
> Why? It contains a definitive record of application performance, security
> threats, fraudulent activity, and more. Splunk takes this data and makes
> sense of it. IT sense. And common sense.
> http://p.sf.net/sfu/splunk-d2dcopy2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Error

[Oluseyi A. <sey...@gm...>]

Hi,

Just received this error trying to dump a sybase db.

21:13:02] [CRITICAL] unhandled exception in sqlmap/1.0-dev (r4384), retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r4384)
Python version: 2.7.1
Operating system: posix
Command line: ./sqlmap.py -u ************************************************************** -D ********* -T USER -C ***************************************** --text-only --dbms=sybase --batch --parse-errors --threads=10 --start=1 --stop=10 --dump
Technique: ERROR
Back-end DBMS: Sybase (fingerprinted)
Traceback (most recent call last):
  File "/Users/fx0ne/sqlmap/_sqlmap.py", line 86, in main
    start()
  File "/Users/fx0ne/sqlmap/lib/controller/controller.py", line 577, in start
    action()
  File "/Users/fx0ne/sqlmap/lib/controller/action.py", line 109, in action
    conf.dbmsHandler.dumpTable()
  File "/Users/fx0ne/sqlmap/plugins/generic/enumeration.py", line 1611, in dumpTable
    retVal = self.__pivotDumpTable(table, colList, blind=False)
  File "/Users/fx0ne/sqlmap/plugins/generic/enumeration.py", line 1446, in __pivotDumpTable
    for i in xrange(int(count)):
ValueError: invalid literal for int() with base 10: 'None'

[*] shutting down at 21:13:02


Kind regards,
Olu

Re: [sqlmap-users] Error/Bug report

[Miroslav S. <mir...@gm...>]

hi.

this should be fixed for some time in latest v1.0-dev in our SVN repository.

please do the:
$ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

to have it up to date.

kind regards,
Miroslav Stampar

On Thu, Sep 22, 2011 at 11:28 AM, le ha thanh <leh...@ya...> wrote:
> Hi,
> I were using sqlmap to check a demo website and got the below error message
> twice.
> I run sqlmap with wizard and set the scanner to highest level and risk. The
> test was run in BackTrack 5, VMWare player 3.1.4, the vm settings are: 1Gb
> RAM, 20Gb extendable HDD with NAT in Windows 7 Ultimate installed on T43,
> 2Gb RAM, 40Gb HDD. I was using wireless connection when run this test.
> Please check! Many thanks.
>
> ===========================================================================
>
>
> # python sqlmap.py --wizard
>
>     sqlmap/0.9 - automatic SQL injection and database takeover tool
>     http://sqlmap.sourceforge.net
>
> [*] starting at: 14:34:01
>
> Please enter full target URL (-u): http://demo.testfire.net/subscribe.aspx
> POST data (--data) [Enter for None]:
> txtEmail=ab...@co...&btnSubmit=Subscribe
> Injection difficulty (--level/--risk). Please choose:
> [1] Normal (default)
> [2] Medium
> [3] Hard
>> 3
> Enumeration (--banner/--current-user/etc). Please choose:
> [1] Basic (default)
> [2] Smart
> [3] All
>> 3
>
> sqlmap is running, please wait..
>
> sqlmap identified the following injection points with a total of 4653
> HTTP(s) requests:
> ---
> Place:
> POST
> Parameter: btnSubmit
>     Type: boolean-based blind
>     Title: OR boolean-based blind - WHERE or HAVING clause
>     Payload: txtEmail=ab...@co...&btnSubmit=-6204) OR NOT 5551=5551 AND
> (7686=7686
> ---
>
> web server operating system: Windows 2003
> web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
> back-end DBMS: Microsoft Access
> banner:    'None'
>
> current user:    'None'
>
> current database:    'None'
>
>
> [16:32:14] [CRITICAL] unhandled exception in sqlmap/0.9, retry your run with
> the latest development version from the Subversion repository. If the
> exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the bug,
> fix it accordingly and get back to you.
> sqlmap version: 0.9 (r3630)
> Python version: 2.6.5
> Operating system: posix
> Command line: sqlmap.py --wizard
> Technique: BOOLEAN
> Back-end DBMS: Microsoft Access (fingerprinted)
> Traceback (most recent call last):
>   File "sqlmap.py", line 82, in main
>     start()
>   File "/pentest/web/scanners/sqlmap/lib/controller/controller.py", line
> 447, in start
>     action()
>   File "/pentest/web/scanners/sqlmap/lib/controller/action.py", line 70, in
> action
>     conf.dumper.dba(conf.dbmsHandler.isDba())
>   File "/pentest/web/scanners/sqlmap/plugins/generic/enumeration.py", line
> 149, in isDba
>     query = queries[Backend.getIdentifiedDbms()].is_dba.query
>   File "/pentest/web/scanners/sqlmap/extra/xmlobject/xmlobject.py", line
> 372, in __getattr__
>     raise AttributeError(attr)
> AttributeError: query
>
> [*] shutting down at: 16:32:14
>
> Ha Thanh
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] Error/Bug report

