Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Force sqlmap to test database, tables, columns names check #5711

Closed
soloh4cker opened this issue May 14, 2024 · 2 comments
Closed

Force sqlmap to test database, tables, columns names check #5711

soloh4cker opened this issue May 14, 2024 · 2 comments

Comments

@soloh4cker
Copy link

Is your feature request related to a problem? Please describe.
I was testing on one target where time based blind injection was vulnerable but accidently deleted session and now sqlmap will waste another 2-3 hours just to retrieve database, tables names which I already have dumped from past attack session.

Describe the solution you'd like
Force sqlmap to test only true or false for database, tables names if we already have. So in true condition it will store this information in session and then in next attack where we want to --dump database we can directly provide database, tables names to retrieve information. So we dont waste time on information which we already have.

Describe alternatives you've considered
While this feature is also useful in this type of time based injection. For example, When we are starring at screen sqlmap is trying to retrieve each character one by one and retrieved "inform....." now we know that database name is going to be "information_schema" but still need to wait sqlmap retrieve it. In this type of situation we can maybe tell sqlmap that try "information_schema" if it is true then move to next information, if it is not then keep trying to retrieve characters one by one as usual.

Additional context
N/A

@soloh4cker
Copy link
Author

Please note that Providing directly names of database, tables, columns is not working. sqlmap is not able to retrieve anything.
Ex. sqlmap.py -u "target.com/?id=1" -p id -D db_name -T tb_name -C col1,col2,col3 --dump
This command failed to retrieve anything.

@stamparm
Copy link
Member

you are like 100th user which had this "idea". python doesn't support interactive keyboard input in non-blocking way across all platforms. program can either wait for your input and block everything else, or run without you providing any input

sorry man for your waste of time. deeply sorry

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants