Repository navigation
http-sql-injection broken in Nmap 7.70 #1191
Description
I was trying to follow an SQL injection tutorial (Web Application Penetration Testing course on Cybrary.it) which showed downloading a VM ISO from https://pentesterlab.com/exercises/from_sqli_to_shell. The tutorial showed using nmap to check for SQLI and in the video it returned lots of results. I have not been able to get it to work and I show using curl below to prove there is an SQLI on the target.
root@kali:~# nmap -debug -p80 --script http-sql-injection --script-args
'httpspider.maxpagecount=200,http-sql-injection.url=/cat.php' 10.0.0.21
Starting Nmap 7.70 ( https://nmap.org ) at 2018-04-19 19:04 PDT
--------------- Timing report ---------------
hostgroups: min 1, max 100000
rtt-timeouts: init 1000, min 100, max 10000
max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
parallelism: min 0, max 0
max-retries: 10, host-timeout: 0
min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.3.
NSE: Arguments from CLI: httpspider.maxpagecount=200,http-sql-injection.url=/cat.php
NSE: Arguments parsed: httpspider.maxpagecount=200,http-sql-injection.url=/cat.php
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 19:04
Completed NSE at 19:04, 0.00s elapsed
Initiating ARP Ping Scan at 19:04
Scanning 10.0.0.21 [1 port]
Packet capture filter (device eth1): arp and arp[18:4] = 0x08002793 and arp[22:2] = 0x0BC1
Completed ARP Ping Scan at 19:04, 0.03s elapsed (1 total hosts)
Overall sending rates: 34.26 packets / s, 1438.75 bytes / s.
mass_rdns: Using DNS server 10.10.77.254
Initiating Parallel DNS resolution of 1 host. at 19:04
mass_rdns: 0.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 19:04, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:04
Scanning 10.0.0.21 [1 port]
Packet capture filter (device eth1): dst host 10.0.0.22 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.0.0.21)))
Discovered open port 80/tcp on 10.0.0.21
Completed SYN Stealth Scan at 19:04, 0.04s elapsed (1 total ports)
Overall sending rates: 22.43 packets / s, 987.01 bytes / s.
NSE: Script scanning 10.0.0.21.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 19:04
NSE: Starting http-sql-injection against 10.0.0.21:80.
NSE: Finished http-sql-injection against 10.0.0.21:80.
NSE: [http-sql-injection 10.0.0.21:80] Testing 33 suspicious URLs
NSE: [http-sql-injection 10.0.0.21:80] Total number of pipelined requests: 33
NSE: [http-sql-injection 10.0.0.21:80] Number of requests allowed by pipeline: 33
NSE: [http-sql-injection 10.0.0.21:80] Number of received responses: 33
NSE: Finished http-sql-injection against 10.0.0.21:80.
Completed NSE at 19:04, 0.18s elapsed
Nmap scan report for 10.0.0.21
Host is up, received arp-response (0.00022s latency).
Scanned at 2018-04-19 19:04:33 PDT for 0s
PORT STATE SERVICE REASON
80/tcp open http syn-ack ttl 64
MAC Address: 08:00:27:68:6D:A0 (Oracle VirtualBox virtual NIC)
Final times for host: srtt: 218 rttvar: 3756 to: 100000
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 19:04
Completed NSE at 19:04, 0.00s elapsed
Read from /usr/bin/../share/nmap: nmap-mac-prefixes nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds
Raw packets sent: 2 (72B) | Rcvd: 2 (72B)
root@kali:~# curl "10.0.0.21/cat.php?id=1'"
<html>
<head>
<link rel="stylesheet" id="base" href="css/default.css" type="text/css" media="screen" />
<title>My awesome Photoblog</title>
</head>
<body>
<div id="header">
<div id="logo">
<h1><a href="index.php">My Awesome Photoblog</a></h1>
</div>
<div id="menu">
<ul>
<li class="active">
<a href="/"> Home |</a>
</li>
<li><a href="cat.php?id=1">test | </a></li>
<li><a href="cat.php?id=2">ruxcon | </a></li>
<li><a href="cat.php?id=3">2010 | </a></li>
<li>
<a href="/all.php">All pictures |</a>
</li>
<li>
<a href="/admin/">Admin</a>
</li>
</ul>
</div>
</div>
</div>
<div id="page">
<div id="content">
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1 <div class="block" id="block-text">
<div class="secondary-navigation">
</div>
</div>
<div id="footer">
<div class="block">
<p>No Copyright </p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
Activity
rtaylor777 commentedon Apr 21, 2018
I'm seeing issues with detection of XSS as well. The course shows that I should be getting results:
https://www.javacrypt.com/images/results.jpg
But instead I am seeing(note that without using debug I don't even see that phpself did anything):
root@kali:/usr/share/nmap/scripts# nmap -debug -p80 --script http-stored-xss.nse,http-dombased-
xss,http-phpself-xss --script-args httpspider.maxpagecount=200 10.0.0.20 10.0.0.21 10.0.0.23
If you want me to report this as a separate bug let me know. I think the problem is related.
dmiller-nmap commentedon May 16, 2018
Thanks for the report! I have a few questions to help diagnose the problem:
Thanks.
dmiller-nmap commentedon May 16, 2018
Regarding the XSS detection, it doesn't look like the vulnerable path is being requested. The
http-phpself-xssscript uses the httpspider library to crawl through the target finding links. If the/xss/example8.phppath is not linked, then the script won't see it. Can you verify that you can find that page linked from the web pages you are targeting? The same goes forhttp-dombased-xssand the/xss/example9.phppath.rtaylor777 commentedon May 19, 2018
Hi Daniel,
Thanks for the replies. Referring to the original post... The version of nmap that the video is using is 6.49BETA4. I tried version 6.47 and I am still not seeing what I hoped for. This is one of the last streams in wireshark when trying again using Nmap 7.70:
I can see that the vulnerable URL cat.php?id=1 is in the returned packet stream but there is no further effort by nmap to access these URLs. I suspect the issue is that spidering is not really happening, since I am not seeing any effort to inject anything.
rtaylor777 commentedon May 19, 2018
Hi Daniel,
Please disregard the 2nd post concerning XSS detection. I am able to get results now thanks.
rtaylor777 commentedon May 19, 2018
Hi Daniel,
I forgot to run the test with sqltrace. I am seeing evidence that it got the error results that should have indicated an injection, here is a small bit of it:
rtaylor777 commentedon May 19, 2018
Ignore the bit about not seeing it in wireshark. I am now... just a bit of a brain shortage. So I guess the only issue is it is not reported as being found despite performing the injection and receiving the error indicating an injection occured.
cldrn commentedon May 28, 2018
The problem here was the error detection string generated by this instance of MySQL was missing in our DB. Remember that Nmap as a project can't ship larger databases so it is always a good idea to keep a larger list that you can use for these cases.
In this case I will add two additional error strings taken from this VM to improve detection with the default DB and close this ticket.
Adds two common error strings when detecting MySQL injections. Closes n…