[le ha t. <leh...@ya...>]

Hi,
I were using sqlmap to check a demo website and got the below error message twice.
I run sqlmap with wizard and set the scanner to highest level and risk. The test was run in BackTrack 5, VMWare player 3.1.4, the vm settings are: 1Gb RAM, 20Gb extendable HDD with NAT in Windows 7 Ultimate installed on T43, 2Gb RAM, 40Gb HDD. I was using wireless connection when run this test.

Please check! Many thanks.


===========================================================================



# python sqlmap.py --wizard

    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[*] starting at: 14:34:01

Please enter full target URL (-u): http://demo.testfire.net/subscribe.aspx
POST data (--data) [Enter for None]: txtEmail=ab...@co...&btnSubmit=Subscribe
Injection difficulty (--level/--risk). Please choose:
[1] Normal (default)
[2] Medium
[3] Hard
> 3
Enumeration (--banner/--current-user/etc). Please choose:
[1] Basic (default)
[2] Smart
[3] All
> 3

sqlmap is running, please wait..

sqlmap identified the following injection points with a total of 4653 HTTP(s) requests:
---
Place: POST                                                                                        
Parameter: btnSubmit
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: txtEmail=ab...@co...&btnSubmit=-6204) OR NOT 5551=5551 AND (7686=7686
---

web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft Access
banner:    'None'

current user:    'None'

current database:    'None'


[16:32:14] [CRITICAL] unhandled exception in sqlmap/0.9, retry your run with the latest development version from the Subversion repository. If the exception persists, please send by e-mail to sql...@li... the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 0.9 (r3630)
Python version: 2.6.5
Operating system: posix
Command line: sqlmap.py --wizard
Technique: BOOLEAN
Back-end DBMS: Microsoft Access (fingerprinted)
Traceback (most recent call last):
  File "sqlmap.py", line 82, in main
    start()
  File "/pentest/web/scanners/sqlmap/lib/controller/controller.py", line 447, in start
    action()
  File "/pentest/web/scanners/sqlmap/lib/controller/action.py", line 70, in action
    conf.dumper.dba(conf.dbmsHandler.isDba())
  File "/pentest/web/scanners/sqlmap/plugins/generic/enumeration.py", line 149, in isDba
    query = queries[Backend.getIdentifiedDbms()].is_dba.query
  File "/pentest/web/scanners/sqlmap/extra/xmlobject/xmlobject.py", line 372, in __getattr__
    raise AttributeError(attr)
AttributeError: query

[*] shutting down at: 16:32:14


 
Ha Thanh

Re: [sqlmap-users] about data charset

[Miroslav S. <mir...@gm...>]

hi root.

you can give it a shoot with --charset=gbk

if that fails, there are number of things that could go wrong:

1) is your editor supporting chinese characters?
2) are you sure that the backend charset/collation is GBK? in case
that the used DBMS connector sets collation to UTF8 and/or Latin1
there could be some problems with automatic conversions
3) which technique are you using?

kind regards.

On Tue, Sep 20, 2011 at 12:08 PM, root <ro...@cn...> wrote:
> hi
> when i use sqlmap to get data,this is gbk encoding.but get in
> cvs,garbled..how to set?
>
> 2011-09-20
> ________________________________
> thks&Best Regards
> robert
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense.
> http://p.sf.net/sfu/splunk-d2dcopy1
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] about data charset

[root <ro...@cn...>]

hi
when i use sqlmap to get data,this is gbk encoding.but get in cvs,garbled..how to set?

2011-09-20 



thks&Best Regards 
robert

Re: [sqlmap-users] about http 500 error

[Miroslav S. <mir...@gm...>]

Hi.

In most cases it's about privileges, but it's strange that other similar
things can be enumerated.

You can contact me privately with more information. For starter, it would be
great to take a look into --fresh-queries --colums -t traffic.txt.

Kind regards
On 19.9.2011. 07:44, "root" <ro...@cn...> wrote:
> hi
> when i use sqlmap to inject web app,i recvied this
>
> unable to retrieve the number of columns 'username' entries for table
'K_members' on database 'demo_test'
> [13:39:03] [WARNING] HTTP error codes detected during testing:
> 500 (Internal Server Error) - 3 times
>
> but i can get database name and tables etc..
>
> this is a timebase bind sqlinject.i dont kown,why can not get data from
columns..
> if this is a web app's bug,why i can get tablename and columns..
> if not,what happen?why this....
>
> 2011-09-19
>
>
>
> thks&Best Regards
> robert

[sqlmap-users] about http 500 error

[root <ro...@cn...>]

hi
when i use sqlmap to inject web app,i recvied this

 unable to retrieve the number of columns 'username' entries for table 'K_members' on database 'demo_test'
[13:39:03] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 3 times

but i can get database name and tables etc..

this is a timebase bind sqlinject.i dont kown,why can not get data from columns..
if this is a web app's bug,why i can get tablename and columns..
if not,what happen?why this....

2011-09-19 



thks&Best Regards 
robert

Re: [sqlmap-users] Sqlmap not working

[shaohua p. <pa...@kn...>]

try to add python before your command,just like:

*python *sqlmap.py -u http://www.target.com

Make sure that the directory of python has been added to your  PATH.




2011/9/19 zerkerpure pkinghotmailcom <zer...@ho...>

>
>  hello I recently installed Sqlmap and python like I was suppost to but when
>  I go to  click sqlmap which is a python file it starts up and says  the
>  normal
>  sqlmap/0.9 - autmatic SQL injection and database takeover tool
>  http://sqlmap.sourceforge.net
>  Usage: python C:\Users\Name\Desktop\sqlmap\sqlmap.py [options]
>  then the problem occurs below is exactly what it says:
>  "sqlmap.py:error: missing a mandatory parameter (-d , -u, -l, -m, -r, -g, -c, --wizard, --update or --dependencies), -h for help.
>   But when i try typing anything and entering like -h it just says [*] shutting down can you please help me out with this problem because im not sure
>   what im doing wrong or what i need to do to fix.
> P.S.
>  I did go into CMD and got to the sqlmap's directory by doing what the usage said to do ex: C:\Users\Name\Desktop\sqlmap\sqlmap.py
>  I also download TortoiseSVN and did update like it wanted me to but still the same problem occurs can someone help me please
>
>
>
> ------------------------------------------------------------------------------
> BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA
> http://p.sf.net/sfu/rim-devcon-copy2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>


-- 
pan


site: www.knownsec.com

[sqlmap-users] Sqlmap not working

[zerkerpure p. <zer...@ho...>]

 hello I recently installed Sqlmap and python like I was suppost to but when
 I go to  click sqlmap which is a python file it starts up and says  the
 normal
 sqlmap/0.9 - autmatic SQL injection and database takeover tool
 http://sqlmap.sourceforge.net
 Usage: python C:\Users\Name\Desktop\sqlmap\sqlmap.py [options]
 then the problem occurs below is exactly what it says:
 "sqlmap.py:error: missing a mandatory parameter (-d , -u, -l, -m, -r, -g, -c, --wizard, --update or --dependencies), -h for help. 
  But when i try typing anything and entering like -h it just says [*] shutting down can you please help me out with this problem because im not sure
  what im doing wrong or what i need to do to fix.
P.S.
 I did go into CMD and got to the sqlmap's directory by doing what the usage said to do ex: C:\Users\Name\Desktop\sqlmap\sqlmap.py
 I also download TortoiseSVN and did update like it wanted me to but still the same problem occurs can someone help me please

 		 	   		  

Re: [sqlmap-users] sqlmap error

[Miroslav S. <mir...@gm...>]

hi.

you are probably using Windows and you just double clicked the sqlmap.py file :)

you are supposed to go the "Command Prompt" inside Windows OS, go to
the sqlmap's directory, and from there run: python sqlmap.py together
with other options.

also, you are advised to checkout the latest v1.0-dev version from our
repository. you can do that by downloading TortoiseSVN and right-click
inside the place where you want it to be checked out, and select
"Checkout...". as an URL address enter:
https://svn.sqlmap.org/sqlmap/trunk/sqlmap

kind regards.

On Sun, Sep 18, 2011 at 6:34 PM, zerkerpure pkinghotmailcom
<zer...@ho...> wrote:
> hello I recently installed Sqlmap and python like I was suppost to but when
> i go to  click sqlmap which is a python file it starts up and says  the
> normal
> sqlmap/0.9 - autmatic SQL injection and database takeover tool
> http://sqlmap.sourceforge.net
> Usage: python C:\Users\Name\Desktop\sqlmap\sqlmap.py [options]
> then the problem occurs below is exactly what it says:
> "sqlmap.py:error: missing a mandatory parameter ('-d' , '-u', '-l', '-r',
> '-g', '-c', '--wizard' or '--update'), -h for help. But when i try typing
> anything and entering like -h it just automatically closes out and does
> nothing can you please help me out with this problem because im not sure
> what im doing wrong or what i need to do to fix.
>
> ------------------------------------------------------------------------------
> BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA
> http://p.sf.net/sfu/rim-devcon-copy2
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar
http://about.me/stamparm

[sqlmap-users] sqlmap error

[zerkerpure p. <zer...@ho...>]

hello I recently installed Sqlmap and python like I was suppost to but when i go to  click sqlmap which is a python file it starts up and says  the normal
sqlmap/0.9 - autmatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net
Usage: python C:\Users\Name\Desktop\sqlmap\sqlmap.py [options]
then the problem occurs below is exactly what it says:
"sqlmap.py:error: missing a mandatory parameter ('-d' , '-u', '-l', '-r', '-g', '-c', '--wizard' or '--update'), -h for help. But when i try typing anything and entering like -h it just automatically closes out and does nothing can you please help me out with this problem because im not sure what im doing wrong or what i need to do to fix.
 		 	   		  

Re: [sqlmap-users] critical unhandled exception error

[Bernardo D. A. G. <ber...@gm...>]

Hi Martin,

Please, svn update to the latest development version from Subversion and retry.

Bernardo

On 12 September 2011 17:39, Martin Damiano <mar...@ho...> wrote:
>
> error code attached as an png image
> critical unhandled exception error
> VER PRESENTACIÓN DESCARGAR TODO
> AGREGAR MÁS FOTOS


--
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: Unavailable

Re: [sqlmap-users] Fwd: Delivery Status Notification (Failure)

[Bernardo D. A. G. <ber...@gm...>]

Hi,

Running svn status you might see that your svn working copy is broken.
I recommend you svn checkout from scratch in another folder and use
sqlmap from there.

Bernardo


On 13 September 2011 15:12, 孙松柏 <luk...@gm...> wrote:
> when i update sqlmap using ./sqlmap.py --update i met this problem:(under
> backtrack5-R1)
>
> Traceback (most recent call last):
>  File "./sqlmap.py", line 17, in <module>
>    from _sqlmap import main
>  File "/pentest/database/sqlmap/_
> sqlmap.py", line 27, in <module>
>    from lib.controller.controller import start
>  File "/pentest/database/sqlmap/lib/controller/controller.py", line 13, in
> <module>
>    from lib.controller.action import action
>  File "/pentest/database/sqlmap/lib/controller/action.py", line 10, in
> <module>
>    from lib.controller.handler import setHandler
>  File "/pentest/database/sqlmap/lib/controller/handler.py", line 27, in
> <module>
>    from plugins.dbms.mssqlserver import MSSQLServerMap
>  File "/pentest/database/sqlmap/plugins/dbms/mssqlserver/__init__.py", line
> 14, in <module>
>    from plugins.dbms.mssqlserver.enumeration import Enumeration
>  File "/pentest/database/sqlmap/plugins/dbms/mssqlserver/enumeration.py",
> line 28, in <module>
>    from plugins.generic.enumeration import Enumeration as
> GenericEnumeration
>  File "/pentest/database/sqlmap/plugins/generic/enumeration.py", line 16,
> in <module>
>    from lib.core.common import BigArray
> ImportError: cannot import name BigArray
>
>
> --
> FIT1-213
> Department of Computer Science
> Tsinghua University, Beijing, 100084
> http://about.me/anakin/bio
>
>
>
> --
> FIT1-213
> Department of Computer Science
> Tsinghua University, Beijing, 100084
> http://about.me/anakin/bio
>
> ------------------------------------------------------------------------------
> BlackBerry&reg; DevCon Americas, Oct. 18-20, San Francisco, CA
> Learn about the latest advances in developing for the
> BlackBerry&reg; mobile platform with sessions, labs & more.
> See new tools and technologies. Register for BlackBerry&reg; DevCon today!
> http://p.sf.net/sfu/rim-devcon-copy1
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: Unavailable

Re: [sqlmap-users] Is there dump resume in sqlmap?

[Sherif El-D. <arc...@gm...>]

:) it continue from where it left.

And it does so because it reads the previous data from the session file .
so, if you "--flush-session"-ed, it will try to get information it might
have already got previously from the beginning.

You should really find yourself a vulnerable application to practice these
things...
On Sep 12, 2011 11:01 PM, "anonymous anonymous" <tm...@2c...> wrote:
>
------------------------------------------------------------------------------
> Doing More with Less: The Next Generation Virtual Desktop
> What are the key obstacles that have prevented many mid-market businesses
> from deploying virtual desktops? How do next-generation virtual desktops
> provide companies an easier-to-deploy, easier-to-manage and more
affordable
> virtual desktop model.http://www.accelacomm.com/jaw/sfnl/114/51426474/