sqlmap-users — sqlmap users mailing list

Re: [sqlmap-users] Bug - Incorrect OS Detection?

[Bernardo D. A. G. <ber...@gm...>]

Anthony,

On 20 April 2011 20:53, Anthony Boynes <ab...@gm...> wrote:
> Hello,
>
> sqlmap is not detecting the proper OS when I try to use various options,
> such as --os-cmd and --os-pwn.  I have been testing against the Kioptrix
> Level 2 VM Challenge.

Proper fingerprint of MySQL < 5 underlying OS has been fixed some
revisions ago, thanks for reporting.

>   Whenever I am prompted for the web server path, it
> will not accept a valid linux path. As you can see from the below output, it
> properly shows "Linux Centos 4", and then for some reason switches to seeing
> Windows as the OS.

Fixed at r3766. Switch --os now forces the OS and avoid sqlmap from
performing any back-end DBMS undelying OS fingerprint.

Cheers,
Bernardo


-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F

Re: [sqlmap-users] output error

[Miroslav S. <mir...@gm...>]

hi.

with the last commit (3761) false positives tests are implemented
(small Turing like arithmetic tests).

this means that now there should be far lesser problems like this
reported by Ahmed.

kr

On Thu, Apr 21, 2011 at 11:19 AM, Miroslav Stampar
<mir...@gm...> wrote:
> hi all.
>
> to deal with this kind of situations (FALSE positives) we've agreed
> internally to run a confirmation phase right after detection phase
> for:
> A) when only blind injection is detected (like in Ahmed's case,
> especially pain in the ass are search engine queries)
> B) when only time and/or stacked injection is detected
>
> as these two cases are really prone to FALSE positives we'll
> incorporate few more checks at the end just to be sure.
>
> if you have some other suggestions please do.
>
> kr
>
> On Wed, Apr 20, 2011 at 3:50 PM, Miroslav Stampar
> <mir...@gm...> wrote:
>> nevermind the last message.
>>
>> this is particular case and i'll try to deal with it.
>>
>> thing is that the returned page for AND 1=1 was really too similar to
>> the original (match ratio 0.973) and together with comparison against
>> response of 1=0 it triggered FALSE positive.
>>
>> kr
>>
>> On Wed, Apr 20, 2011 at 3:24 PM, Miroslav Stampar
>> <mir...@gm...> wrote:
>>> hi all.
>>>
>>> here we have a pretty "interesting" problem. ahmed sent me privately
>>> the url and it really seems like a FALSE positive.
>>>
>>> but this one is pretty annoying and not so obvious to solve.
>>>
>>> thing is that the tested "search" parameter with payload "bla AND 1=1"
>>> displays totally different results than "bla AND 1=0". by totally i
>>> mean totally as major number of people, and our engine, really would
>>> say that it's affected, while it's not.
>>>
>>> the question goes like this. what would you suggest how to deal
>>> (automatically) with this kind of situations? it's a normal case when
>>> really the tested parameter is some kind of query string and for
>>> different payloads it acts like it's really affected while it's not.
>>>
>>> one case of FALSE positive from this one is:
>>> ---
>>> Place: GET
>>> Parameter: q
>>>    Type: boolean-based blind
>>>    Title: AND boolean-based blind - WHERE or HAVING clause
>>>    Payload: q=Something AND 8602=8602
>>> ---
>>>
>>> to be more ironic, things like --string and/or --regexp wouldn't help
>>> as they would also FAIL :) and call it a POSITIVE.
>>>
>>> kr
>>>
>>> On Wed, Apr 20, 2011 at 1:48 PM, Miroslav Stampar
>>> <mir...@gm...> wrote:
>>>> this is a false positive for sure, because of one reason:
>>>> in one run it's MySQL detected while in second it's Postgres.
>>>>
>>>> you can disclose the URL itself to me so i could test it myself and
>>>> find out what's going on or you can just forget about it (as it's
>>>> false positive).
>>>>
>>>> kr
>>>>
>>>> On Wed, Apr 20, 2011 at 1:44 PM, Ahmed Shawky <ah...@is...> wrote:
>>>>> after using these falgs sqlmap is unable to retrieve the number of
>>>>> databases
>>>>> sqlmap identified the following injection points with a total of 111 HTTP(s)
>>>>> requests:
>>>>> ---
>>>>> Place: GET
>>>>> Parameter: q
>>>>>     Type: boolean-based blind
>>>>>     Title: AND boolean-based blind - WHERE or HAVING clause
>>>>>     Payload: q=Open addressing) AND 4293=4293
>>>>> ---
>>>>> [13:40:09] [INFO] testing PostgreSQL
>>>>> [13:40:10] [INFO] confirming PostgreSQL
>>>>> [13:40:11] [INFO] the back-end DBMS is PostgreSQL
>>>>> web server operating system: Windows 2008
>>>>> web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
>>>>> back-end DBMS: PostgreSQL
>>>>> [13:40:11] [INFO] fetching database names
>>>>> [13:40:11] [INFO] fetching number of databases
>>>>> [13:40:11] [INFO] retrieved:
>>>>> [13:40:18] [ERROR] unable to retrieve the number of databases
>>>>> [13:40:18] [INFO] falling back to current database
>>>>> [13:40:18] [INFO] fetching current database
>>>>> [13:40:18] [INFO] retrieved:
>>>>> [13:40:55] [CRITICAL] unable to retrieve the database names
>>>>>
>>>>> On Wed, Apr 20, 2011 at 10:41 AM, Miroslav Stampar
>>>>> <mir...@gm...> wrote:
>>>>>>
>>>>>> hi Ahmed.
>>>>>>
>>>>>> could you please retry with --flush-session and --text-only and report
>>>>>> back?
>>>>>>
>>>>>> kr
>>>>>>
>>>>>> On Wed, Apr 20, 2011 at 7:06 AM, Ahmed Shawky <ah...@is...> wrote:
>>>>>> > sqlmap display the output in strange way something like
>>>>>> > available databases [1]:
>>>>>> > [*] ][[[][A[]][][][[][]B! [[[[QCR Q]C
>>>>>> > the used flags are -t log.log --level 3 --risk 3 --dbs
>>>>>> > info:
>>>>>> > Place: GET
>>>>>> > Parameter: q
>>>>>> >     Type: boolean-based blind
>>>>>> >     Title: AND boolean-based blind - WHERE or HAVING clause
>>>>>> >     Payload: q=Open addressing) AND 6448=6448
>>>>>> > ---
>>>>>> > [05:46:53] [INFO] the back-end DBMS is MySQL
>>>>>> > web server operating system: Windows 2008
>>>>>> > web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET
>>>>>> > 2.0.50727
>>>>>> > back-end DBMS: MySQL 5
>>>>>> > --
>>>>>> >
>>>>>> > Ahmed Shawky El-Antry
>>>>>> > Pen-tester, Programmer and System administrator
>>>>>> > lnxg33k owner "http://lnxg33k.wordpress.com"
>>>>>> > Isecur1ty team member"http://www.isecur1ty.org"
>>>>>> > Twitter @lnxg33k
>>>>>> >
>>>>>> >
>>>>>> > ------------------------------------------------------------------------------
>>>>>> > Benefiting from Server Virtualization: Beyond Initial Workload
>>>>>> > Consolidation -- Increasing the use of server virtualization is a top
>>>>>> > priority.Virtualization can reduce costs, simplify management, and
>>>>>> > improve
>>>>>> > application availability and disaster protection. Learn more about
>>>>>> > boosting
>>>>>> > the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
>>>>>> > _______________________________________________
>>>>>> > sqlmap-users mailing list
>>>>>> > sql...@li...
>>>>>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>>> >
>>>>>> >
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Miroslav Stampar
>>>>>>
>>>>>> E-mail: miroslav.stampar (at) gmail.com
>>>>>> PGP Key ID: 0xB5397B1B
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>>
>>>>> Ahmed Shawky El-Antry
>>>>> Pen-tester, Programmer and System administrator
>>>>> lnxg33k owner "http://lnxg33k.wordpress.com"
>>>>> Isecur1ty team member"http://www.isecur1ty.org"
>>>>> Twitter @lnxg33k
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Miroslav Stampar
>>>>
>>>> E-mail: miroslav.stampar (at) gmail.com
>>>> PGP Key ID: 0xB5397B1B
>>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail: miroslav.stampar (at) gmail.com
>>> PGP Key ID: 0xB5397B1B
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail: miroslav.stampar (at) gmail.com
>> PGP Key ID: 0xB5397B1B
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail: miroslav.stampar (at) gmail.com
> PGP Key ID: 0xB5397B1B
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] bug --file-read

