sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-30 05:23:50 +03:00
Code Issues Packages Projects Releases Wiki Activity
432b567584
sqlmap/lib/core/optiondict.py

204 lines
10 KiB
Python
Raw Normal View History

After the storm, a restore..
2008-10-15 19:38:22 +04:00
#!/usr/bin/env python
"""
modified homepage address
2012-07-12 21:38:03 +04:00
Copyright (c) 2006-2012 sqlmap developers (http://sqlmap.org/)
sorry, cosmetics
2010-10-15 03:18:29 +04:00
See the file 'doc/COPYING' for copying permission
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"""
optDict = {
Code refactoring and minor bug fixes.
2010-05-27 20:45:09 +04:00
# Format:
# Family: { "parameter name": "parameter datatype" },
# Or:
# Family: { "parameter name": ("parameter datatype", "category name used for common outputs feature") },
sqlmap 0.6.3-rc4: Minor enhancement to be able to specify the number of seconds before timeout the connection, default is set to 10 seconds. Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url. Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread. Minor code restyling. Updated documentation.
2008-12-04 20:40:03 +03:00
"Target": {
Major enhancement to directly connect to the dbms without passing via a sql injection: adapted code accordingly - see #158. This feature relies on python third-party libraries to be able to connect to the database. For the moment it has been implemented for MySQL (with python-mysqldb module) and PostgreSQL (with python-psycopg2 module). Minor layout adjustments.
2010-03-27 02:23:25 +03:00
"direct": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"url": "string",
changing conf attribute to a more proper name
2011-05-11 00:48:34 +04:00
"logFile": "string",
Cosmetics
2011-06-08 20:08:20 +04:00
"bulkFile": "string",
Minor code refactoring
2010-01-14 23:42:45 +03:00
"requestFile": "string",
code commit regarding Feature #119
2010-01-12 16:11:26 +03:00
"googleDork": "string",
Minor code refactoring
2010-01-14 23:42:45 +03:00
"configFile": "string"
sqlmap 0.6.3-rc4: Minor enhancement to be able to specify the number of seconds before timeout the connection, default is set to 10 seconds. Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url. Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread. Minor code restyling. Updated documentation.
2008-12-04 20:40:03 +03:00
},
"Request": {
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"data": "string",
transformed cDel to pDel as a more generic option
2011-10-07 02:03:33 +04:00
"pDel": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"cookie": "string",
Implementation for an Issue #118
2012-07-24 17:34:50 +04:00
"loadCookies": "string",
Minor code refactoring
2010-01-14 23:42:45 +03:00
"cookieUrlencode": "boolean",
sqlmap 0.8-rc3: Merge from Miroslav Stampar's branch fixing a bug when verbosity > 2, another major bug with urlencoding/urldecoding of POST data and Cookies, adding --drop-set-cookie option, implementing support to automatically decode gzip and deflate HTTP responses, support for Google dork page result (--gpage) and a minor code cleanup.
2010-01-02 05:02:12 +03:00
"dropSetCookie": "boolean",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"agent": "string",
adding --random-agent and removing -a
2011-02-02 17:51:12 +03:00
"randomAgent": "boolean",
implemented --randomize switch by request
2011-08-29 16:50:52 +04:00
"rParam": "string",
adding --force-ssl switch (most useful in combination with -r)
2012-02-08 13:11:57 +04:00
"forceSSL": "boolean",
adding support for scanning Host header values (-p host)
2011-12-20 16:52:41 +04:00
"host": "string",
Split character for tamper scripts (--tamper option) is now comma, not semi-colon. Minor enhancement
2010-10-17 01:52:16 +04:00
"referer": "string",
sqlmap 0.6.3-rc4: minor enhancement to be able to specify extra HTTP headers by providing option --headers. By default Accept, Accept-Language and Accept-Charset headers are set. Added support to get the injection payload prefix and postfix from user. Minor bug fix to exclude image files when parsing (-l) proxies log files. Minor code adjustments. Updated documentation.
2008-12-09 00:24:24 +03:00
"headers": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"aType": "string",
"aCred": "string",
implementation of Feature #17
2010-01-07 15:59:09 +03:00
"aCert": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"proxy": "string",
added option --proxy-cred for setting proxy credentials (Feature #195)
2010-08-19 02:45:00 +04:00
"pCred": "string",
Minor adjustments
2010-03-03 19:19:17 +03:00
"ignoreProxy": "boolean",
sqlmap 0.6.3-rc1: * Minor enhancement to be able to specify the number of seconds to wait between each HTTP request. * Minor bug fix to handle session.error and session.timeout in HTTP requests. * Updated documentation.
2008-11-09 19:57:47 +03:00
"delay": "float",
added --scope feature regarding Feature #105
2010-01-09 23:44:50 +03:00
"timeout": "float",
"retries": "integer",
implementation of Feature #176 (Safe URL: avoid being kicked out after N unsuccessful requests)
2010-04-16 16:44:47 +04:00
"scope": "string",
"safUrl": "string",
adding switch --eval
2011-11-21 20:41:02 +04:00
"saFreq": "integer",
adding switch --skip-urlencode to skip URL encoding of POST data
2012-05-25 03:30:33 +04:00
"skipUrlEncode": "boolean",
adding switch --eval
2011-11-21 20:41:02 +04:00
"evalCode": "string"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
Split character for tamper scripts (--tamper option) is now comma, not semi-colon. Minor enhancement
2010-10-17 01:52:16 +04:00
"Optimization": {
"optimize": "boolean",
Renamed --common-prediction switch to --predict-output
2010-10-17 03:50:13 +04:00
"predictOutput": "boolean",
Split character for tamper scripts (--tamper option) is now comma, not semi-colon. Minor enhancement
2010-10-17 01:52:16 +04:00
"keepAlive": "boolean",
"nullConnection": "boolean",
"threads": "integer"
},
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"Injection": {
sqlmap 0.6.3-rc4: Minor enhancement to be able to specify the number of seconds before timeout the connection, default is set to 10 seconds. Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url. Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread. Minor code restyling. Updated documentation.
2008-12-04 20:40:03 +03:00
"testParameter": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"dbms": "string",
Updated to sqlmap 0.7 release candidate 1
2009-04-22 15:48:07 +04:00
"os": "string",
adding --invalid-bignum (Havij like bignum style for invalidating/negating values); renaming --logical-negate to --invalid-logical
2012-04-26 00:29:07 +04:00
"invalidBignum": "boolean",
Implementation for Issue #92
2012-07-16 13:07:47 +04:00
"invalidLogical": "boolean",
"noCast": "boolean",
"noUnescape": "boolean",
sqlmap 0.6.3-rc4: minor enhancement to be able to specify extra HTTP headers by providing option --headers. By default Accept, Accept-Language and Accept-Charset headers are set. Added support to get the injection payload prefix and postfix from user. Minor bug fix to exclude image files when parsing (-l) proxies log files. Minor code adjustments. Updated documentation.
2008-12-09 00:24:24 +03:00
"prefix": "string",
Proper english (--postfix is now --suffix) and --string/--regexp does not necessarily need to match into the original response body, it might well be in the injected True condition only!
2010-11-18 01:00:09 +03:00
"suffix": "string",
implemented parameter --skip
2011-08-29 17:29:42 +04:00
"skip": "string",
More replacements for refactoring. Minor layout adjustments. Alignment of conffile/optiondict/cmdline parameters.
2010-11-08 15:36:48 +03:00
"tamper": "string"
},
"Detection": {
Rewrite from scratch the detection engine. Now it performs checks defined in payload.xml. User can specify its own. All (hopefully) functionalities should still be working. Added two switches, --level and --risk to specify which injection tests and boundaries to use. The main advantage now is that sqlmap is able to identify initially which injection types are present so for instance if boolean-based blind is not supported, but error-based is, sqlmap will keep going and work!
