Re: [sqlmap-users] MySQL error based technique bug

2013-04-18 Thread Miroslav Stampar
Last one is a benign check for Suhosin patch (having dummy whitespaces): http://192.168.22.128:80/sqlmap/mysql/get_int.php?id=1%20AND%20%28SELECT%208912%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a62776e3a%2C%28SELECT%20%28CASE%20WHEN%20%288150%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2

[sqlmap-users] MySQL error based technique bug

2013-04-18 Thread Konrads Smelkovs
A php/mysql system has a simple, integer SQL injection. The only working technique is error based (verified and successfully exploited manually). Any other techniques cause the server to not reply, jus stall. When using sqlmap with --dbms=mysql and --technique=E, sqlmap successfully does 3 requests