{"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3135","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3135/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3135/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3135/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/3135","id":328965299,"node_id":"MDU6SXNzdWUzMjg5NjUyOTk=","number":3135,"title":"Can't inject into Oracle database","user":{"login":"tampe125","id":606707,"node_id":"MDQ6VXNlcjYwNjcwNw==","avatar_url":"https://avatars1.githubusercontent.com/u/606707?v=4","gravatar_id":"","url":"https://api.github.com/users/tampe125","html_url":"https://github.com/tampe125","followers_url":"https://api.github.com/users/tampe125/followers","following_url":"https://api.github.com/users/tampe125/following{/other_user}","gists_url":"https://api.github.com/users/tampe125/gists{/gist_id}","starred_url":"https://api.github.com/users/tampe125/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tampe125/subscriptions","organizations_url":"https://api.github.com/users/tampe125/orgs","repos_url":"https://api.github.com/users/tampe125/repos","events_url":"https://api.github.com/users/tampe125/events{/privacy}","received_events_url":"https://api.github.com/users/tampe125/received_events","type":"User","site_admin":false},"labels":[{"id":8192956,"node_id":"MDU6TGFiZWw4MTkyOTU2","url":"https://api.github.com/repos/sqlmapproject/sqlmap/labels/support","name":"support","color":"02d7e1","default":false}],"state":"closed","locked":false,"assignee":{"login":"stamparm","id":921555,"node_id":"MDQ6VXNlcjkyMTU1NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/921555?v=4","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"assignees":[{"login":"stamparm","id":921555,"node_id":"MDQ6VXNlcjkyMTU1NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/921555?v=4","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":6,"created_at":"2018-06-04T08:56:33Z","updated_at":"2018-09-01T14:17:27Z","closed_at":"2018-09-01T14:17:27Z","author_association":"NONE","body":"## What's the problem (or question)?\r\nI can't successfully detect nor extract data from a Oracle blind SQL injection.\r\nBurp can successfully detect the injection with the payload `'||abs(1)||'`, but SQLmap can't. Even if I manually set the injection point, SQLmap is not able to extract any data.\r\n\r\n## Do you have an idea for a solution?\r\nI *think* the problem is that I'm not able to supply all the required params to SQLmap to fully understand what's happening. This injection is a bit tricky, I'll try to explain it without disclosing any sensitive information.  \r\n\r\n## How can we reproduce the issue?\r\nBackground: this is a search endpoint, with a matching percentage of the results. If the injection point is equal to `AAA` (just an example), I get a 100% match, any other value returns a match of 75%.  \r\nI'm able to run manual blind injections by creating a statement that returns `AAA` when true:\r\n```\r\n{\"searchField\": \"AA'|| (CASE WHEN (INSTR((SELECT * FROM v$version WHERE banner LIKE 'Oracle%'), '11') > 0) THEN 'A' ELSE 'X' END) ||'\"}\r\n```\r\nI think I can play with the `--string` param to tell SQLmap when the query is successfully ran, but is there a way to tell it to produce payloads that should be inserted inside the `WHEN` clause and read back the results?\r\n\r\n## What are the running context details?\r\n* Installation method (e.g. `pip`, `apt-get`, `git clone` or `zip`/`tar.gz`): git clone\r\n* Client OS (e.g. `Microsoft Windows 10`): Ubuntu 18.04\r\n* Program version (`python sqlmap.py --version` or `sqlmap --version` depending on installation): 1.2.5.23#dev (commit eb498e6c03d55c273f2a0018185d4db0e0f87662)\r\n* Target DBMS (e.g. `Microsoft SQL Server`): Oracle\r\n* Detected WAF/IDS/IPS protection (e.g. `ModSecurity` or `unknown`): None\r\n* SQLi techniques found by sqlmap (e.g. `error-based` and `boolean-based blind`): None\r\n* Results of manual target assessment (e.g. found that the payload `query=test' AND 4113 IN ((SELECT 'foobar'))-- qKLV` works): See above\r\n"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/417862692","html_url":"https://github.com/sqlmapproject/sqlmap/issues/3135#issuecomment-417862692","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3135","id":417862692,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzg2MjY5Mg==","user":{"login":"stamparm","id":921555,"node_id":"MDQ6VXNlcjkyMTU1NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/921555?v=4","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"created_at":"2018-09-01T14:17:27Z","updated_at":"2018-09-01T14:17:27Z","author_association":"MEMBER","body":"Closing because of inactivity"}}
{"actor":{"display_login":"stamparm"}}