http-sql-injection broken in Nmap 7.70 #1191
Description
I was trying to follow an SQL injection tutorial (Web Application Penetration Testing course on Cybrary.it) which showed downloading a VM ISO from https://pentesterlab.com/exercises/from_sqli_to_shell. The tutorial showed using nmap to check for SQLI and in the video it returned lots of results. I have not been able to get it to work and I show using curl below to prove there is an SQLI on the target.
root@kali:~# nmap -debug -p80 --script http-sql-injection --script-args
'httpspider.maxpagecount=200,http-sql-injection.url=/cat.php' 10.0.0.21
Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-19 19:04 PDT
--------------- Timing report ---------------
hostgroups: min 1, max 100000
rtt-timeouts: init 1000, min 100, max 10000
max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
parallelism: min 0, max 0
max-retries: 10, host-timeout: 0
min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.3.
NSE: Arguments from CLI: httpspider.maxpagecount=200,http-sql-injection.url=/cat.php
NSE: Arguments parsed: httpspider.maxpagecount=200,http-sql-injection.url=/cat.php
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 19:04
Completed NSE at 19:04, 0.00s elapsed
Initiating ARP Ping Scan at 19:04
Scanning 10.0.0.21 [1 port]
Packet capture filter (device eth1): arp and arp[18:4] = 0x08002793 and arp[22:2] = 0x0BC1
Completed ARP Ping Scan at 19:04, 0.03s elapsed (1 total hosts)
Overall sending rates: 34.26 packets / s, 1438.75 bytes / s.
mass_rdns: Using DNS server 10.10.77.254
Initiating Parallel DNS resolution of 1 host. at 19:04
mass_rdns: 0.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 19:04, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:04
Scanning 10.0.0.21 [1 port]
Packet capture filter (device eth1): dst host 10.0.0.22 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.0.0.21)))
Discovered open port 80/tcp on 10.0.0.21
Completed SYN Stealth Scan at 19:04, 0.04s elapsed (1 total ports)
Overall sending rates: 22.43 packets / s, 987.01 bytes / s.
NSE: Script scanning 10.0.0.21.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 19:04
NSE: Starting http-sql-injection against 10.0.0.21:80.
NSE: Finished http-sql-injection against 10.0.0.21:80.
NSE: [http-sql-injection 10.0.0.21:80] Testing 33 suspicious URLs
NSE: [http-sql-injection 10.0.0.21:80] Total number of pipelined requests: 33
NSE: [http-sql-injection 10.0.0.21:80] Number of requests allowed by pipeline: 33
NSE: [http-sql-injection 10.0.0.21:80] Number of received responses: 33
NSE: Finished http-sql-injection against 10.0.0.21:80.
Completed NSE at 19:04, 0.18s elapsed
Nmap scan report for 10.0.0.21
Host is up, received arp-response (0.00022s latency).
Scanned at 2018-04-19 19:04:33 PDT for 0s
PORT STATE SERVICE REASON
80/tcp open http syn-ack ttl 64
MAC Address: 08:00:27:68:6D:A0 (Oracle VirtualBox virtual NIC)
Final times for host: srtt: 218 rttvar: 3756 to: 100000
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 19:04
Completed NSE at 19:04, 0.00s elapsed
Read from /usr/bin/../share/nmap: nmap-mac-prefixes nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds
Raw packets sent: 2 (72B) | Rcvd: 2 (72B)
root@kali:~# curl "10.0.0.21/cat.php?id=1'"
<html>
<head>
<link rel="stylesheet" id="base" href="css/default.css" type="text/css" media="screen" />
<title>My awesome Photoblog</title>
</head>
<body>
<div id="header">
<div id="logo">
<h1><a href="index.php">My Awesome Photoblog</a></h1>
</div>
<div id="menu">
<ul>
<li class="active">
<a href="/"> Home |</a>
</li>
<li><a href="cat.php?id=1">test | </a></li>
<li><a href="cat.php?id=2">ruxcon | </a></li>
<li><a href="cat.php?id=3">2010 | </a></li>
<li>
<a href="/all.php">All pictures |</a>
</li>
<li>
<a href="/admin/">Admin</a>
</li>
</ul>
</div>
</div>
</div>
<div id="page">
<div id="content">
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1 <div class="block" id="block-text">
<div class="secondary-navigation">
</div>
</div>
<div id="footer">
<div class="block">
<p>No Copyright </p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>