+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [TUT] Use An SQL Injection to Hack a Website on Windows Using SQLMap[TUT] (/showthread.php?tid=4645201)
* - Coeg - Feb 22, 2015
why i get a message like these?
[11:13:03] [WARNING] using unescaped version of the test because of zero knowled
ge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[11:17:17] [WARNING] GET parameter 'page' is not injectable
[11:17:17] [CRITICAL] all tested parameters appear to be not injectable. Try to
increase '--level'/'--risk' values to perform more tests. Also, you can try to r
erun by providing either a valid value for option '--string' (or '--regexp') If
you suspect that there is some kind of protection mechanism involved (e.g. WAF)
maybe you could retry with an option '--tamper' (e.g. '--tamper=space2comment')
What do i do to fix that?
* - Abdilo - Feb 23, 2015
(Feb 22, 2015 11:05 PM)Coeg Wrote: why i get a message like these?that means from the tests it did it is not vuln to sqli
[11:13:03] [WARNING] using unescaped version of the test because of zero knowled
ge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[11:17:17] [WARNING] GET parameter 'page' is not injectable
[11:17:17] [CRITICAL] all tested parameters appear to be not injectable. Try to
increase '--level'/'--risk' values to perform more tests. Also, you can try to r
erun by providing either a valid value for option '--string' (or '--regexp') If
you suspect that there is some kind of protection mechanism involved (e.g. WAF)
maybe you could retry with an option '--tamper' (e.g. '--tamper=space2comment')
What do i do to fix that?
do --level=4 --risk=4
* - Obimoto - Feb 23, 2015
(Feb 23, 2015 12:58 AM)Grey Hat Mafias Bitch Wrote: that means from the tests it did it is not vuln to sqliYeah the last part is this ^^^
do --level=4 --risk=4
The first part is saying it does not know what the back-end dbms is, so by default it is using the unescaped version...
You would use the -dbms option to fix that...
i.e.
-dbms=MySql
* - Coeg - Feb 23, 2015
I'm trying to inject this site with sqlmap
www*trisakti*ac*id/?page=jobs&ID=1105
Could you help and show me how to inject that site please?
* - Abdilo - Feb 24, 2015
(Feb 23, 2015 08:02 PM)Coeg Wrote: I'm trying to inject this site with sqlmapim going to laugh my ass off if there is no sqli and you think all sites are vuln to sqli because they have ?id=
www*trisakti*ac*id/?page=jobs&ID=1105
Could you help and show me how to inject that site please?
* - Arka - Feb 24, 2015
(Feb 24, 2015 12:37 AM)Grey Hat Mafias Bitch Wrote: im going to laugh my ass off if there is no sqli and you think all sites are vuln to sqli because they have ?id=
He may not think that. He asked for help with the same URL in a thread he made --> https://hackforums.net/showthread.php?tid=4700000
The site was proven to be vulnerable.
* - rUNEY - Feb 24, 2015
Dear OP you made one mistake from what i can see, The code on the sixth step says "slqmap.py" Its supposed to be "sqlmap.py" thought i'd clear that up so people don try 7-8 times like i did anyways Some help with this would be appreciated i1107.photobucketDOTcom/albums/h381/raylaw1/Untitled_zpsioddncmt.png
* - swatcity - Feb 24, 2015
this is literally full blown aids.
lol @ not even mentioning --help
* - Balde - Feb 26, 2015
Great Tutorial bro, Thanks for this!
* - Triload - Feb 28, 2015
Great tutorial, much to read through which is nice
* - devtheacc - Mar 1, 2015
Thank you!
Will try to learn now!
!!!!!!
* - mradin1 - Mar 2, 2015
Nice tutorial, really appreciate this :)
* - LionRagex - Mar 4, 2015
Do these kind of errors also make the website sql vulnerable or it's only erros mentioning sql gyazo.com/d6d874e6daeb3e29834ffe71c2d523e3
* - ŜHΔÐΣ - Mar 4, 2015
what does inurl mean i need to put the actual url ?
http://heroes-wow.com/wotlk/admin/login.php
* - Lexica - Mar 4, 2015
(Mar 4, 2015 10:01 PM)Berries Wrote: what does inurl mean i need to put the actual url ?
http://heroes-wow.com/wotlk/admin/login.php
Here you go, just click this LMGTFY.