2010-11-28 21:10:54 +03:00
"level": "integer",
"risk": "integer",
Minor enhancemet to support also --regexp, --excl-str and --excl-reg options rather than only --string when comparing HTTP responses page content
2008-12-05 18:34:13 +03:00
"string": "string",
Implementation for an Issue #70
2012-07-26 14:06:02 +04:00
"notString": "notString",
Minor enhancemet to support also --regexp, --excl-str and --excl-reg options rather than only --string when comparing HTTP responses page content
2008-12-05 18:34:13 +03:00
"regexp": "string",
minor fix
2012-01-05 14:24:27 +04:00
"code": "integer",
adding --titles switch (killer switch for pages with lots of dynamicity and/or international ones)
2011-06-11 03:18:43 +04:00
"textOnly": "boolean",
"titles": "boolean"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
sqlmap 0.6.3-rc4: Minor enhancement to be able to specify the number of seconds before timeout the connection, default is set to 10 seconds. Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url. Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread. Minor code restyling. Updated documentation.
2008-12-04 20:40:03 +03:00
"Techniques": {
Refactoring to --technique
2011-04-07 14:00:47 +04:00
"tech": "string",
Minor layout adjustments
2010-01-10 00:08:47 +03:00
"timeSec": "integer",
fix for a bug reported by black zero (ValueError: invalid literal for int() with base 10: '1-20')
2010-12-13 02:59:55 +03:00
"uCols": "string",
unhiding --dns-domain switch
2012-05-27 22:41:06 +04:00
"uChar": "string",
Implementation for an Issue #4
2012-07-26 16:07:05 +04:00
"dnsName": "string",
"secondOrder": "string"
sqlmap 0.6.3-rc4: Minor enhancement to be able to specify the number of seconds before timeout the connection, default is set to 10 seconds. Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url. Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread. Minor code restyling. Updated documentation.
2008-12-04 20:40:03 +03:00
},
Initial implementation of support for stacked queries. Added method to test for Time based blind SQL injection query stacking on the affected parameter a SLEEP() or similar DBMS specific function. Adapted libraries, plugins and XML with the above changes. Minor layout adjustments.
2008-11-12 03:36:50 +03:00
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"Fingerprint": {
Merged back from personal branch to trunk (svn merge -r846:940 ...) Changes: * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (--os-bof) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for --first and --last so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if -s option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring.
2009-09-26 03:03:45 +04:00
"extensiveFp": "boolean"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
"Enumeration": {
Code refactoring and minor bug fixes.
2010-05-27 20:45:09 +04:00
"getBanner": ("boolean", "Banners"),
"getCurrentUser": ("boolean", "Users"),
"getCurrentDb": ("boolean", "Databases"),
added --hostname switch to retrieve DBMS server hostname - closes issue #69
2012-07-12 03:01:57 +04:00
"getHostname": "boolean",
Minor enhancement to support an option (--is-dba) to show if the current user is a database management system administrator.
2008-12-18 23:41:11 +03:00
"isDba": "boolean",
Code refactoring and minor bug fixes.
2010-05-27 20:45:09 +04:00
"getUsers": ("boolean", "Users"),
Minor fixes
2010-05-30 18:53:13 +04:00
"getPasswordHashes": ("boolean", "Passwords"),
Code refactoring and minor bug fixes.
