sql injection timing crash
Created by: yannicsmeets
Hi,
I'm trying out the arachni scanner on the wavsep. I used the following command to start up arachni:
./arachni --scope-include-pattern 192.168.56.101/wavsep/active --audit-links --audit-forms --audit-cookies --audit-cookies-extensively --audit-headers --audit-jsons --audit-xmls --audit-parameter-names --audit-with-both-methods --checks=sql_injection,sql_injection_differential,sql_injection_timing http://192.168.56.101/wavsep/active/index-sql.jspUnfortunately, after some time, i get the following error:
[*] Blind SQL injection (timing attack): Phase 2 for cookie input 'Parameter name fuzzing' with action http://192.168.56.101/wavsep/active/SInjection-Detection-Evaluation-GET-500Error/index.jsp
[~] Blind SQL injection (timing attack): * Waiting for the effects of the timing attack to wear off, this may take a while (max waiting time is 120.0 seconds).
[~] Blind SQL injection (timing attack): * OK, got a response after 0.001553 seconds.
[~] Blind SQL injection (timing attack): * Performing control check.
[-] [NoMethodError] undefined method `sub' for nil:NilClass
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/capabilities/analyzable/timeout.rb:459:in `if_timeout_control_check_ok'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/capabilities/analyzable/timeout.rb:414:in `timing_attack_verify'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/capabilities/analyzable/timeout.rb:153:in `analysis_phase_2'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/capabilities/analyzable/timeout.rb:114:in `run'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/capabilities/analyzable.rb:40:in `timeout_audit_run'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/check/auditor.rb:49:in `timeout_audit_run'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework/parts/audit.rb:144:in `audit_page'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework/parts/audit.rb:243:in `audit_queues'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework/parts/audit.rb:193:in `block in audit'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework/parts/audit.rb:173:in `loop'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework/parts/audit.rb:173:in `audit'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework.rb:120:in `block in run'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `call'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework.rb:120:in `run'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/ui/cli/framework.rb:62:in `block in run'
[-]
[-] Parent:
[-] Arachni::Framework
[-]
[-] Block:
[-] #<Proc:0x007fec4a7ed9c8@/Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework.rb:120>
[-]
[-] Caller:
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/framework.rb:120:in `run'
[-] /Users/ysmeets/Documents/Arachni/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/ui/cli/framework.rb:62:in `block in run'
[-] --------------------------------------------------------------------------------Seems like a bug...
Cheers,
Yannic