[Miroslav S. <mir...@gm...>]

hi Kirill.

thank you for your report. find it fixed in the latest commit.

kr

On Thu, Apr 21, 2011 at 3:26 PM, Kirill Morozov <l0...@l0...> wrote:
> Hi,
> i try to read file and get error, maybe this file does not exists, because i
> got /etc/passwd without problems.
> [17:20:08] [INFO] the back-end DBMS is MySQL
> web server operating system: Linux Debian or Ubuntu 5.0 (lenny)
> web application technology: Apache 2.2.9, PHP 5.2.16
> back-end DBMS: MySQL 5.0
> [17:20:08] [INFO] fingerprinting the back-end DBMS operating system
> [17:20:09] [INFO] the back-end DBMS operating system is Linux
> [17:20:09] [INFO] fetching file: '/etc/apache2/httpd.conf'
> [17:20:09] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run
> with the latest development version from the Subversion repository. If the
> exception persists, please send by e-mail to
> sql...@li... the following text and any information
> required to reproduce the bug. The developers will try to reproduce the bug,
> fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r3742)
> Python version: 2.6.5
> Operating system: posix
> Command line: ./sqlmap.py -u *******************************************
> --file-read=/etc/apache2/httpd.conf
> Technique: ERROR
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "./sqlmap.py", line 83, in main
>     start()
>   File "/root/sqlmap-dev/lib/controller/controller.py", line 467, in start
>     action()
>   File "/root/sqlmap-dev/lib/controller/action.py", line 123, in action
>     conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
>   File "/root/sqlmap-dev/plugins/generic/filesystem.py", line 297, in
> readFile
>     newFileContent += chunk
> TypeError: cannot concatenate 'str' and 'NoneType' objects
> [*] shutting down at: 17:20:09
>
> --
> Kirill Morozov
> KIMO2-RIPE, RHCE
>
>
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

[sqlmap-users] bug --file-read

[Kirill M. <l0...@l0...>]

Hi,

i try to read file and get error, maybe this file does not exists, because i
got /etc/passwd without problems.

[17:20:08] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian or Ubuntu 5.0 (lenny)
web application technology: Apache 2.2.9, PHP 5.2.16
back-end DBMS: MySQL 5.0
[17:20:08] [INFO] fingerprinting the back-end DBMS operating system
[17:20:09] [INFO] the back-end DBMS operating system is Linux
[17:20:09] [INFO] fetching file: '/etc/apache2/httpd.conf'

[17:20:09] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run
with the latest development version from the Subversion repository. If the
exception persists, please send by e-mail to
sql...@li... the following text and any information
required to reproduce the bug. The developers will try to reproduce the bug,
fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r3742)
Python version: 2.6.5
Operating system: posix
Command line: ./sqlmap.py -u *******************************************
--file-read=/etc/apache2/httpd.conf
Technique: ERROR
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "./sqlmap.py", line 83, in main
    start()
  File "/root/sqlmap-dev/lib/controller/controller.py", line 467, in start
    action()
  File "/root/sqlmap-dev/lib/controller/action.py", line 123, in action
    conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
  File "/root/sqlmap-dev/plugins/generic/filesystem.py", line 297, in
readFile
    newFileContent += chunk
TypeError: cannot concatenate 'str' and 'NoneType' objects

[*] shutting down at: 17:20:09


-- 
Kirill Morozov
KIMO2-RIPE, RHCE

[sqlmap-users] --os-pwn was down last couple of days

[Miroslav S. <mir...@gm...>]

hi all.

just to inform you that --os-pwn was down for last couple of days due
to a bug (if run on non-Windows platforms) with packing of payloads as
a result of our anti-virus avoiding maneuverers (UPX is falsely flaged
as virus by 10% of antivirus software, and it's quite annoying that
for example Avast triggers on official 0.9 release because of UPX).

now everything should be back on tracks.

kr

-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] output error

[Miroslav S. <mir...@gm...>]

hi all.

to deal with this kind of situations (FALSE positives) we've agreed
internally to run a confirmation phase right after detection phase
for:
A) when only blind injection is detected (like in Ahmed's case,
especially pain in the ass are search engine queries)
B) when only time and/or stacked injection is detected

as these two cases are really prone to FALSE positives we'll
incorporate few more checks at the end just to be sure.

if you have some other suggestions please do.

