Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SQLMAP Slows down after many lines dumped #5071

Open
Yorchbs opened this issue Apr 18, 2022 · 6 comments
Open

SQLMAP Slows down after many lines dumped #5071

Yorchbs opened this issue Apr 18, 2022 · 6 comments

Comments

@Yorchbs
Copy link

Yorchbs commented Apr 18, 2022

After many dumped lines, sqlmap slows down over time and gets slower and slower. Is not internet connection problems because I tested it from different targets/connections/PC's. If you make --flush-session and you restart the dump it goes very fast again but after ~200k lines, it slows down again. (working with 10 threads and checked and DOS is not happening)

To reproduce you can make a vuln website in a VPS and make a link vulnerable to test it. I'm testing right now with my 2M database and is happening something like this:

Captura de pantalla (109)_LI

Running sqlmap 1.6.4 and tested in Windows 10 and Kali Linux. Different networks and different hard

All the taregets are running MYSQL >= 5 and the SQLi detected is UNION BASED, NO WAF/IPS.

Thanks in advance.

@stamparm
Copy link
Member

can you rerun with -v 3 and show some payloads being sent? you've skipped the issue template, so, we are playing a guessing game here

@Yorchbs
Copy link
Author

Yorchbs commented Apr 22, 2022

can you rerun with -v 3 and show some payloads being sent? you've skipped the issue template, so, we are playing a guessing game here

Here are the Payloads being sent, are the normal and they should work well because manually they work well
cap

@stamparm
Copy link
Member

you've hidden parts of the payload. is there ORDER BY inside?

@Yorchbs
Copy link
Author

Yorchbs commented Apr 29, 2022

No sir, is just the table name inside the CAST(table AS CHAR) and the db.table after FROM (FROM db.table LIMIT X,1)

@stamparm
Copy link
Member

stamparm commented May 13, 2022

then it is strange. sqlmap should not slow down in such cases. also, it seems that the target is doing connection timeouts (not the sqlmap internal problem) for some strange reason. i would ask you to rerun with -v 3 and use those PAYLOADs inside the browser. maybe some useful error pops out

@stamparm
Copy link
Member

image

this means that the site ^^ is slowing down, not the sqlmap

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants