Why SQLMap Doesn’t Attack Specified Parameter?

I am new to SQLMap. I have setup Kali and OWASPBWA VM. Both VMs are on same NAT Network set in VirtualBox.

When I try to run following command:

sqlmap -u "http://<IP_ADDRESS>/mutillidae/index.php?page=user-info.php?username=111&password=bbb&user-info-php-submit-button=View+Account+Details" -p username 

I get following messages:

  • Previous heuristics detected that the target is protected by some kind of WAF/IPS.
  • Multiple messages – Unable to connect to the targeturl. sqlmap is trying to reconnect.
  • heuristics test shows that GET parameter ‘username’ might not be injectable.

There are several YouTube videos which display same setup with above 2 VMs, and are able to run the command and find injection in username parameter. What am I doing wrong? Please help.

Does Nmap use only one of the DNS servers specified in the –dns-server flag per host?

When I’m scanning with Nmap, I make an effort to get proper hostnames associated with the target IPs. To do this, I scan UDP 53 on the targets to identify DNS servers and then run something like the following for each identified DNS server:

nmap -sL -v4 --dns-servers DNSSERVER TARGETS 

I have to review the results for each tested DNS server to see how many of the targets it can resolve, and also determine if the resolved targets differ.

The docs seem to imply that if you specify multiple servers in the --dns-servers flag, that it will choose one at random (or round robin). This interpretation comes from the "is often faster" part.

The problem I have is that my scan targets may not all be supported by the same DNS server. In my case, I’d rather specify all identified DNS servers in --dns-servers and have it fail over until it finds one that returns a response. If only one of the specified servers is used, to get accurate results I would need to perform multiple scans, each with a single DNS server specified.

My question is, is it true that the --dns-server flag will use only one of the specified DNS servers, and not try them all?

Complexity of Subset Sum where the size of the subset is specified

I know it should be easy but I’m trying to determine the complexity of the following variant of Subset Sum.

Given a subset $ S$ of positive integers and integers $ k>0$ and $ N>0$ , is there a subset $ T\subset S$ such that $ |T|=k$ and the members of $ T$ sum to $ N$ ?

All of the formulations of subset sum that I’ve seen don’t specify $ k$ so I’m wondering if this problem can be solved in polynomial time. If $ k$ is fixed for all instances, then I know that the problem is in P and solvable by brute force in $ O(n^k)$ time. However, I’m allowing $ k$ to vary from instance to instance.

LinkOpen::linke: Specified file is not a MathLink executable. in AceGen

I tried to run AceGen/AceFEM on my Mac(10.15.5). I installed Mathematica ( successfully and also the latest version of the AcePackage (7.113). The installation of the AcePackage is successful, saying the C compiler is found. Now I can build an element (from the MainLibrary) for example, but running a simulation is not possible. Both packages can be loaded, but executing the SMTInputData[]; command gives the following error.

LinkOpen: Specified file is not a MathLink executable..  External numerical module is closed. Please restart Mathematica and try again. If the error repeats rebuild and recompile all user elements in debug mode. 

The latest version of Xcode is installed as well.

What can I do?

Thanks for your help!

Where are field names of decoded human readable X.509 certificates specified?

The ASN.1 module for X.509 certificates as specified in RFC 5912 – Section 14 is as follows:

TBSCertificate  ::=  SEQUENCE  {       version         [0]  Version DEFAULT v1,       serialNumber         CertificateSerialNumber,       signature            AlgorithmIdentifier{SIGNATURE-ALGORITHM,                                 {SignatureAlgorithms}},       issuer               Name,       validity             Validity,       subject              Name,       subjectPublicKeyInfo SubjectPublicKeyInfo,       ... ,       [[2:               -- If present, version MUST be v2       issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,       subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL       ]],       [[3:               -- If present, version MUST be v3 --       extensions      [3]  Extensions{{CertExtensions}} OPTIONAL       ]], ... }  

The field names are the same in RFC 5280.

The decoded example certificate on the X.509 Wikipedia page however has completely different field names:

Certificate:     Data:         Version: 3 (0x2)         Serial Number:             10:e6:fc:62:b7:41:8a:d5:00:5e:45:b6         Signature Algorithm: sha256WithRSAEncryption         Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2         Validity             Not Before: Nov 21 08:00:00 2016 GMT             Not After : Nov 22 07:59:59 2017 GMT         Subject: C=US, ST=California, L=San Francisco, O=Wikimedia Foundation, Inc., CN=*.wikipedia.org         Subject Public Key Info:             Public Key Algorithm: id-ecPublicKey                 Public-Key: (256 bit)             pub:                      00:c9:22:69:31:8a:d6:6c:ea:da:c3:7f:2c:ac:a5:                     af:c0:02:ea:81:cb:65:b9:fd:0c:6d:46:5b:c9:1e:                     9d:3b:ef                 ASN1 OID: prime256v1                 NIST CURVE: P-256         X509v3 extensions:             X509v3 Key Usage: critical                 Digital Signature, Key Agreement          ... 

Signature Algorithm instead of algorithm, X509v3 extensions instead of just extensions.

Since the certificate has version 3, i would assume it doesn’t have anything to do with the version…

Of course i searched for various field names like X509v3 Key Usage or X509v3 CRL Distribution Points but couldn’t find any reference.

So where are the field names of the decoded human readable X.509 certificate specified or mapped?

Count how many posts have a specified tag AND category

I know how to count how many posts has a certain tag, or category

For example:

$  term_slug = 'some-post-tag'; $  term = get_term_by('slug', $  term_slug, $  post_tag); echo $  term->count; 

BUT! Is there anyway to count how many posts that have a tag AND a specified category?

I want to count how many posts that have the tag(slug) “cats” and the category slug “allow-list”

Is this even possible?

Using the elements of one Matrix to form a new Matrix with specified rules

Given a matrix [a], how to get matrices [b] and [c] based on the following two rules?

  1. rule [a]->[b]: Strike out corresponding term in [a] and take product of the remaining two terms in the same column.
  2. rule [a]->[c]: Strike out the row and column containing the corresponding term in [a] and take sum of cross products in the 2×2 matrix remaining.

x,y,z can be replaced with 1,2,3; For example, $ a_{xy},a_{yz}$ can be replaced with a12,a23; [a] can be replace with:

a = {{a11, a12, a13}, {a21, a22, a23}, {a31, a32, a33}} 

Thank you

Matrix [a]

enter image description here

Matrix [b]

enter image description here

Matrix [c]

enter image description here

Is there a default casting time for a spell or class ability if none is specified?

I’m relatively new to D&D. Only been in a group for about 2 months, and still learning stuff every time we meet. But my question is, If a spell/cantrip/class ability does not specify the required casting time (i.e. action, bonus action, reaction), what is the default setting for casting?

I was just wondering if such a thing even exists. Because I was looking at class homebrews for an upcoming campaign, and some of them don’t specify how to use the class ability in combat. I could just ask my DM how they would want to go about it, but I was curious whether any such rule exists.

Is there a default casting time for a spell or class ability if none is specified?