kr

On Wed, Apr 20, 2011 at 3:50 PM, Miroslav Stampar
<mir...@gm...> wrote:
> nevermind the last message.
>
> this is particular case and i'll try to deal with it.
>
> thing is that the returned page for AND 1=1 was really too similar to
> the original (match ratio 0.973) and together with comparison against
> response of 1=0 it triggered FALSE positive.
>
> kr
>
> On Wed, Apr 20, 2011 at 3:24 PM, Miroslav Stampar
> <mir...@gm...> wrote:
>> hi all.
>>
>> here we have a pretty "interesting" problem. ahmed sent me privately
>> the url and it really seems like a FALSE positive.
>>
>> but this one is pretty annoying and not so obvious to solve.
>>
>> thing is that the tested "search" parameter with payload "bla AND 1=1"
>> displays totally different results than "bla AND 1=0". by totally i
>> mean totally as major number of people, and our engine, really would
>> say that it's affected, while it's not.
>>
>> the question goes like this. what would you suggest how to deal
>> (automatically) with this kind of situations? it's a normal case when
>> really the tested parameter is some kind of query string and for
>> different payloads it acts like it's really affected while it's not.
>>
>> one case of FALSE positive from this one is:
>> ---
>> Place: GET
>> Parameter: q
>>    Type: boolean-based blind
>>    Title: AND boolean-based blind - WHERE or HAVING clause
>>    Payload: q=Something AND 8602=8602
>> ---
>>
>> to be more ironic, things like --string and/or --regexp wouldn't help
>> as they would also FAIL :) and call it a POSITIVE.
>>
>> kr
>>
>> On Wed, Apr 20, 2011 at 1:48 PM, Miroslav Stampar
>> <mir...@gm...> wrote:
>>> this is a false positive for sure, because of one reason:
>>> in one run it's MySQL detected while in second it's Postgres.
>>>
>>> you can disclose the URL itself to me so i could test it myself and
>>> find out what's going on or you can just forget about it (as it's
>>> false positive).
>>>
>>> kr
>>>
>>> On Wed, Apr 20, 2011 at 1:44 PM, Ahmed Shawky <ah...@is...> wrote:
>>>> after using these falgs sqlmap is unable to retrieve the number of
>>>> databases
>>>> sqlmap identified the following injection points with a total of 111 HTTP(s)
>>>> requests:
>>>> ---
>>>> Place: GET
>>>> Parameter: q
>>>>     Type: boolean-based blind
>>>>     Title: AND boolean-based blind - WHERE or HAVING clause
>>>>     Payload: q=Open addressing) AND 4293=4293
>>>> ---
>>>> [13:40:09] [INFO] testing PostgreSQL
>>>> [13:40:10] [INFO] confirming PostgreSQL
>>>> [13:40:11] [INFO] the back-end DBMS is PostgreSQL
>>>> web server operating system: Windows 2008
>>>> web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
>>>> back-end DBMS: PostgreSQL
>>>> [13:40:11] [INFO] fetching database names
>>>> [13:40:11] [INFO] fetching number of databases
>>>> [13:40:11] [INFO] retrieved:
>>>> [13:40:18] [ERROR] unable to retrieve the number of databases
>>>> [13:40:18] [INFO] falling back to current database
>>>> [13:40:18] [INFO] fetching current database
>>>> [13:40:18] [INFO] retrieved:
>>>> [13:40:55] [CRITICAL] unable to retrieve the database names
>>>>
>>>> On Wed, Apr 20, 2011 at 10:41 AM, Miroslav Stampar
>>>> <mir...@gm...> wrote:
>>>>>
>>>>> hi Ahmed.
>>>>>
>>>>> could you please retry with --flush-session and --text-only and report
>>>>> back?
>>>>>
>>>>> kr
>>>>>
>>>>> On Wed, Apr 20, 2011 at 7:06 AM, Ahmed Shawky <ah...@is...> wrote:
>>>>> > sqlmap display the output in strange way something like
>>>>> > available databases [1]:
>>>>> > [*] ][[[][A[]][][][[][]B! [[[[QCR Q]C
>>>>> > the used flags are -t log.log --level 3 --risk 3 --dbs
>>>>> > info:
>>>>> > Place: GET
>>>>> > Parameter: q
>>>>> >     Type: boolean-based blind
>>>>> >     Title: AND boolean-based blind - WHERE or HAVING clause
>>>>> >     Payload: q=Open addressing) AND 6448=6448
>>>>> > ---
>>>>> > [05:46:53] [INFO] the back-end DBMS is MySQL
>>>>> > web server operating system: Windows 2008
>>>>> > web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET
>>>>> > 2.0.50727
>>>>> > back-end DBMS: MySQL 5
>>>>> > --
>>>>> >
>>>>> > Ahmed Shawky El-Antry
>>>>> > Pen-tester, Programmer and System administrator
>>>>> > lnxg33k owner "http://lnxg33k.wordpress.com"
>>>>> > Isecur1ty team member"http://www.isecur1ty.org"
>>>>> > Twitter @lnxg33k
>>>>> >
>>>>> >
>>>>> > ------------------------------------------------------------------------------
>>>>> > Benefiting from Server Virtualization: Beyond Initial Workload
>>>>> > Consolidation -- Increasing the use of server virtualization is a top
>>>>> > priority.Virtualization can reduce costs, simplify management, and
>>>>> > improve
>>>>> > application availability and disaster protection. Learn more about
>>>>> > boosting
>>>>> > the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
>>>>> > _______________________________________________
>>>>> > sqlmap-users mailing list
>>>>> > sql...@li...
>>>>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>>> >
>>>>> >
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Miroslav Stampar
>>>>>
>>>>> E-mail: miroslav.stampar (at) gmail.com
>>>>> PGP Key ID: 0xB5397B1B
>>>>
>>>>
>>>>
>>>> --
>>>>
>>>> Ahmed Shawky El-Antry
>>>> Pen-tester, Programmer and System administrator
>>>> lnxg33k owner "http://lnxg33k.wordpress.com"
>>>> Isecur1ty team member"http://www.isecur1ty.org"
>>>> Twitter @lnxg33k
>>>>
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail: miroslav.stampar (at) gmail.com
>>> PGP Key ID: 0xB5397B1B
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail: miroslav.stampar (at) gmail.com
>> PGP Key ID: 0xB5397B1B
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail: miroslav.stampar (at) gmail.com
> PGP Key ID: 0xB5397B1B
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] A suggestion for blind SQL injection

[Miroslav S. <mir...@gm...>]

hi David.

