sqlmap-users

Re: [sqlmap-users] Possible Bug

[yonny m. <yo...@go...>]

[17:38:28] [CRITICAL] unhandled exception in sqlmap/0.9-dev, retry your run
with the latest development version from the Subversion repository. If the
exception persists, please send by e-mail to
sql...@li... the following text and any information
required to reproduce the bug. The developers will try to reproduce the bug,
fix it accordingly and get back to you.
sqlmap version: 0.9-dev (r3226)
Python version: 2.6.5
Operating system: posix
Command line: /pentest/database/sqlmap/sqlmap.py --level 5 --risk 3
--parse-errors --msf-path /pentest/exploits/framework3 --read-file
/etc/passwd --time-sec 10 --method=POST --data=user_name=loan&password=2121
--threads 1 --timeout 39 -u **********************************************
--dbms mysql --flush-session
Technique: ERROR
Back-end DBMS: MySQL (fingerprinted)
Traceback (most recent call last):
  File "/pentest/database/sqlmap/sqlmap.py", line 82, in main
    start()
  File "/pentest/database/sqlmap/lib/controller/controller.py", line 414, in
start
    action()
  File "/pentest/database/sqlmap/lib/controller/action.py", line 123, in
action
    conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
  File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 285,
in readFile
    newFileContent += chunk
TypeError: cannot concatenate 'str' and 'NoneType' objects

Re: [sqlmap-users] Possible Bug

[Bernardo D. A. G. <ber...@gm...>]

Hi yonny.

On 6 February 2011 14:44, yonny mutai <yo...@go...> wrote:
> ...
> Command line: /pentest/database/sqlmap/sqlmap.py --level 5 --risk 3
> --parse-errors --msf-path /pentest/exploits/framework3 --read-file
> /etc/passwd --time-sec 10 --method=POST --data=user_name=loan&password=2121
> --threads 1 --timeout 39 -u **********************************************
> --dbms mysql --flush-session
> Technique: ERROR
> Back-end DBMS: MySQL (fingerprinted)
> Traceback (most recent call last):
>   File "/pentest/database/sqlmap/sqlmap.py", line 82, in main
>     start()
>   File "/pentest/database/sqlmap/lib/controller/controller.py", line 414, in
> start
>     action()
>   File "/pentest/database/sqlmap/lib/controller/action.py", line 123, in
> action
>     conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
>   File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 285,
> in readFile
>     newFileContent += chunk
> TypeError: cannot concatenate 'str' and 'NoneType' objects

We have been reported this bug since 24 hours by another user. We are
on the case. If you svn update, you'll see that the exception is
handled correctly now, no traceback anymore.
Support to read files on MySQL via error-based though will come as
soon as we fix an important bug related to MySQL trimming of output in
error-based payloads.

Thanks for reporting.

Cheers,
-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F

Re: [sqlmap-users] Possible Bug

[Bernardo D. A. G. <ber...@gm...>]

Hi yonny,

On 6 February 2011 15:21, Bernardo Damele A. G.
<ber...@gm...> wrote:
> ...
>>     conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
>>   File "/pentest/database/sqlmap/plugins/generic/filesystem.py", line 285,
>> in readFile
>>     newFileContent += chunk
>> TypeError: cannot concatenate 'str' and 'NoneType' objects
>
> We have been reported this bug since 24 hours by another user. We are
> on the case. If you svn update, you'll see that the exception is
> handled correctly now, no traceback anymore.
> Support to read files on MySQL via error-based though will come as
> soon as we fix an important bug related to MySQL trimming of output in
> error-based payloads.

We have done the fix and re-enabled file retrieval via SQL injection
techniques on MySQL one.

Cheers,
Bernardo


-- 
Bernardo Damele A. G.

E-mail / Jabber: bernardo.damele (at) gmail.com
Mobile: +447788962949 (UK 07788962949)
PGP Key ID: 0x05F5A30F