search

andresriancho / w3af

w3af: web application attack and audit framework, the open source web vulnerability scanner.
http://w3af.org/
4.52k stars 1.21k forks source link

[Auto-Generated] Bug Report - " #683

Closed 1d3df9903ad closed 10 years ago

1d3df9903ad commented 10 years ago

User description

What steps will reproduce the problem? 1. 2. 3.

What is the expected output? What do you see instead?

What operating system are you using?

Please provide any additional information below:

Version Information

  Python version: 2.7.3 (default, Sep 26 2013, 20:03:06) [GCC 4.6.3]
  GTK version: 2.24.10
  PyGTK version: 2.24.0
  w3af version:
    w3af - Web Application Attack and Audit Framework
    Version: 1.6
    Revision: 3ef1aa4e9e - 25 Sep 2013 13:10
    Author: Andres Riancho and the w3af team.

Traceback

Traceback (most recent call last):
  File "/pentest/web/w3af/core/ui/gui/tabs/exploit/vuln_list.py", line 276, in _launch_exploit
    expl.exploit(vuln_id_list)
  File "/pentest/web/w3af/core/controllers/plugins/attack_plugin.py", line 197, in exploit
    s = self._generate_shell(vuln)
  File "/pentest/web/w3af/plugins/attack/sqlmap.py", line 76, in _generate_shell
    if self._verify_vuln(vuln_obj):
  File "/pentest/web/w3af/plugins/attack/sqlmap.py", line 105, in _verify_vuln
    if sqlmap.is_vulnerable():
  File "/pentest/web/w3af/plugins/attack/db/sqlmap_wrapper.py", line 102, in is_vulnerable
    raise NotImplementedError(fmt % (full_command, stdout))
NotImplementedError: Unexpected answer found in sqlmap output for command "python sqlmap.py --batch --disable-coloring --proxy=http://127.0.0.1:44451/ --batch --url=http://domain/path/foo/search.php?q=11'%20AND%20'11'='12&search_type=like --data=q=&search_type=like": "
    sqlmap/1.0-dev-3ef1aa4 - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 20:19:30

[?1049h(B[?7h[?1049l
[?1l>
[20:19:30] [WARNING] it appears that you have provided tainted parameter values ('q=11' AND '11'='12') with most probably leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to properly run 

Are you sure you want to continue? [y/N] N

[*] shutting down at 20:19:30

"

Enabled Plugins

andresriancho commented 10 years ago

Duplicates #262