"I don't know if there are other quickest methods, else it could be
included in sqlmap."

actually we have a mechanisms to dealing with these kind of problems.
it's called tampering and you can use it with --tamper switch and
scripts located in ./tamper directory. in your case best solution
would be to try to use script "tamper/between.py". it will replace all
occurrences of character > with equivalent 'between' form, e.g. a>10
---> a not between 0 and 10.

so, try to use --tamper="./tamper/between.py" do deal with your case.

KR

On Wed, Apr 20, 2011 at 6:33 PM, David Alvarez
<dav...@gm...> wrote:
> Hello,
> I found a web application that uses PostgreSQL 8.1.22 and filter '>' and '<'
> characters. This app is vulnerable to a Blind Sql injection, so sqlmap try
> to extract data doing the boolean-base technique. However, due to <,>
> characters are filtered sqlmap is not able to extract data. The method that
> I used to extract was very slow: changing boolean condition from A > B to A
> = B.
> So, this is a possible kind of method to extract data when '<>' characters
> are filtered. I don't know if there are other quickest methods, else it
> could be included in sqlmap.
> Kind regards,
> David Alvarez
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

[sqlmap-users] Bug - Incorrect OS Detection?

[Anthony B. <ab...@gm...>]

Hello,

sqlmap is not detecting the proper OS when I try to use various options,
such as --os-cmd and --os-pwn.  I have been testing against the Kioptrix
Level 2 VM Challenge.   Whenever I am prompted for the web server path, it
will not accept a valid linux path. As you can see from the below output, it
properly shows "Linux Centos 4", and then for some reason switches to seeing
Windows as the OS.


./sqlmap.py -u "http://192.168.1.21/index.php" --data "uname=foo&psw=bar"
--dbms=MySQL --level=5 --risk=3 --os="Linux" --os-pwn
--msf-path="/storage/tools/framework3/"



there were multiple injection points, please select the one to use for
following injections:
[0] place: POST, parameter: uname, type: Single quoted string (default)
[1] place: POST, parameter: psw, type: Single quoted string
[q] Quit
> 0
[12:39:34] [INFO] testing MySQL
[12:39:48] [INFO] confirming MySQL

[12:40:16] [WARNING] adjusting time delay to 1 second (due to good response
times)
[12:40:16] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 4
web application technology: PHP 4.3.9, Apache 2.0.52
back-end DBMS: MySQL < 5.0.0
[12:40:16] [INFO] fingerprinting the back-end DBMS operating system
[12:40:16] [INFO] the back-end DBMS operating system is Windows
how do you want to establish the tunnel?
[1] TCP: Metasploit Framework (default)
[2] ICMP: icmpsh - ICMP tunneling
> 1
[12:40:22] [INFO] going to use a web backdoor to establish the tunnel
[12:40:22] [INFO] trying to upload the file stager
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] PHP (default)
[4] JSP
> 3
[12:40:24] [WARNING] unable to retrieve the web server document root
please provide the web server document root
[C:/xampp/htdocs/,C:/Inetpub/wwwroot/]:
[12:40:27] [WARNING] unable to retrieve any web server path
please provide any additional web server full path to try to upload the
agent [Enter for None]:
[12:40:27] [WARNING] unable to upload the file stager on 'C:/xampp/htdocs'
[12:40:27] [WARNING] unable to upload the file stager on
'C:/Inetpub/wwwroot'
[12:40:27] [WARNING] HTTP error codes detected during testing:
404 (Not Found) - 2 times
[12:40:27] [INFO] Fetched data logged to text files under
'/storage/tools/sqlmap-dev/output/192.168.1.21'

[*] shutting down at: 12:40:27




./sqlmap.py --version

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

sqlmap/1.0-dev

[sqlmap-users] A suggestion for blind SQL injection

[David A. <dav...@gm...>]

Hello,

I found a web application that uses PostgreSQL 8.1.22 and filter '>' and '<'
characters. This app is vulnerable to a Blind Sql injection, so sqlmap try
to extract data doing the boolean-base technique. However, due to <,>
characters are filtered sqlmap is not able to extract data. The method that
I used to extract was very slow: changing boolean condition from A > B to A
= B.

So, this is a possible kind of method to extract data when '<>' characters
are filtered. I don't know if there are other quickest methods, else it
could be included in sqlmap.

Kind regards,
David Alvarez

Re: [sqlmap-users] output error

[Miroslav S. <mir...@gm...>]

nevermind the last message.

this is particular case and i'll try to deal with it.

thing is that the returned page for AND 1=1 was really too similar to
the original (match ratio 0.973) and together with comparison against
response of 1=0 it triggered FALSE positive.

kr

On Wed, Apr 20, 2011 at 3:24 PM, Miroslav Stampar
<mir...@gm...> wrote:
> hi all.
>
> here we have a pretty "interesting" problem. ahmed sent me privately
> the url and it really seems like a FALSE positive.
>
> but this one is pretty annoying and not so obvious to solve.
>
> thing is that the tested "search" parameter with payload "bla AND 1=1"
> displays totally different results than "bla AND 1=0". by totally i
> mean totally as major number of people, and our engine, really would
> say that it's affected, while it's not.
>
> the question goes like this. what would you suggest how to deal
> (automatically) with this kind of situations? it's a normal case when
> really the tested parameter is some kind of query string and for
> different payloads it acts like it's really affected while it's not.
>
> one case of FALSE positive from this one is:
> ---
> Place: GET
> Parameter: q
>    Type: boolean-based blind
>    Title: AND boolean-based blind - WHERE or HAVING clause
>    Payload: q=Something AND 8602=8602
> ---
>
> to be more ironic, things like --string and/or --regexp wouldn't help
> as they would also FAIL :) and call it a POSITIVE.
>
> kr
>
> On Wed, Apr 20, 2011 at 1:48 PM, Miroslav Stampar
> <mir...@gm...> wrote:
>> this is a false positive for sure, because of one reason:
>> in one run it's MySQL detected while in second it's Postgres.
>>
>> you can disclose the URL itself to me so i could test it myself and
>> find out what's going on or you can just forget about it (as it's
>> false positive).
>>
>> kr
>>
>> On Wed, Apr 20, 2011 at 1:44 PM, Ahmed Shawky <ah...@is...> wrote:
>>> after using these falgs sqlmap is unable to retrieve the number of
>>> databases
>>> sqlmap identified the following injection points with a total of 111 HTTP(s)
>>> requests:
>>> ---
>>> Place: GET
>>> Parameter: q
>>>     Type: boolean-based blind
>>>     Title: AND boolean-based blind - WHERE or HAVING clause
>>>     Payload: q=Open addressing) AND 4293=4293
>>> ---
>>> [13:40:09] [INFO] testing PostgreSQL
>>> [13:40:10] [INFO] confirming PostgreSQL
>>> [13:40:11] [INFO] the back-end DBMS is PostgreSQL
>>> web server operating system: Windows 2008
>>> web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
>>> back-end DBMS: PostgreSQL
>>> [13:40:11] [INFO] fetching database names
>>> [13:40:11] [INFO] fetching number of databases
>>> [13:40:11] [INFO] retrieved:
>>> [13:40:18] [ERROR] unable to retrieve the number of databases
>>> [13:40:18] [INFO] falling back to current database
>>> [13:40:18] [INFO] fetching current database
>>> [13:40:18] [INFO] retrieved:
>>> [13:40:55] [CRITICAL] unable to retrieve the database names
>>>
>>> On Wed, Apr 20, 2011 at 10:41 AM, Miroslav Stampar
>>> <mir...@gm...> wrote:
>>>>
>>>> hi Ahmed.
>>>>
>>>> could you please retry with --flush-session and --text-only and report
>>>> back?
>>>>
>>>> kr
>>>>
>>>> On Wed, Apr 20, 2011 at 7:06 AM, Ahmed Shawky <ah...@is...> wrote:
>>>> > sqlmap display the output in strange way something like
>>>> > available databases [1]:
>>>> > [*] ][[[][A[]][][][[][]B! [[[[QCR Q]C
>>>> > the used flags are -t log.log --level 3 --risk 3 --dbs
>>>> > info:
>>>> > Place: GET
>>>> > Parameter: q
>>>> >     Type: boolean-based blind
>>>> >     Title: AND boolean-based blind - WHERE or HAVING clause
>>>> >     Payload: q=Open addressing) AND 6448=6448
>>>> > ---
>>>> > [05:46:53] [INFO] the back-end DBMS is MySQL
>>>> > web server operating system: Windows 2008
>>>> > web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET
>>>> > 2.0.50727
>>>> > back-end DBMS: MySQL 5
>>>> > --
>>>> >
>>>> > Ahmed Shawky El-Antry
>>>> > Pen-tester, Programmer and System administrator
>>>> > lnxg33k owner "http://lnxg33k.wordpress.com"
>>>> > Isecur1ty team member"http://www.isecur1ty.org"
>>>> > Twitter @lnxg33k
>>>> >
>>>> >
>>>> > ------------------------------------------------------------------------------
>>>> > Benefiting from Server Virtualization: Beyond Initial Workload
>>>> > Consolidation -- Increasing the use of server virtualization is a top
>>>> > priority.Virtualization can reduce costs, simplify management, and
>>>> > improve
>>>> > application availability and disaster protection. Learn more about
>>>> > boosting
>>>> > the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
>>>> > _______________________________________________
>>>> > sqlmap-users mailing list
>>>> > sql...@li...
>>>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>>> >
>>>> >
>>>>
>>>>
>>>>
>>>> --
>>>> Miroslav Stampar
>>>>
>>>> E-mail: miroslav.stampar (at) gmail.com
>>>> PGP Key ID: 0xB5397B1B
>>>
>>>
>>>
>>> --
>>>
>>> Ahmed Shawky El-Antry
>>> Pen-tester, Programmer and System administrator
>>> lnxg33k owner "http://lnxg33k.wordpress.com"
>>> Isecur1ty team member"http://www.isecur1ty.org"
>>> Twitter @lnxg33k
>>>
>>
>>
>>
>> --
>> Miroslav Stampar
>>
>> E-mail: miroslav.stampar (at) gmail.com
>> PGP Key ID: 0xB5397B1B
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail: miroslav.stampar (at) gmail.com
> PGP Key ID: 0xB5397B1B
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] output error

[Miroslav S. <mir...@gm...>]

hi all.

here we have a pretty "interesting" problem. ahmed sent me privately
the url and it really seems like a FALSE positive.

but this one is pretty annoying and not so obvious to solve.

thing is that the tested "search" parameter with payload "bla AND 1=1"
displays totally different results than "bla AND 1=0". by totally i
mean totally as major number of people, and our engine, really would
say that it's affected, while it's not.

the question goes like this. what would you suggest how to deal
(automatically) with this kind of situations? it's a normal case when
really the tested parameter is some kind of query string and for
different payloads it acts like it's really affected while it's not.

one case of FALSE positive from this one is:
---
Place: GET
Parameter: q
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: q=Something AND 8602=8602
---

to be more ironic, things like --string and/or --regexp wouldn't help
as they would also FAIL :) and call it a POSITIVE.

