Skip to content

postgres OOB sqli failure #3206

@ASKWares

Description

@ASKWares

What's the problem (or question)?

Why sqlmap tells me
[09:55:27] [ERROR] data retrieval through DNS channel failed. Turning off DNS exfiltration support

i found a timebased sqli with dbms
PostgreSQL 9.1.24lts2 on i686-pc-linux-gnu, compiled by gcc (Debian 4.7.2-5) 4.7.2, 32-bit

worked as timebased & stacked queries , and i checked it manualy

and i've read your paper about oob sql injection attack and dns exfiltration
but when i try to send the sql query you mentioned in the paper which i don't know if it compatible with postgres 9.1 or not , it doesn't work, so i decide to ask you about this matter , because no one mention it except you , and all the papers and posts are copy of your original paper

thank you for your efforts

Do you have an idea for a solution?

How can we reproduce the issue?

What are the running context details?

  • Installation method (e.g. pip, apt-get, git clone or zip/tar.gz):
  • Client OS (e.g. Microsoft Windows 10)
  • Program version (python sqlmap.py --version or sqlmap --version depending on installation):
  • Target DBMS (e.g. Microsoft SQL Server):
  • Detected WAF/IDS/IPS protection (e.g. ModSecurity or unknown):
  • SQLi techniques found by sqlmap (e.g. error-based and boolean-based blind):
  • Results of manual target assessment (e.g. found that the payload query=test' AND 4113 IN ((SELECT 'foobar'))-- qKLV works):
  • Relevant console output (if any):
  • Exception traceback (if any):

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions