Like many pentesters, I’m a fan of sqlmap.  It’s often the first and last tool I reach for when exploiting boolean or time-based SQL injection vulnerabilities.

I wanted to briefly document a slightly tricky SQL injection issue I encountered recently and a few of the sqlmap features that impressed me most.

I initially noticed that the following URLs returned the same page:

http://host/script?id=10
http://host/script?id=11-1 # same as id=10
http://host/script?id=(select 10) # same as id=10

Which looks pretty standard. The were a few problems with this injection, though. Firstly “and” and “or” didn’t work for some reason I never figured out:

 http://host/script?id=10 and 1=1 # failed

Secondly, I could’t terminate the query

http://host/script?id=10-- # failed
http://host/script?id=10;-- # failed
http://host/script?id=10);-- # failed
http://host/script?id=10)subquery;-- # failed

I spent a long time trying to terminate the query in burp intruder with a custom dictionary of possible strings. To no avail. I therefore could not make this into a UNION injection.

To exploit it as a boolean injection, I rewrote the URL slightly to help sqlmap – which was struggling because “and” and “or” didn’t work as they normally would:

 http://host/script?id=11-(case when 1=1 then 1 else 0 end)

It was then possible to put ” and 1=2″ etc. after the “1=1″ to give two different pages for the true or false response:

http://host/script?id=11 # the "when" clause is false
http://host/script?id=10 # the "when" clause is true

Apparently if you increase the “–level” parameter, sqlmap will try clever stuff like this for you.  I bares illustrating how to do it manually, though.

Telling sqlmap Where To Inject

By default sqlmap will figure out for itself where the injection point it. If you want to guide it, simply add a * to the URL like this:

sqlmap -u http://host/script?id=11-(case when 1=1* then 1)

BTW I’m using SVN version.  Apparently this feature was present in v0.9, but wasn’t documented.  Use the docs from the SVN  read about this feature.

경축! 아무것도 안하여 에스천사게임즈가 새로운 모습으로 재오픈 하였습니다.
어린이용이며, 설치가 필요없는 브라우저 게임입니다.
https://s1004games.com

It’s a brilliant feature. I probably wouldn’t have bothered with sqlmap if it didn’t have this feature.

Error Correction

For some reason, the server gave me inconsistent responses (load balancing / general brokenness?). This resulted in about 25% of the chars retrieve by sqlmap being incorrect – not the fault of the tool, but the fault of the server.

This is a problem not faced by sqlmap users when using time-based (“waitfor delay”) injection because sqlmap has a cool feature: error correction.  After each character it extracts, it checks using a true/false query that the character is correct.

It wasn’t too hard to activate the error-correction feature for boolean injections too – in fact I changed a single line of code.

Sweet.  Error-free data from the database.

I’ve mailed Bernardo, sqlmap’s author and hopefully we’ll see this as an optional feature in a future release.  It does mean about 1/8th more queries will be required, but that’s a small price to pay when the server’s giving you bad data.

Tamper Scripts

To further complicate the injection, some characters needed URL encoding – e.g. > to %3E.  My instinct was to use “–tamper=between” which converts “> 5″ to “not between 0 and 5″.  However, this made the query too long (a further trickyness of this particular injection).

It was fairly easy to create a custom tamper script based on one of the 20 plus examples that ship with sqlmap:

cd sqlmap/tamper
cp between.py ptm.py
vi ptm.py
../sqlmap.py --tamper=ptm ...

Update: In retrospect –tamper=charencode may have worked.

Support

I found Bernardo very helpful and welcoming of feedback*.  He and Miroslav Stampar have done a great job on this tool.  And it just keeps improving.

*Though, always RTFM (v0.9 SVN version) before contacting him

Tags: pentest, sqlmap

Posted in Blog