Repository navigation
--technique=B --sql-shell not working properly for ... LIMIT m,n #209
Description
Not working properly:
... --sql-query="SELECT id FROM users LIMIT 0, 5" -z "ign,flu,bat,tec=B"
Those limit boundaries are not properly unpacked/used:
back-end DBMS: MySQL >= 5.0.0
[13:15:04] [INFO] fetching SQL SELECT statement query output: 'SELECT id FROM users LIMIT 0, 5'
[13:15:04] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 64
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 32
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 16
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 8
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 4
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 2
[13:15:04] [PAYLOAD] 1 AND ORD(MID((SELECT IFNULL(CAST(id AS CHAR),0x20) FROM users),1,1)) > 1
[13:15:04] [INFO] retrieved:
[13:15:04] [DEBUG] performed 7 queries in 0 seconds
[13:15:04] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' and/or switch '--hex'
SELECT id FROM users LIMIT 0, 5: None
Activity
stamparm commentedon Oct 20, 2012
Found while working on Issue #208
Fix for an Issue #209
stormwin commentedon Oct 20, 2012
still got crash after update
[13:34:17] [CRITICAL] unhandled exception in sqlmap/1.0-dev-261b286, retry your run with the latest development version from the GitHub repository. If the exception persists, please send by e-mail to 'sqlmap-users@lists.sourceforge.net' or open a new issue at 'https://github.com/sqlmapproject/sqlmap/issues/new' with the following text and any information required to reproduce the bug. The developers will try to reproduce the bug, fix it accordingly and get back to you.
sqlmap version: 1.0-dev-261b286
Python version: 2.6.5
Operating system: posix
Command line: sqlmap.py -u ******************************************************** --forms --level 7 --risk 5 --dbms=sqlite --sql-query=SELECT id FROM accounts LIMIT 0, 5
Technique: BOOLEAN
Back-end DBMS: SQLite (fingerprinted)
Traceback (most recent call last):
File "/root/sqlmap/_sqlmap.py", line 72, in main
start()
File "/root/sqlmap/lib/controller/controller.py", line 568, in start
action()
File "/root/sqlmap/lib/controller/action.py", line 136, in action
conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
File "/root/sqlmap/plugins/generic/custom.py", line 48, in sqlQuery
output = inject.getValue(query, fromUser=True)
File "/root/sqlmap/lib/request/inject.py", line 423, in getValue
value = __goInferenceProxy(query, fromUser, batch, unpack, charsetType, firstChar, lastChar, dump)
File "/root/sqlmap/lib/request/inject.py", line 208, in __goInferenceProxy
stopLimit = int(stopLimit)
TypeError: int() argument must be a string or a number, not 'NoneType'
stamparm commentedon Oct 20, 2012
That's a different crash :) I'll investigate
On Sat, Oct 20, 2012 at 1:40 PM, Vlado Velichkovski <
notifications@github.com> wrote:
Miroslav Stampar
http://about.me/stamparm
Minor update for Issue #209
Minor update for Issue #209
stamparm commentedon Oct 21, 2012
@stormwin fixed
stormwin commentedon Oct 21, 2012
tested, works great on 21481df