kr

On Wed, Apr 20, 2011 at 1:48 PM, Miroslav Stampar
<mir...@gm...> wrote:
> this is a false positive for sure, because of one reason:
> in one run it's MySQL detected while in second it's Postgres.
>
> you can disclose the URL itself to me so i could test it myself and
> find out what's going on or you can just forget about it (as it's
> false positive).
>
> kr
>
> On Wed, Apr 20, 2011 at 1:44 PM, Ahmed Shawky <ah...@is...> wrote:
>> after using these falgs sqlmap is unable to retrieve the number of
>> databases
>> sqlmap identified the following injection points with a total of 111 HTTP(s)
>> requests:
>> ---
>> Place: GET
>> Parameter: q
>>     Type: boolean-based blind
>>     Title: AND boolean-based blind - WHERE or HAVING clause
>>     Payload: q=Open addressing) AND 4293=4293
>> ---
>> [13:40:09] [INFO] testing PostgreSQL
>> [13:40:10] [INFO] confirming PostgreSQL
>> [13:40:11] [INFO] the back-end DBMS is PostgreSQL
>> web server operating system: Windows 2008
>> web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
>> back-end DBMS: PostgreSQL
>> [13:40:11] [INFO] fetching database names
>> [13:40:11] [INFO] fetching number of databases
>> [13:40:11] [INFO] retrieved:
>> [13:40:18] [ERROR] unable to retrieve the number of databases
>> [13:40:18] [INFO] falling back to current database
>> [13:40:18] [INFO] fetching current database
>> [13:40:18] [INFO] retrieved:
>> [13:40:55] [CRITICAL] unable to retrieve the database names
>>
>> On Wed, Apr 20, 2011 at 10:41 AM, Miroslav Stampar
>> <mir...@gm...> wrote:
>>>
>>> hi Ahmed.
>>>
>>> could you please retry with --flush-session and --text-only and report
>>> back?
>>>
>>> kr
>>>
>>> On Wed, Apr 20, 2011 at 7:06 AM, Ahmed Shawky <ah...@is...> wrote:
>>> > sqlmap display the output in strange way something like
>>> > available databases [1]:
>>> > [*] ][[[][A[]][][][[][]B! [[[[QCR Q]C
>>> > the used flags are -t log.log --level 3 --risk 3 --dbs
>>> > info:
>>> > Place: GET
>>> > Parameter: q
>>> >     Type: boolean-based blind
>>> >     Title: AND boolean-based blind - WHERE or HAVING clause
>>> >     Payload: q=Open addressing) AND 6448=6448
>>> > ---
>>> > [05:46:53] [INFO] the back-end DBMS is MySQL
>>> > web server operating system: Windows 2008
>>> > web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET
>>> > 2.0.50727
>>> > back-end DBMS: MySQL 5
>>> > --
>>> >
>>> > Ahmed Shawky El-Antry
>>> > Pen-tester, Programmer and System administrator
>>> > lnxg33k owner "http://lnxg33k.wordpress.com"
>>> > Isecur1ty team member"http://www.isecur1ty.org"
>>> > Twitter @lnxg33k
>>> >
>>> >
>>> > ------------------------------------------------------------------------------
>>> > Benefiting from Server Virtualization: Beyond Initial Workload
>>> > Consolidation -- Increasing the use of server virtualization is a top
>>> > priority.Virtualization can reduce costs, simplify management, and
>>> > improve
>>> > application availability and disaster protection. Learn more about
>>> > boosting
>>> > the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
>>> > _______________________________________________
>>> > sqlmap-users mailing list
>>> > sql...@li...
>>> > https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>> >
>>> >
>>>
>>>
>>>
>>> --
>>> Miroslav Stampar
>>>
>>> E-mail: miroslav.stampar (at) gmail.com
>>> PGP Key ID: 0xB5397B1B
>>
>>
>>
>> --
>>
>> Ahmed Shawky El-Antry
>> Pen-tester, Programmer and System administrator
>> lnxg33k owner "http://lnxg33k.wordpress.com"
>> Isecur1ty team member"http://www.isecur1ty.org"
>> Twitter @lnxg33k
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail: miroslav.stampar (at) gmail.com
> PGP Key ID: 0xB5397B1B
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] output error

[Miroslav S. <mir...@gm...>]

hi Ahmed.

could you please retry with --flush-session and --text-only and report back?

kr

On Wed, Apr 20, 2011 at 7:06 AM, Ahmed Shawky <ah...@is...> wrote:
> sqlmap display the output in strange way something like
> available databases [1]:
> [*] ][[[][A[]][][][[][]B! [[[[QCR Q]C
> the used flags are -t log.log --level 3 --risk 3 --dbs
> info:
> Place: GET
> Parameter: q
>     Type: boolean-based blind
>     Title: AND boolean-based blind - WHERE or HAVING clause
>     Payload: q=Open addressing) AND 6448=6448
> ---
> [05:46:53] [INFO] the back-end DBMS is MySQL
> web server operating system: Windows 2008
> web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
> back-end DBMS: MySQL 5
> --
>
> Ahmed Shawky El-Antry
> Pen-tester, Programmer and System administrator
> lnxg33k owner "http://lnxg33k.wordpress.com"
> Isecur1ty team member"http://www.isecur1ty.org"
> Twitter @lnxg33k
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] heuristic detection of charset

[Miroslav S. <mir...@gm...>]

hi Andres.

thank you for your idea :)

find it implemented in the latest commit (r3721).

kr

On Wed, Apr 20, 2011 at 1:47 AM, Andres Riancho
<and...@gm...> wrote:
> One recomendation would be to also enable it to "break a tie". If the http
> header says encoding A and the html says B, use chardet to decide which one
> to use.
>
> --
> Andres Riancho
>
> El abr 18, 2011 11:03 a.m., "Miroslav Stampar" <mir...@gm...>
> escribió:
>
> hi all.
>
> with r3700 automatic detection of web page charset/encoding is
> implemented by usage of "Universal Encoding Detector"
> (http://chardet.feedparser.org/).
>
> it's turned on only in two cases:
> A) if charset is not explicitly set
> and/or
> B) if declared charset is invalid (like you used to see that warning
> message "unknown web page charset. please report by email...")
>
> basically, same mechanism is used in Firefox and used package is a
> Python port of it.
>
> you are more than welcome to report any future problems related.
>
> kr
>
> --
> Miroslav Stampar
>
> E-mail: miroslav.stampar (at) gmail.com
> PGP Key ID: 0xB5397B1B
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

[sqlmap-users] output error

[Ahmed S. <ah...@is...>]

sqlmap display the output in strange way something like

available databases [1]:
[*] ][[[][A[]][][][[][]B![[[[QCRQ]C

the used flags are -t log.log --level 3 --risk 3 --dbs

info:

Place: GET
Parameter: q
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: q=Open addressing) AND 6448=6448
---

[05:46:53] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: MySQL 5

-- 

   - Ahmed Shawky El-Antry
   - Pen-tester, Programmer and System administrator
   - lnxg33k owner "http://lnxg33k.wordpress.com"
   - Isecur1ty team member"http://www.isecur1ty.org"
   - Twitter @lnxg33k

Re: [sqlmap-users] heuristic detection of charset

[Andres R. <and...@gm...>]

One recomendation would be to also enable it to "break a tie". If the http
header says encoding A and the html says B, use chardet to decide which one
to use.

--
Andres Riancho

El abr 18, 2011 11:03 a.m., "Miroslav Stampar" <mir...@gm...>
escribió:

hi all.

with r3700 automatic detection of web page charset/encoding is
implemented by usage of "Universal Encoding Detector"
(http://chardet.feedparser.org/).

it's turned on only in two cases:
A) if charset is not explicitly set
and/or
B) if declared charset is invalid (like you used to see that warning
message "unknown web page charset. please report by email...")

basically, same mechanism is used in Firefox and used package is a
Python port of it.

you are more than welcome to report any future problems related.

kr

--
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

------------------------------------------------------------------------------
Benefiting from Server Virtualization: Beyond Initial Workload
Consolidation -- Increasing the use of server virtualization is a top
priority.Virtualization can reduce costs, simplify management, and improve
application availability and disaster protection. Learn more about boosting
the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
_______________________________________________
sqlmap-users mailing list
sql...@li...
https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[Bernardo D. A. G. <ber...@gm...>]

Thanks for the info Steve.
We will consider a valid cert for svn.sqlmap.org.

