Skip to content

Injection being made before the header (SOAP)  #2532

Description

@mazoz

I believe it is a mistake, because the same request file and the same command (sqlmap -r file.txt ...) was used a few days ago and it worked normally, now it does not work anymore, it seems that the request is being made before the header of the soap and not in the body, even when i use * or i indicate the parameter for injection. It is happening with all request files from other hosts that also worked but did not work anymore. I hope it's a valid issue. Thank you!

Follows logs.

# tested sqlmap --version 1.1.5.5#dev (original version now)
# tested sqlmap --version 1.1.5#stable

===============

# TRY 1

sqlmap -r soap_request1.txt --banner

[00:28:17] [INFO] testing if POST parameter '<SOAP-ENV:Envelopexmlns:SOAP-ENV' is dynamic
[00:28:17] [WARNING] POST parameter '<SOAP-ENV:Envelopexmlns:SOAP-ENV' does not appear to be dynamic
[00:28:17] [WARNING] heuristic (basic) test shows that POST parameter '<SOAP-ENV:Envelopexmlns:SOAP-ENV' might not be injectable

===============

# TRY 2

sqlmap -r soap_request1.txt -p urn:strTicket

[00:29:39] [INFO] parsing HTTP request from 'soap_request1.txt'
SOAP/XML data found in POST data. Do you want to process it? [Y/n/q] 
[00:29:41] [CRITICAL] all testable parameters you provided are not present within the given request data

================

SOAP REQUEST (soap_request1.txt)

POST /path1/path2/asmx.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/Check"
Content-Length: 599
Referer: http://sub.host.com/path1/path2/asmx.asmx?WSDL
Host: sub.host.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:Check>
           <urn:strTicket>1</urn:strTicket>
           <urn:strCh>1</urn:strCh>
        </urn:Check>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

===============

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions