sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-04-19 08:32:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

Updated Usage (markdown)

Browse Source
This commit is contained in:
stamparm 2012-10-27 10:34:30 -07:00
parent 5a5d571fa1
commit 2ffb3b42d1
1 changed files with 197 additions and 199 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

396
Usage.md
View File

@ -1,227 +1,227 @@
# Usage
```
Usage: python sqlmap.py [options]
Options:
-h, --help Show basic help message and exit
-hh Show advanced help message and exit
-v VERBOSE Verbosity level: 0-6 (default 1)
Usage: python sqlmap.py [options]
Target:
At least one of these options has to be specified to set the source to
get target urls from
Options:
-h, --help Show basic help message and exit
-hh Show advanced help message and exit
-v VERBOSE Verbosity level: 0-6 (default 1)
-d DIRECT Direct connection to the database
-u URL, --url=URL Target url
-l LOGFILE Parse targets from Burp or WebScarab proxy logs
-m BULKFILE Scan multiple targets enlisted in a given textual file
-r REQUESTFILE Load HTTP request from a file
-g GOOGLEDORK Process Google dork results as target urls
-c CONFIGFILE Load options from a configuration INI file
Target:
At least one of these options has to be specified to set the source to
get target urls from
Request:
These options can be used to specify how to connect to the target url
-d DIRECT Direct connection to the database
-u URL, --url=URL Target url
-l LOGFILE Parse targets from Burp or WebScarab proxy logs
-m BULKFILE Scan multiple targets enlisted in a given textual file
-r REQUESTFILE Load HTTP request from a file
-g GOOGLEDORK Process Google dork results as target urls
-c CONFIGFILE Load options from a configuration INI file
--data=DATA Data string to be sent through POST
--param-del=PDEL Character used for splitting parameter values
--cookie=COOKIE HTTP Cookie header
--load-cookies=L.. File containing cookies in Netscape/wget format
--drop-set-cookie Ignore Set-Cookie header from response
--user-agent=AGENT HTTP User-Agent header
--random-agent Use randomly selected HTTP User-Agent header
--randomize=RPARAM Randomly change value for given parameter(s)
--force-ssl Force usage of SSL/HTTPS requests
--host=HOST HTTP Host header
--referer=REFERER HTTP Referer header
--headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123")
--auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)
--auth-cred=ACRED HTTP authentication credentials (name:password)
--auth-cert=ACERT HTTP authentication certificate (key_file,cert_file)
--proxy=PROXY Use a HTTP proxy to connect to the target url
--proxy-cred=PCRED HTTP proxy authentication credentials (name:password)
--ignore-proxy Ignore system default HTTP proxy
--delay=DELAY Delay in seconds between each HTTP request
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
--retries=RETRIES Retries when the connection timeouts (default 3)
--scope=SCOPE Regexp to filter targets from provided proxy log
--safe-url=SAFURL Url address to visit frequently during testing
--safe-freq=SAFREQ Test requests between two visits to a given safe url
--skip-urlencode Skip URL encoding of payload data
--eval=EVALCODE Evaluate provided Python code before the request (e.g.
"import hashlib;id2=hashlib.md5(id).hexdigest()")
Request:
These options can be used to specify how to connect to the target url
Optimization:
These options can be used to optimize the performance of sqlmap
--data=DATA Data string to be sent through POST
--param-del=PDEL Character used for splitting parameter values
--cookie=COOKIE HTTP Cookie header
--load-cookies=L.. File containing cookies in Netscape/wget format
--drop-set-cookie Ignore Set-Cookie header from response
--user-agent=AGENT HTTP User-Agent header
--random-agent Use randomly selected HTTP User-Agent header
--randomize=RPARAM Randomly change value for given parameter(s)
--force-ssl Force usage of SSL/HTTPS requests
--host=HOST HTTP Host header
--referer=REFERER HTTP Referer header
--headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123")
--auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)
--auth-cred=ACRED HTTP authentication credentials (name:password)
--auth-cert=ACERT HTTP authentication certificate (key_file,cert_file)
--proxy=PROXY Use a HTTP proxy to connect to the target url
--proxy-cred=PCRED HTTP proxy authentication credentials (name:password)
--ignore-proxy Ignore system default HTTP proxy
--delay=DELAY Delay in seconds between each HTTP request
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
--retries=RETRIES Retries when the connection timeouts (default 3)
--scope=SCOPE Regexp to filter targets from provided proxy log
--safe-url=SAFURL Url address to visit frequently during testing
--safe-freq=SAFREQ Test requests between two visits to a given safe url
--skip-urlencode Skip URL encoding of payload data
--eval=EVALCODE Evaluate provided Python code before the request (e.g.
"import hashlib;id2=hashlib.md5(id).hexdigest()")
-o Turn on all optimization switches
--predict-output Predict common queries output
--keep-alive Use persistent HTTP(s) connections
--null-connection Retrieve page length without actual HTTP response body
--threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
Optimization:
These options can be used to optimize the performance of sqlmap
Injection:
These options can be used to specify which parameters to test for,
provide custom injection payloads and optional tampering scripts
-o Turn on all optimization switches
--predict-output Predict common queries output
--keep-alive Use persistent HTTP(s) connections
