Hello, I have a problem regarding MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
sqlmap manages to sleep the database using the payload ((SELECT 9607 FROM (SELECT(SLEEP(10)))nGXq))
the problem is that when sqlmap checks if the injection point is a false positive it uses a payload that looks like this
((SELECT 3545 FROM (SELECT(SLEEP(10-(IF(16=16,0,10)))))EGID))
By doing some manual testing I figured out that the reason the payload containing the IF statement does not work is because IF statements get filtered out. I have manually verified this by using a payload that looks like this
((SELECT (CASE WHEN (1=1) THEN (SELECT SLEEP(5)) ELSE 0 END) FROM (SELECT(0))kJCC))
The payload successfully sleeps the database aswell as checking if 1=1
I've tried to tell sqlmap not to use the IF statement when verifying for false positives but I haven't been able to figure out how. I tried using --tamper but when encoding/obfuscating the payload it simply doesn't work. Is it possible to make a custom payload within the time_blind.xml that works by creating payloads like the one that I created? And if so, how?
Do you have any other recommendations on what I can do to make the sql injection successful?
Hello, I have a problem regarding MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
sqlmap manages to sleep the database using the payload ((SELECT 9607 FROM (SELECT(SLEEP(10)))nGXq))
the problem is that when sqlmap checks if the injection point is a false positive it uses a payload that looks like this
((SELECT 3545 FROM (SELECT(SLEEP(10-(IF(16=16,0,10)))))EGID))
By doing some manual testing I figured out that the reason the payload containing the IF statement does not work is because IF statements get filtered out. I have manually verified this by using a payload that looks like this
((SELECT (CASE WHEN (1=1) THEN (SELECT SLEEP(5)) ELSE 0 END) FROM (SELECT(0))kJCC))
The payload successfully sleeps the database aswell as checking if 1=1
I've tried to tell sqlmap not to use the IF statement when verifying for false positives but I haven't been able to figure out how. I tried using --tamper but when encoding/obfuscating the payload it simply doesn't work. Is it possible to make a custom payload within the time_blind.xml that works by creating payloads like the one that I created? And if so, how?
Do you have any other recommendations on what I can do to make the sql injection successful?
info:
python sqlmap.py -r C:\Users\xxx\Desktop\sqlmapproject-sqlmap-54e953d\requestx.txt -p order --threads=10 --level=5 --risk=3 -v 3 --random-agent --technique=T --prefix="(" --suffix=")" --dbms=mysql --time-sec=10
The text was updated successfully, but these errors were encountered: