sqlmap-users

[sqlmap-users] trouble with "Accept-Encoding"

[Philippe A. R. S. <sc...@co...>]

Hi,

using the current svn version sql-map wouldn't find an injection (using
--string).
In verbose output I saw that gzip Content-Encoding was used.
This scrambles the -v5 output badly.

After removing the appropriate line (390) from ./lib/core/option.py the
injection was succesfully discovered.

I didn't look any further. But there seems to be something broken with
the handling of encoded responses.

It would be helpful to be able to disable encoding as an option and if
-v5 supplied the decoded response (as an option?).

BTW, the server was:
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727


Regards,

Philippe

Re: [sqlmap-users] trouble with "Accept-Encoding"

[Bernardo D. A. G. <ber...@gm...>]

Hi Philippe,

Philippe A. R. Schaeffer wrote:
> ...
> using the current svn version sql-map wouldn't find an injection (using
> --string).
> In verbose output I saw that gzip Content-Encoding was used.
> This scrambles the -v5 output badly.
> 
> After removing the appropriate line (390) from ./lib/core/option.py the
> injection was succesfully discovered.
> ...

Thanks for reporting this problem. I fixed it and commited on svn. Now
you can provide extra headers with option --headers and by default
sqlmap only adds Accept, Accept-Language and Accept-Charset, not
Encoding headers anymore.

> if -v5 supplied the decoded response (as an option?).

That will come in the long run.

Cheers,
-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobiles: +39-3493821385 (IT), +44-(0)7788962949 (UK)
PGP Key ID: 0x05F5A30F

[sqlmap-users] Feature request: Filter evasion

[Philippe A. R. S. <sc...@co...>]

Hi,

testing an SQL-I (and talking to the responsible admins) I came across a
filter that is blocking any requests containing 2 of the strings given
below.

It seems to be possible to evade the filter by including comments (e.g.
"se/**/lect" - for MSSQL).
I've done some tests by changing xml/queries.xml which is a rather dirty
hack.

It would be a nice feature to use such evasion techniques as an option
in sql-map.

Regards,

Philippe

alter
backup
begin
cast
convert
create
cursor
database
declare
delete
deny
drop
dt_
dump
exec
execute
exists
from
function
grant
identity
index
insert
into
master
ms_
on
procedure
rollback
schema
select
set
sp_
statistics
table
transaction
trigger
truncate
update
user
view
where
xp_

Re: [sqlmap-users] Feature request: Filter evasion

[Bernardo D. A. G. <ber...@gm...>]

Hi Philippe,

On Tue, Dec 9, 2008 at 13:14, Philippe A. R. Schaeffer
<sc...@co...> wrote:
> ...
> It would be a nice feature to use such evasion techniques as an option
> in sql-map.

The IDS/IPS filter evasion will come in the long run.

Cheers,
-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobiles: +39-3493821385 (IT), +44-(0)7788962949 (UK)
PGP Key ID: 0x05F5A30F