{"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2321","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2321/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2321/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2321/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/2321","id":197740163,"number":2321,"title":"Sqlmap don't see time-based sql injection","user":{"login":"airatkazan","id":18429253,"avatar_url":"https://avatars.githubusercontent.com/u/18429253?v=3","gravatar_id":"","url":"https://api.github.com/users/airatkazan","html_url":"https://github.com/airatkazan","followers_url":"https://api.github.com/users/airatkazan/followers","following_url":"https://api.github.com/users/airatkazan/following{/other_user}","gists_url":"https://api.github.com/users/airatkazan/gists{/gist_id}","starred_url":"https://api.github.com/users/airatkazan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/airatkazan/subscriptions","organizations_url":"https://api.github.com/users/airatkazan/orgs","repos_url":"https://api.github.com/users/airatkazan/repos","events_url":"https://api.github.com/users/airatkazan/events{/privacy}","received_events_url":"https://api.github.com/users/airatkazan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-12-27T18:23:26Z","updated_at":"2016-12-27T18:30:15Z","closed_at":null,"body":"I found time-based sqli with Burp Suite pro (scanner module). I check this vuln with Burp Suite repeater module (change time argument in payload) - vuln work.\r\nBut if i run sqlmap, he don't see this sqli.\r\n\r\nRequest and response unusual:\r\nI send request with POST -> get response with 303 http code (303 code - redirect with GET method) -> get request with GET method to new location.\r\n\r\nSQLi work in first stage: POST->303 code\r\n\r\nStandard POST request\r\nPOST /xxx HTTP/1.1\r\nHost: www.ZZZ.com\r\nUser-Agent: ....\r\n.....\r\narg1=1&arg2=2'%2b(select*from(select(sleep(20)))a)%2b'&arg3=3........\r\n\r\nResponse:\r\n\r\nHTTP/1.1 303 See other\r\nDate: Sat, 24 Dec 2016 18:35:28 GMT\r\nServer: Apache/x.x.xx (Unix) \r\nSet-Cookie: cookie=XXXXXXXXXXXXXXXXXX ; expires=Sun, 29-Dec-2017 04:35:48 GMT; path=/\r\nLocation: https://www.ZZZ.com/new-location\r\nCache-Control: max-age=3600\r\nContent-Length: 4\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\n\r\nBurp Suite payload: **and (select*from(select(sleep(20)))a)--**\r\nAlso Burp found another sqli and in error i found, what database - MySQL\r\n\r\nsqlmap -r post.txt --beep --dbs --dbms=mysql --level=5 --risk=3 \r\nand i say No to sqlmap answer about redirect.\r\nSqlmap don't see sqli..... \r\nmaybe I'm doing something wrong?\r\nOr sqlmap don't search injection in 303 code response?"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/269364110","html_url":"https://github.com/sqlmapproject/sqlmap/issues/2321#issuecomment-269364110","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/2321","id":269364110,"user":{"login":"stamparm","id":921555,"avatar_url":"https://avatars.githubusercontent.com/u/921555?v=3","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"created_at":"2016-12-27T18:30:14Z","updated_at":"2016-12-27T18:30:14Z","body":"What's the content of your request file?\n\nOn Dec 27, 2016 19:23, \"airatkazan\" <notifications@github.com> wrote:\n\n> I found time-based sqli with Burp Suite pro (scanner module). I check this\n> vuln with Burp Suite repeater module (change time argument in payload) -\n> vuln work.\n> But if i run sqlmap, he don't see this sqli.\n>\n> Request and response unusual:\n> I send request with POST -> get response with 303 http code (303 code -\n> redirect with GET method) -> get request with GET method to new location.\n>\n> SQLi work in first stage: POST->303 code\n>\n> Standard POST request\n> POST /xxx HTTP/1.1\n> Host: www.ZZZ.com\n> User-Agent: ....\n> .....\n> arg1=1&arg2=2**'%2b(select*from(select(sleep(20)))a)%2b'**&arg3=3........\n>\n> Response:\n>\n> HTTP/1.1 303 See other\n> Date: Sat, 24 Dec 2016 18:35:28 GMT\n> Server: Apache/x.x.xx (Unix)\n> Set-Cookie: cookie=XXXXXXXXXXXXXXXXXX ; expires=Sun, 29-Dec-2017 04:35:48\n> GMT; path=/\n> Location: https://www.ZZZ.com/new-location\n> Cache-Control: max-age=3600\n> Content-Length: 4\n> Connection: close\n> Content-Type: text/html; charset=utf-8\n>\n> Burp Suite payload: *and (select*from(select(sleep(20)))a)--*\n> Also Burp found another sqli and in error i found, what database - MySQL\n>\n> sqlmap -r post.txt --beep --dbs --dbms=mysql --level=5 --risk=3\n> and i say No to sqlmap answer about redirect.\n> Sqlmap don't see sqli.....\n> maybe I'm doing something wrong?\n> Or sqlmap don't search injection in 303 code response?\n>\n> —\n> You are receiving this because you are subscribed to this thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/sqlmapproject/sqlmap/issues/2321>, or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AA4P02ZIcLB53kFJu-2RolI1Rg424D3Bks5rMVeggaJpZM4LWbte>\n> .\n>\n"}}
{"actor":{"display_login":"stamparm"}}