Bernardo Damele A. G.

This message was sent from a smartphone

On 17 Apr 2011, at 23:33, Steven Pinkham <ste...@gm...> wrote:

> Ryan Sears wrote:
>> Wait, what? Are they *really* signed by a trusted CA?
>
> Yup.  Startcom was added to the windows root certificate program in
> September 2009.  They were already in Firefox and Safari at that time.
>
> It work just fine everywhere, as long as you correctly install the
> intermediate certs according to the instructions, much like you need to
> do for a godaddy or other cert these days.
>
> http://www.startssl.com/?app=25#31
>
> They allow one alt name of your choosing. Authentication is handled with
> client side certs.  They do basic fraud avoidance like flagging people
> who ask for, say, usbank.example.com as their alt name(I've tried ;-)
>
> As far as I can tell there is absolutely no upside to paying for some
> other Class 1 (domain/email validated) cert over the startcom free cert.
> Of course, if you need a wildcard cert, class 2 cert with business
> verification(so your name shows up when smart users hover over the lock
> icon), or extended validation cert(so the bar turns green), you still
> have to pony up.  Otherwise, class 1 certs are common and trusted on the
> Internet.  Most people don't know or care about the differences of the
> different classes.
>
> #1 reason to not use SSL is gone. Spread the word. ;-)
>
>> I was going to suggest getting one from GoDaddy (http://www.godaddy.com/Compare/gdcompare_ssl.aspx?isc=sslqgo026e). Hell I'll even pay for it myself, anything I can do to support you guys!
>>
>> Maybe we should go with comodo? :-P
>>
>> Ryan
>>
>
>
> --
> | Steven Pinkham, Security Consultant    |
> | http://www.mavensecurity.com           |
> | GPG public key ID CD31CAFB             |
>
>
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users

[sqlmap-users] heuristic detection of charset

[Miroslav S. <mir...@gm...>]

hi all.

with r3700 automatic detection of web page charset/encoding is
implemented by usage of "Universal Encoding Detector"
(http://chardet.feedparser.org/).

it's turned on only in two cases:
A) if charset is not explicitly set
and/or
B) if declared charset is invalid (like you used to see that warning
message "unknown web page charset. please report by email...")

basically, same mechanism is used in Firefox and used package is a
Python port of it.

you are more than welcome to report any future problems related.

kr

-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] BUG

[Miroslav S. <mir...@gm...>]

hi nigthman

find it fixed and committed in the latest revision (3698).

kr

On Mon, Apr 18, 2011 at 12:05 PM,  <nig...@em...> wrote:
> I found a new bug
>
> [11:58:55] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the Subversio
> n repository. If the exception persists, please send by e-mail to sql...@li... the following text and any in
> formation required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
> sqlmap version: 1.0-dev (r3679)
> Python version: 2.6.5
> Operating system: nt
> Command line: C:\pentest\p\sqlmap.0.9\sqlmap.py -u **************************************************************
> ********** --random-agent --retries=6 --level 5 --risk 3 --dump -D ****************** -T ********* --start=7167
> Technique: ERROR
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "C:\pentest\p\sqlmap.0.9\sqlmap.py", line 83, in main
>     start()
>   File "C:\pentest\p\sqlmap.0.9\lib\controller\controller.py", line 467, in start
>     action()
>   File "C:\pentest\p\sqlmap.0.9\lib\controller\action.py", line 103, in action
>     conf.dumper.dbTableValues(conf.dbmsHandler.dumpTable())
>   File "C:\pentest\p\sqlmap.0.9\plugins\generic\enumeration.py", line 1478, in dumpTable
>     attackDumpedTable()
>   File "C:\pentest\p\sqlmap.0.9\lib\utils\hash.py", line 280, in attackDumpedTable
>     results = dictionaryAttack(attack_dict)
>   File "C:\pentest\p\sqlmap.0.9\lib\utils\hash.py", line 408, in dictionaryAttack
>     word = word + suffix
> TypeError: unsupported operand type(s) for +: 'NoneType' and 'str'
>
> [*] shutting down at: 11:58:55
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

[sqlmap-users] BUG

[<nig...@em...>]

I found a new bug

[11:58:55] [CRITICAL] unhandled exception in sqlmap/1.0-dev, retry your run with the latest development version from the Subversio
n repository. If the exception persists, please send by e-mail to sql...@li... the following text and any in
formation required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev (r3679)
Python version: 2.6.5
Operating system: nt
Command line: C:\pentest\p\sqlmap.0.9\sqlmap.py -u **************************************************************
********** --random-agent --retries=6 --level 5 --risk 3 --dump -D ****************** -T ********* --start=7167
Technique: ERROR
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "C:\pentest\p\sqlmap.0.9\sqlmap.py", line 83, in main
    start()
  File "C:\pentest\p\sqlmap.0.9\lib\controller\controller.py", line 467, in start
    action()
  File "C:\pentest\p\sqlmap.0.9\lib\controller\action.py", line 103, in action
    conf.dumper.dbTableValues(conf.dbmsHandler.dumpTable())
  File "C:\pentest\p\sqlmap.0.9\plugins\generic\enumeration.py", line 1478, in dumpTable
    attackDumpedTable()
  File "C:\pentest\p\sqlmap.0.9\lib\utils\hash.py", line 280, in attackDumpedTable
    results = dictionaryAttack(attack_dict)
  File "C:\pentest\p\sqlmap.0.9\lib\utils\hash.py", line 408, in dictionaryAttack
    word = word + suffix
TypeError: unsupported operand type(s) for +: 'NoneType' and 'str'

[*] shutting down at: 11:58:55

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[Steven P. <ste...@gm...>]

Ryan Sears wrote:
> Wait, what? Are they *really* signed by a trusted CA?

Yup.  Startcom was added to the windows root certificate program in
September 2009.  They were already in Firefox and Safari at that time.

It work just fine everywhere, as long as you correctly install the
intermediate certs according to the instructions, much like you need to
do for a godaddy or other cert these days.

http://www.startssl.com/?app=25#31

They allow one alt name of your choosing. Authentication is handled with
client side certs.  They do basic fraud avoidance like flagging people
who ask for, say, usbank.example.com as their alt name(I've tried ;-)

As far as I can tell there is absolutely no upside to paying for some
other Class 1 (domain/email validated) cert over the startcom free cert.
 Of course, if you need a wildcard cert, class 2 cert with business
verification(so your name shows up when smart users hover over the lock
icon), or extended validation cert(so the bar turns green), you still
have to pony up.  Otherwise, class 1 certs are common and trusted on the
Internet.  Most people don't know or care about the differences of the
different classes.

#1 reason to not use SSL is gone. Spread the word. ;-)

> I was going to suggest getting one from GoDaddy (http://www.godaddy.com/Compare/gdcompare_ssl.aspx?isc=sslqgo026e). Hell I'll even pay for it myself, anything I can do to support you guys!
> 
> Maybe we should go with comodo? :-P
> 
> Ryan
> 


-- 
 | Steven Pinkham, Security Consultant    |
 | http://www.mavensecurity.com           |
 | GPG public key ID CD31CAFB             |

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[Ryan S. <rd...@mt...>]

Wait, what? Are they *really* signed by a trusted CA?

I was going to suggest getting one from GoDaddy (http://www.godaddy.com/Compare/gdcompare_ssl.aspx?isc=sslqgo026e). Hell I'll even pay for it myself, anything I can do to support you guys!

Maybe we should go with comodo? :-P

Ryan

----- Original Message -----
From: "Steven Pinkham" <ste...@gm...>
To: "Miroslav Stampar" <mir...@gm...>
Cc: "sqlmap users" <sql...@li...>
Sent: Sunday, April 17, 2011 2:15:45 PM GMT -05:00 US/Canada Eastern
Subject: Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

Miroslav Stampar wrote:
> hi.
> 
> what are the suggestions for getting real certificate (not self-signed)?
> 
> kr
> 

Basic startcom SSL certs are free.  They are supported by all major
browsers and operating systems, and are verified as poorly^W well as any
other SSL cert.

http://cert.startcom.org/

-- 
 | Steven Pinkham, Security Consultant    |
 | http://www.mavensecurity.com           |
 | GPG public key ID CD31CAFB             |



------------------------------------------------------------------------------
Benefiting from Server Virtualization: Beyond Initial Workload 
Consolidation -- Increasing the use of server virtualization is a top
priority.Virtualization can reduce costs, simplify management, and improve 
application availability and disaster protection. Learn more about boosting 
the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
_______________________________________________
sqlmap-users mailing list
sql...@li...
https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[Steven P. <ste...@gm...>]

Miroslav Stampar wrote:
> hi.
> 
> what are the suggestions for getting real certificate (not self-signed)?
> 
> kr
> 

Basic startcom SSL certs are free.  They are supported by all major
browsers and operating systems, and are verified as poorly^W well as any
other SSL cert.

http://cert.startcom.org/

-- 
 | Steven Pinkham, Security Consultant    |
 | http://www.mavensecurity.com           |
 | GPG public key ID CD31CAFB             |

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[Bernardo D. A. G. <ber...@gm...>]

This would not solve anything as svn command does not check
certificate validity. It would only serve for access from the browser
as far as I know. Nevertheless, we can consider to get a CA signed
certificate.

The problem with svn asking for password should only occur when svn
updating after a long time. A checkout is a solution. However,
chromium and perhaps other browsers can ask for password too, ignore
it.

Bernardo Damele A. G.

This message was sent from a smartphone

On 17 Apr 2011, at 17:12, Miroslav Stampar <mir...@gm...> wrote:

> hi.
>
> what are the suggestions for getting real certificate (not self-signed)?
>
> kr
>
> On Sun, Apr 17, 2011 at 5:56 PM,  <bu...@gm...> wrote:
>>> i've tried this moment (via anonymous) and it worked ok.
>>>
>>> could you please try to go to the web page at that same url using your
>>> browser and tell what's happening? in normal case browser shouldn't
>>> ask you for credentials.
>>>
>>> kr
>>>
>>> On Sun, Apr 17, 2011 at 3:18 PM, Mines <ab...@mi...> wrote:
>>>> Hi,
>>>> It seems sqlmap svn server needs credentials to checkout using commandline
>>>> svn from:
>>>>
>>>> https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap
>>>>
>>>>
>>>> Any ideas?
>>
>> I guess it is just a misinterpretation of the self-signed certificate
>> warning.
>>
>> What about getting a real certificate (for free)?
>>
>> ------------------------------------------------------------------------------
>> Benefiting from Server Virtualization: Beyond Initial Workload
>> Consolidation -- Increasing the use of server virtualization is a top
>> priority.Virtualization can reduce costs, simplify management, and improve
>> application availability and disaster protection. Learn more about boosting
>> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
>> _______________________________________________
>> sqlmap-users mailing list
>> sql...@li...
>> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>>
>
>
>
> --
> Miroslav Stampar
>
> E-mail: miroslav.stampar (at) gmail.com
> PGP Key ID: 0xB5397B1B
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[Miroslav S. <mir...@gm...>]

hi.

what are the suggestions for getting real certificate (not self-signed)?

kr

On Sun, Apr 17, 2011 at 5:56 PM,  <bu...@gm...> wrote:
>> i've tried this moment (via anonymous) and it worked ok.
>>
>> could you please try to go to the web page at that same url using your
>> browser and tell what's happening? in normal case browser shouldn't
>> ask you for credentials.
>>
>> kr
>>
>> On Sun, Apr 17, 2011 at 3:18 PM, Mines <ab...@mi...> wrote:
>>> Hi,
>>> It seems sqlmap svn server needs credentials to checkout using commandline
>>> svn from:
>>>
>>> https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap
>>>
>>>
>>> Any ideas?
>
> I guess it is just a misinterpretation of the self-signed certificate
> warning.
>
> What about getting a real certificate (for free)?
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sqlmap-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sqlmap-users
>



-- 
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B

Re: [sqlmap-users] Fail when trying to perform a checkout from sqlmap trunk

[<bu...@gm...>]

> i've tried this moment (via anonymous) and it worked ok.
> 
> could you please try to go to the web page at that same url using your
> browser and tell what's happening? in normal case browser shouldn't
> ask you for credentials.
> 
> kr
> 
> On Sun, Apr 17, 2011 at 3:18 PM, Mines <ab...@mi...> wrote:
>> Hi,
>> It seems sqlmap svn server needs credentials to checkout using commandline
>> svn from:
>>
>> https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap
>>
>>
>> Any ideas?

I guess it is just a misinterpretation of the self-signed certificate
warning.

What about getting a real certificate (for free)?