Supported Vulnerabilites Emulation (Glastopf vs SNARE)

[monsterhunterboy98]

I tried replicating the exploitation steps done on my Glastopf Instance on my newly installed Snare. I only manage to emulate LFI exploit on snare. However, when I tried the successful injections on Snare, it was not able to emulate it.

Glastopf:

Snare: Snare Simply refreshes the cloned page.

Is there a reference for all the supported vulnerabilities emulation for snare? As I only manage to emulate the LFI exploit

[monsterhunterboy98]

:(

[afeena]

Please describe more info and send the command you've used (please don't use screenshots for reproduction steps, I don't see well what did you use, I assumed select @@Verison)

By default tanner uses sqlite3 , and this select command is not a valid command for this database, so nothing should happen. Tanner supports mysql and sqlite databases

And also additional info will be helpful: 1) Did you use your own tanner version? 2) What did you see in tanner log?

[monsterhunterboy98]

appended url for SQL injection on Glastopf: "Glastopf IP"/index.php/?q="select @@Version;"

Snare: "Snare IP"/?q="select @@Version;"

Nothing happened for Snare. I did the same command on my vulnerable MySQL instance it works fine.

1.I did not install tanner. I was able to replicate the LFI exploit without tanner so I went ahead and did the sql injection

[afeena]

@monsterhunterboy98 MySQL is not default db for SNARE. default is sqlite3. You can change this in config.

[glaslos]

Closing this for inactivity. I assume all questions have been answered.