3
python sqlmap.py -u "https://bake-house.com/" --random-agent -v 3   

[15:38:18] [DEBUG] cleaning up configuration parameters
[15:38:18] [DEBUG] checking for WebSocket
[15:38:18] [DEBUG] setting the HTTP timeout
[15:38:18] [DEBUG] loading random HTTP User-Agent header(s) from file '/tmp/sqlmap/txt/user-agents.txt'
[15:38:18] [INFO] fetched random HTTP User-Agent header from file '/tmp/sqlmap/txt/user-agents.txt': 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.42 Safari/530.5'
[15:38:18] [DEBUG] creating HTTP requests opener object
[15:38:18] [DEBUG] resolving hostname 'bake-house.com'
[15:38:19] [INFO] testing connection to the target URL
[15:38:20] [DEBUG] SSL connection error occurred ('[SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:590)')
[15:38:20] [DEBUG] SSL connection error occurred ('[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:590)')
[15:38:21] [DEBUG] SSL connection error occurred ('[SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:590)')
[15:38:21] [CRITICAL] can't establish SSL connection

If change host on example: https://google.com, here connection result - OK

In Ubuntu and Windows 7 this problem have.

Code SQLMap, module http connection: https://github.com/sqlmapproject/sqlmap/blob/master/lib/request/httpshandler.py

Python 2.7.10, SQLMap last version, OpenSSL 1.0.2a

Please, help me, how fix this problem?

modoyupiwa
  • 31
  • 1
  • 2
  • The main difference between these hosts regarding SSL is that bake-house.com croaks if no [SNI](http://en.wikipedia.org/wiki/Server_Name_Indication) is used while google.com works without SNI. My guess is that sqlmap does not use SNI. – Steffen Ullrich May 26 '15 at 07:13
  • I validated Steffen's comment against my own server. This is a Java SNI issue. You can workaround this purely on the client. Tools like Burp allow you to disable SNI (i.e. act like an old browser). This stops these types of errors and TLS connection problems. However, I could not see a switch or option for sqlmap to disable SNI. Sorry. I want the same thing. – rustyMagnet Jul 06 '16 at 10:54

0 Answers0