1

I was performing SQL injection through sqlmap and it showed that the parameter is vulnerable but it is only extracting random bits instead of actual data.

I am pasting extracted material here.

[00:12:27] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 8 (MariaDB fork)
[00:12:27] [INFO] fetching current user
[00:12:28] [INFO] resumed: \x021W@{\xf0Q\x07\xf9`x~\x07\xfc/
current user: '1W@{\xf0Q\xf9`x~\xfc/'
[00:12:28] [INFO] fetching server hostname
[00:12:28] [INFO] resumed: b{|5Xfpt\x18\x1df\x02\xa2/\x16p{\x07\xfd\x7f|>
hostname: 'b{|5Xfpt↑↔f☻\xa2/▬p{\xfd⌂|>'
[00:12:28] [INFO] fetching database names
[00:12:28] [INFO] fetching number of databases
[00:12:28] [INFO] resumed: 8930
[00:12:28] [INFO] resumed: 0\xff\x11R6
[00:12:28] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[00:12:28] [INFO] retrieved:
[00:12:30] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[00:12:30] [INFO] resumed: ~y\x84\x00\x07\xad\x7f|xx\x07\xfe\x07\xf8M
[00:12:30] [INFO] resumed: \xc1\xfc\x7f\x7f\x07\xf4\xf8@t\x07\xf9\x7f\x07\xf9\x1dx\x07\xe2\x07\xff\xe4\x050\x05_\xf0\x0b`~\x7f@`_`\x03P?\xfc\x80\x03\xe7\x10\x00\x07\xff\xff\xe1
[00:12:30] [INFO] resumed: ~\xff\xf8\x07\x88\x07\x97W\x0c\x07\xe0u\x7f\x04\xb5u|y\x7fP@\x07\xff
[00:12:30] [INFO] retrieved: A"}%
[00:12:51] [INFO] resumed: \x048z
[00:12:51] [INFO] resumed: \x07\xe2\x03\xfc\xff\xe6
[00:12:51] [INFO] resumed: tHh\x07\xc4\x04@\x07\x0ej\x07\xe4
[00:12:51] [INFO] resumed: H`?{
[00:12:51] [INFO] retrieved:
[00:12:53] [INFO] retrieved:
[00:12:55] [INFO] resumed: A
[00:12:55] [INFO] retrieved:
[00:12:57] [INFO] resumed: r\x07\xf6\x04q\xba\xff\xfe\x03\xff\xfe \x04\x7f\xe4{\xff\xc2\xfc\x01\x07\xfc\xe1\x00\x7f@?\xff\x90\x7f\x07\xf5|}\xfd\x00\x00p\xff\xfeo\x07\xfe
[00:12:57] [INFO] resumed: \xfe\x80\x00\x07\xff\xff
[00:12:57] [INFO] resumed: F\x00
[00:12:57] [INFO] resumed: \xff@\x00\xff\x83v`~\x7f
[00:12:57] [INFO] retrieved: ec
[00:13:08] [INFO] retrieved: ;
[00:13:15] [INFO] retrieved:
[00:13:17] [INFO] resumed: 9\x00\x00\x07\x10\x07\x88\x04@? \x00
[00:13:17] [INFO] retrieved:
[00:13:19] [INFO] retrieved: \xfeO\xe8 \xff \xfc\xff\xfb3 \xce\xf2k\xff\xe0rp`` o  S\xa1\xab
[00:17:35] [INFO] retrieved: "rAjR^^!
[00:18:16] [INFO] resumed: 8\xe4\x00
[00:18:16] [INFO] retrieved:
[00:18:18] [INFO] retrieved:  \xf7X
[00:18:38] [INFO] resumed: \xff\x08
[00:18:38] [INFO] resumed: \x03\xff\xf4\x00\xfe\xb5
[00:18:38] [INFO] resumed: |\x07\xff\x07\xff\x18\x07\xff\xf2\x07\r\xff\x92\x03\xff?\xfe`\x07\xff m~\xe1\x00\x03\xf4\x00\x00
[00:18:38] [INFO] resumed: \x07\xe2\xae`
[00:18:38] [INFO] resumed: \x06\xb0\x00\xff\xf8?\xf9\x00\xff\xf8\x07\x10
[00:18:38] [INFO] resumed: \x07\xff\xc8k.\xfe\xb6C\x07\xe2\x07\xfe\x07\x8f\xfc\x07\xfcrpv|\x07\xfe\x07L\x7f\x18\x07\x10l~\x07\xfc\x07\x01P\xff\xff`\x7f`\xba@
[00:18:38] [INFO] resumed: \x84\x00
[00:18:38] [INFO] retrieved: @^Th  r1
[00:19:19] [INFO] retrieved: P
[00:19:25] [INFO] retrieved: p}s
[00:19:41] [INFO] resumed: ~\xff\xf0/
[00:19:41] [INFO] retrieved:
[00:19:43] [INFO] resumed: ?\x1f\xf9/\xff\xff\xf4k0~@\xe0\x83\x07\xf0\x7f\x07\xc2~\x07\x88\x7f\x07\xf8mx\x07\xe2\xff\xf9\xe8\x7f`~>\x041u\xff\xfe\x07\xff\xf9\x04@
[00:19:43] [INFO] resumed: \xf8@\xfa\xbf\xf2
[00:19:43] [INFO] retrieved:
[00:19:45] [INFO] resumed: \xff\xff@
[00:19:45] [INFO] resumed: \x07\xff\xeb\xf4\x00\x00\x07\x87@?\xdd\x00
[00:19:45] [INFO] resumed: \xfc
[00:19:45] [INFO] retrieved:
[00:19:47] [INFO] retrieved: #W@p\x84 ` \xf3,?\xff\xfb\xff\xf0 ` ez \xff\xee~ \xe1\xff\xe1W\xff\xc2#\xcf  \xf6f\xf8@pz<\xf59\xc1\xc2?\xff
[00:27:38] [INFO] retrieved: @ \xe8 \xffdh\xff\xf6 \xfc | \xe4u   \xfe @ \xe3\xc8k 0   q +  \xfe\xc1  \xf1   \xe8  \xff\x84\xfeN \xfc ~\xc2  \xd5 v~x`

Please anyone who could help me with this would be very appreciated.

UndercoverDog
  • 612
  • 2
  • 17
Skull dev
  • 11
  • 2
  • Try to dump again with the switch --fresh-queries to see if it was only a random bug. Maybe the DB is in a foreign language and the characters cant be interpreted correctly? Look in the created .csv file if there is this bug aswell – UndercoverDog Aug 20 '22 at 09:20
  • I try but didn't work at all retrieve this result. `[02:35:38] [INFO] retrieved: @i`r current user: '@i`r' [02:36:01] [INFO] fetching server hostname [02:36:01] [INFO] retrieved: hostname: ''fetching current database [02:36:11] [INFO] retrieved: A4 available databases [1]: [*] A4 – Skull dev Aug 20 '22 at 09:37
  • Maybe try --hex so it outputs in hexadecimal. Then go on a Hex to unicode converter site and look If you get a result – UndercoverDog Aug 20 '22 at 10:56
  • Also try maybe an other dumping technique if avalible (--tech=BEUSQ) BE=blind error based;U=Union Select;SQ=Stacked Queries. For example to only try Union queries use --tech=U – UndercoverDog Aug 20 '22 at 11:03
  • Thanks for the help but sill no success and same result – Skull dev Aug 20 '22 at 19:12
  • Use verbose mode and manually copy paste the get/post requests in (Tor) browser. If you still get weird results, the injection point(s) might be a false positive? – UndercoverDog Aug 20 '22 at 19:18
  • 1
    Nothing works in my case i guess it false positive. I do try to convert random bits into hex and then into text but nothing work – Skull dev Aug 22 '22 at 12:20
  • In which language/from which country is the website (Some of the Hex character may be russian unicode(?))? Also let sqlmap dump some rows and then look what the result is in the output table. Otherwise you may have been unlucky and its a false positive – UndercoverDog Aug 22 '22 at 14:58
  • 1
    The website belongs to France. Could you please do me a favor. Please write down the complete sqlmap commend which were telling me to do so, because i try everything in my knowledge – Skull dev Aug 24 '22 at 14:11
  • 'sqlmap -u [url] -p [Parameter to inject like "?id=0"] --technique=[try either B,E,U or SQ] --hex --eta --fresh-queries' would be my try (only use if you have permission from the Site owner) – UndercoverDog Aug 24 '22 at 14:55
  • Sure. Let me ask them and then let you know. Btw thanks a ton – Skull dev Aug 24 '22 at 15:19
  • Normally U should ask them before even doing any pentests! – UndercoverDog Aug 24 '22 at 15:30
  • 1
    True but it's not a bug bounty though. It a private client and they allow me to do that. Soo I am trying – Skull dev Aug 25 '22 at 22:40
  • 1
    Found some database named its like.: available database A4. But unfortunately they didn't accept it as that is not the name of there database. – Skull dev Sep 02 '22 at 11:53

0 Answers0