{"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3063","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3063/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3063/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3063/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/3063","id":316579454,"number":3063,"title":"help me stam netsparker yes sqlmap no :(","user":{"login":"serdaresen06","id":37293862,"avatar_url":"https://avatars0.githubusercontent.com/u/37293862?v=4","gravatar_id":"","url":"https://api.github.com/users/serdaresen06","html_url":"https://github.com/serdaresen06","followers_url":"https://api.github.com/users/serdaresen06/followers","following_url":"https://api.github.com/users/serdaresen06/following{/other_user}","gists_url":"https://api.github.com/users/serdaresen06/gists{/gist_id}","starred_url":"https://api.github.com/users/serdaresen06/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serdaresen06/subscriptions","organizations_url":"https://api.github.com/users/serdaresen06/orgs","repos_url":"https://api.github.com/users/serdaresen06/repos","events_url":"https://api.github.com/users/serdaresen06/events{/privacy}","received_events_url":"https://api.github.com/users/serdaresen06/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-22T13:32:01Z","updated_at":"2018-04-22T13:43:09Z","closed_at":null,"author_association":"NONE","body":"nesparker scan\r\n![screenshot_1](https://user-images.githubusercontent.com/37293862/39095477-b4b7a42a-4649-11e8-932c-de064122d31a.png)\r\n![screenshot_3png](https://user-images.githubusercontent.com/37293862/39095478-b59db546-4649-11e8-92a9-faa697bed67a.png)\r\n\r\n\r\nNetSparker I crawled the site netsparker found the database name even, but with SQLMap I did not get anything out of my help\r\n\r\ncopy sqlmap command\r\nsqlmap no injectıon :(\r\nsqlmap scan\r\n       __H__\r\n ___ ___[,]_____ ___ ___  {1.2.4.19#dev}\r\n|_ -| . [,]     | .'| . |\r\n|___|_  [)]_|_|_|__,|  _|\r\n      |_|V          |_|   http://sqlmap.org\r\n\r\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual\r\n consent is illegal. It is the end user's responsibility to obey all applicable\r\nlocal, state and federal laws. Developers assume no liability and are not respon\r\nsible for any misuse or damage caused by this program\r\n\r\n[*] starting at 16:24:20\r\n\r\n[16:24:20] [INFO] loading tamper module 'charencode'\r\n[16:24:21] [INFO] testing connection to the target URL\r\n[16:24:24] [CRITICAL] previous heuristics detected that the target is protected\r\nby some kind of WAF/IPS/IDS\r\n[16:24:24] [INFO] testing if the target URL content is stable\r\n[16:24:24] [WARNING] target URL content is not stable. sqlmap will base the page\r\n comparison on a sequence matcher. If no dynamic nor injectable parameters are d\r\netected, or in case of junk results, refer to user's manual paragraph 'Page comp\r\narison'\r\nhow do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c\r\n[16:24:28] [INFO] searching for dynamic content\r\n[16:24:56] [INFO] dynamic content marked for removal (2 regions)\r\n[16:24:56] [CRITICAL] target URL content appears to be heavily dynamic. sqlmap i\r\ns going to retry the request(s)\r\n[16:26:23] [WARNING] target URL content appears to be too dynamic. Switching to\r\n'--text-only'\r\n[16:26:23] [INFO] testing for SQL injection on POST parameter 'ctl00$txtforPassw\r\nord'\r\n[16:26:23] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\r\n[16:26:33] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\r\n[16:26:43] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)\r\n'\r\n[16:26:53] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (Gen\r\neric comment)'\r\n[16:26:53] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Gene\r\nric comment)'\r\n[16:26:53] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'\r\n[16:26:54] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL) (origi\r\nnal value)'\r\n[16:26:54] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'\r\n[16:26:55] [INFO] testing 'Boolean-based blind - Parameter replace (CASE) (origi\r\nnal value)'\r\n[16:26:55] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Par\r\nameter replace'\r\n[16:26:56] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - ORD\r\nER BY clause'\r\n[16:26:57] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Sta\r\ncked queries (IF)'\r\n[16:26:57] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o\r\nr HAVING clause (IN)'\r\n[16:27:02] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or\r\n HAVING clause (IN)'\r\n[16:27:07] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o\r\nr HAVING clause (CONVERT)'\r\n[16:27:13] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or\r\n HAVING clause (CONVERT)'\r\n[16:27:18] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o\r\nr HAVING clause (CONCAT)'\r\n[16:27:24] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or\r\n HAVING clause (CONCAT)'\r\n[16:27:29] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter r\r\neplace'\r\n[16:27:29] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'\r\n[16:27:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)\r\n'\r\n[16:27:30] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'\r\n[16:27:35] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (hea\r\nvy query)'\r\n[16:27:40] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heav\r\ny query)'\r\n[16:27:45] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'\r\n[16:28:47] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns\r\n'\r\nit is not recommended to perform extended UNION tests if there is not at least o\r\nne other (potential) technique found. Do you want to skip? [Y/n] Y\r\n[16:30:50] [WARNING] POST parameter 'ctl00$txtforPassword' does not seem to be i\r\nnjectable\r\n[16:30:50] [CRITICAL] all tested parameters do not appear to be injectable. Try\r\nto increase values for '--level'/'--risk' options if you wish to perform more te\r\nsts\r\n[16:30:50] [WARNING] HTTP error codes detected during run:\r\n500 (Internal Server Error) - 886 times\r\n\r\n[*] shutting down at 16:30:50\r\n\r\n\r\nC:\\Python27\\sqlmap> --dbms=\"Microsoft SQL Server\"- -disable-precon --time-sec 20 --text-only --tamper charencode.py --timeout=30 --dbs\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/383382602","html_url":"https://github.com/sqlmapproject/sqlmap/issues/3063#issuecomment-383382602","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3063","id":383382602,"user":{"login":"neo1230","id":38433624,"avatar_url":"https://avatars0.githubusercontent.com/u/38433624?v=4","gravatar_id":"","url":"https://api.github.com/users/neo1230","html_url":"https://github.com/neo1230","followers_url":"https://api.github.com/users/neo1230/followers","following_url":"https://api.github.com/users/neo1230/following{/other_user}","gists_url":"https://api.github.com/users/neo1230/gists{/gist_id}","starred_url":"https://api.github.com/users/neo1230/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neo1230/subscriptions","organizations_url":"https://api.github.com/users/neo1230/orgs","repos_url":"https://api.github.com/users/neo1230/repos","events_url":"https://api.github.com/users/neo1230/events{/privacy}","received_events_url":"https://api.github.com/users/neo1230/received_events","type":"User","site_admin":false},"created_at":"2018-04-22T13:43:09Z","updated_at":"2018-04-22T13:43:09Z","author_association":"NONE","body":"I am going to forget about downloading my MySQL injection because of all these problems \nI want like to make my own sql I don’t know how to do it should I use notepad or notepad++ or something else\nAnd I would like it if you tell me the commands I should use to make MySQL and I would like it if you tell me which programme I should I use to create MySQL injection and don’t bother trying to fix the mysql for me you did  a good job but it consumes to much of my time\n\n\nSent from Mail for Windows 10\n\nFrom: serdaresen06\nSent: 22 April 2018 14:32\nTo: sqlmapproject/sqlmap\nCc: Subscribed\nSubject: [sqlmapproject/sqlmap] help me stam netsparker yes sqlmap no :((#3063)\n\nnesparker scan\n\n\nNetSparker I crawled the site netsparker found the database name even, but with SQLMap I did not get anything out of my help\ncopy sqlmap command\nsqlmap no injectıon :(\nsqlmap scan\nH\n___ [,]__ ___ ___ {1.2.4.19#dev}\n|_ -| . [,] | .'| . |\n|| [)]|||__,| |\n||V || http://sqlmap.org\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual\nconsent is illegal. It is the end user's responsibility to obey all applicable\nlocal, state and federal laws. Developers assume no liability and are not respon\nsible for any misuse or damage caused by this program\n[*] starting at 16:24:20\n[16:24:20] [INFO] loading tamper module 'charencode'\n[16:24:21] [INFO] testing connection to the target URL\n[16:24:24] [CRITICAL] previous heuristics detected that the target is protected\nby some kind of WAF/IPS/IDS\n[16:24:24] [INFO] testing if the target URL content is stable\n[16:24:24] [WARNING] target URL content is not stable. sqlmap will base the page\ncomparison on a sequence matcher. If no dynamic nor injectable parameters are d\netected, or in case of junk results, refer to user's manual paragraph 'Page comp\narison'\nhow do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c\n[16:24:28] [INFO] searching for dynamic content\n[16:24:56] [INFO] dynamic content marked for removal (2 regions)\n[16:24:56] [CRITICAL] target URL content appears to be heavily dynamic. sqlmap i\ns going to retry the request(s)\n[16:26:23] [WARNING] target URL content appears to be too dynamic. Switching to\n'--text-only'\n[16:26:23] [INFO] testing for SQL injection on POST parameter 'ctl00$txtforPassw\nord'\n[16:26:23] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\n[16:26:33] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'\n[16:26:43] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)\n'\n[16:26:53] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (Gen\neric comment)'\n[16:26:53] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (Gene\nric comment)'\n[16:26:53] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL)'\n[16:26:54] [INFO] testing 'Boolean-based blind - Parameter replace (DUAL) (origi\nnal value)'\n[16:26:54] [INFO] testing 'Boolean-based blind - Parameter replace (CASE)'\n[16:26:55] [INFO] testing 'Boolean-based blind - Parameter replace (CASE) (origi\nnal value)'\n[16:26:55] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Par\nameter replace'\n[16:26:56] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - ORD\nER BY clause'\n[16:26:57] [INFO] testing 'Microsoft SQL Server/Sybase boolean-based blind - Sta\ncked queries (IF)'\n[16:26:57] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o\nr HAVING clause (IN)'\n[16:27:02] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or\nHAVING clause (IN)'\n[16:27:07] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o\nr HAVING clause (CONVERT)'\n[16:27:13] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or\nHAVING clause (CONVERT)'\n[16:27:18] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o\nr HAVING clause (CONCAT)'\n[16:27:24] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or\nHAVING clause (CONCAT)'\n[16:27:29] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter r\neplace'\n[16:27:29] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'\n[16:27:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)\n'\n[16:27:30] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)'\n[16:27:35] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (hea\nvy query)'\n[16:27:40] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heav\ny query)'\n[16:27:45] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'\n[16:28:47] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns\n'\nit is not recommended to perform extended UNION tests if there is not at least o\nne other (potential) technique found. Do you want to skip? [Y/n] Y\n[16:30:50] [WARNING] POST parameter 'ctl00$txtforPassword' does not seem to be i\nnjectable\n[16:30:50] [CRITICAL] all tested parameters do not appear to be injectable. Try\nto increase values for '--level'/'--risk' options if you wish to perform more te\nsts\n[16:30:50] [WARNING] HTTP error codes detected during run:\n500 (Internal Server Error) - 886 times\n[*] shutting down at 16:30:50\nC:\\Python27\\sqlmap>\n—\nYou are receiving this because you are subscribed to this thread.\nReply to this email directly, view it on GitHub, or mute the thread.\n\n"}}
{"actor":{"display_login":"neo1230"}}