2010-05-27 20:45:09 +04:00
"getPrivileges": ("boolean", "Privileges"),
"getRoles": ("boolean", "Roles"),
"getDbs": ("boolean", "Databases"),
"getTables": ("boolean", "Tables"),
"getColumns": ("boolean", "Columns"),
Added switch --schema to enumerate DBMS schema and now --columns does not require a mandatory table (-T) anymore, instead it will act as an alias for --schema
2011-04-29 03:59:00 +04:00
"getSchema": "boolean",
Added --count switch to count the number of entries for a specific table (when -T is provided), all database's tables (when only -D is provided) or all databases' tables when neither -D nor -T are provided
2011-04-30 04:22:22 +04:00
"getCount": "boolean",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"dumpTable": "boolean",
"dumpAll": "boolean",
Added option --search to work in conjunction with -D (done), -T (soon) or -C (replaces --dump -C) - See #190: * --search -D foobar: searches all database names like the ones provided * --search -T foobar: searches all databases' table names like the ones provided (soon) * --search -C foobar: replaces --dump -C
2010-05-07 17:40:57 +04:00
"search": "boolean",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"db": "string",
"tbl": "string",
"col": "string",
Split character for tamper scripts (--tamper option) is now comma, not semi-colon. Minor enhancement
2010-10-17 01:52:16 +04:00
"user": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"excludeSysDbs": "boolean",
"limitStart": "integer",
"limitStop": "integer",
Merged back from personal branch to trunk (svn merge -r846:940 ...) Changes: * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (--os-bof) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for --first and --last so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if -s option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring.
2009-09-26 03:03:45 +04:00
"firstChar": "integer",
"lastChar": "integer",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"query": "string",
initial work for issue #33
2012-07-10 03:27:08 +04:00
"sqlShell": "boolean",
"sqlFile": "string"
minor update
2010-11-09 19:59:36 +03:00
},
"Brute": {
re-renaming of brute force switches. this way is better.
2010-11-11 10:57:44 +03:00
"commonTables": "boolean",
Added --union-cols switch to specify the max number of columns to test for UNION query sql injection. Now stores/resumes also the exact UNION payload to session file.
2010-11-14 02:24:41 +03:00
"commonColumns": "boolean"
Merged back from personal branch to trunk (svn merge -r846:940 ...) Changes: * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (--os-bof) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for --first and --last so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if -s option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring.
2009-09-26 03:03:45 +04:00
},
"User-defined function": {
"udfInject": "boolean",
"shLib": "string"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
"File system": {
"rFile": "string",
"wFile": "string",
Merged back from personal branch to trunk (svn merge -r846:940 ...) Changes: * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (--os-bof) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for --first and --last so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if -s option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring.
2009-09-26 03:03:45 +04:00
"dFile": "string"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
"Takeover": {
Updated to sqlmap 0.7 release candidate 1
2009-04-22 15:48:07 +04:00
"osCmd": "string",
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"osShell": "boolean",
Updated to sqlmap 0.7 release candidate 1
2009-04-22 15:48:07 +04:00
"osPwn": "boolean",
"osSmb": "boolean",
"osBof": "boolean",
"privEsc": "boolean",
"msfPath": "string",
Merged back from personal branch to trunk (svn merge -r846:940 ...) Changes: * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (--os-bof) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for --first and --last so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if -s option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring.
2009-09-26 03:03:45 +04:00
"tmpPath": "string"
},
"Windows": {
"regRead": "boolean",
"regAdd": "boolean",
"regDel": "boolean",
"regKey": "string",
"regVal": "string",
"regData": "string",
"regType": "string"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
cosmetics
2010-11-16 17:11:32 +03:00
"General": {
Hide switch -x (XML output format) as it is incomplete and bugged and won't make it for 0.9 stable
2011-02-27 15:17:41 +03:00
#"xmlFile": "string",
added --charset option to force charset encoding of the retrieved data (e.g. when the backend collation is different than the current web page charset) as requested by devon.mitchell1988@y​ahoo.com
2011-05-18 02:55:22 +04:00
"trafficFile": "string",
"batch": "boolean",
"charset": "string",
adding option --csv-del
2011-11-30 21:39:41 +04:00
"checkTor": "boolean",
few bug fixes (NTLM credential parsing was wrong), some switch reordering (few Misc to General), implemented --check-waf switch (irony is that this will also be called highly experimental/unstable while other things will be called "major/turbo/super bug fix/implementation")
2011-07-06 09:44:47 +04:00
"crawlDepth": "integer",
adding option --csv-del
2011-11-30 21:39:41 +04:00
"csvDel": "string",
Implementation for an Issue #118
2012-07-24 17:34:50 +04:00
"dbmsCred": "string",
added --charset option to force charset encoding of the retrieved data (e.g. when the backend collation is different than the current web page charset) as requested by devon.mitchell1988@y​ahoo.com
2011-05-18 02:55:22 +04:00
"eta": "boolean",
cosmetics
2010-11-16 17:11:32 +03:00
"flushSession": "boolean",
"forms": "boolean",
added --charset option to force charset encoding of the retrieved data (e.g. when the backend collation is different than the current web page charset) as requested by devon.mitchell1988@y​ahoo.com
2011-05-18 02:55:22 +04:00
"freshQueries": "boolean",
implementation of switch --hex for 4 major DBMSes
2012-02-21 15:44:48 +04:00
"hexConvert": "boolean",
Adding switch --output-dir (Issue #53)
2012-07-03 02:50:23 +04:00
"oDir": "string",
few bug fixes (NTLM credential parsing was wrong), some switch reordering (few Misc to General), implemented --check-waf switch (irony is that this will also be called highly experimental/unstable while other things will be called "major/turbo/super bug fix/implementation")
2011-07-06 09:44:47 +04:00
"parseErrors": "boolean",
"replicate": "boolean",
"updateAll": "boolean",
added switch --check-tor
2011-10-25 21:37:43 +04:00
"tor": "boolean",
implemented --tor-port by request
2011-12-23 14:57:09 +04:00
"torPort": "integer",
adding switch --tor-type
2011-12-16 03:19:55 +04:00
"torType": "string",
cosmetics
2010-11-16 17:11:32 +03:00
},
After the storm, a restore..
2008-10-15 19:38:22 +04:00
"Miscellaneous": {
added General cmdline group
2010-11-16 17:09:09 +03:00
"checkPayload": "boolean",
sqlmap 0.8-rc3: Merge from Miroslav Stampar's branch fixing a bug when verbosity > 2, another major bug with urlencoding/urldecoding of POST data and Cookies, adding --drop-set-cookie option, implementing support to automatically decode gzip and deflate HTTP responses, support for Google dork page result (--gpage) and a minor code cleanup.
2010-01-02 05:02:12 +03:00
"cleanup": "boolean",
minor update (all misc options are alphabetically ordered)
2011-06-27 12:21:33 +04:00
"dependencies": "boolean",
added General cmdline group
2010-11-16 17:09:09 +03:00
"googlePage": "integer",
implemented --mobile switch
2011-04-29 23:27:23 +04:00
"mobile": "boolean",
implementing a --page-rank switch as requested by l0rda@l0rda.biz
2011-03-23 14:57:57 +03:00
"pageRank": "boolean",
adding new switch '--smart' by request
2011-07-10 19:16:58 +04:00
"smart": "boolean",
Update for Issue #118
2012-07-24 17:43:29 +04:00
"testFilter": "string",
Bernardo will kill me (added --wizard for total beginners)
2011-03-29 15:42:55 +04:00
"wizard": "boolean",
sqlmap 0.8-rc3: Merge from Miroslav Stampar's branch fixing a bug when verbosity > 2, another major bug with urlencoding/urldecoding of POST data and Cookies, adding --drop-set-cookie option, implementing support to automatically decode gzip and deflate HTTP responses, support for Google dork page result (--gpage) and a minor code cleanup.
2010-01-02 05:02:12 +03:00
"verbose": "integer"
After the storm, a restore..
2008-10-15 19:38:22 +04:00
},
}
Reference in New Issue Copy Permalink