0

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo)

However, using SQLMAP I can't enumerate anything else - where it is tables within the DB or user hashes... which is what I want to get.

Any tips? Here is what I have used. I found a sqldump.sql file in the root with the name of two tables called products and secrets if that helps?

root@kali:~# sqlmap -t --cookie="PHPSESSID=XXX" 
-u https://127.0.0.1/page.php 
--data="timestamp=1461171839" 
--method=POST 
--threads=10 
--no-cast 
-D=dbInfo
tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes 
--level=5 
--risk=3 
--dbms=mysql
4
  • The motivation of this question seems suspicious. If this is really your server, and you "found" a dump file in the root of the site and managed to identify the name of a database, you should probably give up on trying to find more and ask yourself why such obvious things have been overlooked. If it's not your server, then I, for one, am not willing to help you breach it further. Avoiding SQL injection is simple -- write correct code that handles query parameters properly. No externally-applied heuristics needed. Apr 24, 2016 at 17:30
  • It's a server on our network setup for testing. It's almost like an internal CTF but not one if that makes sense.
    – pee2pee
    Apr 24, 2016 at 17:36
  • Your question isn't clear. Did you manage to dump anything? What is your specific question? If this is a CTF do you know that there's some vuln? Do you have a flag you're looking for?
    – Daisetsu
    Apr 24, 2016 at 21:23
  • It's an internal test. The only thing I managed to get is the name of the DB. The 'flag' is the user's password.
    – pee2pee
    Apr 24, 2016 at 21:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.