--null-connection Retrieve page length without actual HTTP response body
--threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
-p TESTPARAMETER Testable parameter(s)
--dbms=DBMS Force back-end DBMS to this value
--os=OS Force back-end DBMS operating system to this value
--invalid-bignum Use big numbers for invalidating values
--invalid-logical Use logical operations for invalidating values
--no-cast Turn off payload casting mechanism
--no-unescape Turn off string unescaping mechanism
--prefix=PREFIX Injection payload prefix string
--suffix=SUFFIX Injection payload suffix string
--skip=SKIP Skip testing for given parameter(s)
--tamper=TAMPER Use given script(s) for tampering injection data
Injection:
These options can be used to specify which parameters to test for,
provide custom injection payloads and optional tampering scripts
Detection:
These options can be used to specify how to parse and compare page
content from HTTP responses when using blind SQL injection technique
-p TESTPARAMETER Testable parameter(s)
--dbms=DBMS Force back-end DBMS to this value
--os=OS Force back-end DBMS operating system to this value
--invalid-bignum Use big numbers for invalidating values
--invalid-logical Use logical operations for invalidating values
--no-cast Turn off payload casting mechanism
--no-unescape Turn off string unescaping mechanism
--prefix=PREFIX Injection payload prefix string
--suffix=SUFFIX Injection payload suffix string
--skip=SKIP Skip testing for given parameter(s)
--tamper=TAMPER Use given script(s) for tampering injection data
--level=LEVEL Level of tests to perform (1-5, default 1)
--risk=RISK Risk of tests to perform (0-3, default 1)
--string=STRING String to match when query is evaluated to True
--not-string=NOT.. String to match when query is evaluated to False
--regexp=REGEXP Regexp to match when query is evaluated to True
--code=CODE HTTP code to match when query is evaluated to True
--text-only Compare pages based only on the textual content
--titles Compare pages based only on their titles
Detection:
These options can be used to specify how to parse and compare page
content from HTTP responses when using blind SQL injection technique
Techniques:
These options can be used to tweak testing of specific SQL injection
techniques
--level=LEVEL Level of tests to perform (1-5, default 1)
--risk=RISK Risk of tests to perform (0-3, default 1)
--string=STRING String to match when query is evaluated to True
--not-string=NOT.. String to match when query is evaluated to False
--regexp=REGEXP Regexp to match when query is evaluated to True
--code=CODE HTTP code to match when query is evaluated to True
--text-only Compare pages based only on the textual content
--titles Compare pages based only on their titles
--technique=TECH SQL injection techniques to test for (default "BEUST")
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
--union-cols=UCOLS Range of columns to test for UNION query SQL injection
--union-char=UCHAR Character to use for bruteforcing number of columns
--dns-domain=DNS.. Domain name used for DNS exfiltration attack
--second-order=S.. Resulting page url searched for second-order response
Techniques:
These options can be used to tweak testing of specific SQL injection
techniques
Fingerprint:
-f, --fingerprint Perform an extensive DBMS version fingerprint
--technique=TECH SQL injection techniques to test for (default "BEUST")
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
--union-cols=UCOLS Range of columns to test for UNION query SQL injection
--union-char=UCHAR Character to use for bruteforcing number of columns
--dns-domain=DNS.. Domain name used for DNS exfiltration attack
--second-order=S.. Resulting page url searched for second-order response
Enumeration:
These options can be used to enumerate the back-end database
management system information, structure and data contained in the
tables. Moreover you can run your own SQL statements
Fingerprint:
-f, --fingerprint Perform an extensive DBMS version fingerprint
-a, --all Retrieve everything
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--hostname Retrieve DBMS server hostname
--is-dba Detect if the DBMS current user is DBA
--users Enumerate DBMS users
--passwords Enumerate DBMS users password hashes
--privileges Enumerate DBMS users privileges
--roles Enumerate DBMS users roles
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--schema Enumerate DBMS schema
--count Retrieve number of entries for table(s)
--dump Dump DBMS database table entries
--dump-all Dump all DBMS databases tables entries
--search Search column(s), table(s) and/or database name(s)
-D DB DBMS database to enumerate
-T TBL DBMS database table to enumerate
-C COL DBMS database table column to enumerate
-U USER DBMS user to enumerate
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
--start=LIMITSTART First query output entry to retrieve
--stop=LIMITSTOP Last query output entry to retrieve
--first=FIRSTCHAR First query output word character to retrieve
--last=LASTCHAR Last query output word character to retrieve
--sql-query=QUERY SQL statement to be executed
--sql-shell Prompt for an interactive SQL shell
--sql-file=SQLFILE Execute SQL statements from given file(s)
Enumeration:
These options can be used to enumerate the back-end database
management system information, structure and data contained in the
tables. Moreover you can run your own SQL statements
Brute force:
These options can be used to run brute force checks
-a, --all Retrieve everything
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--hostname Retrieve DBMS server hostname
--is-dba Detect if the DBMS current user is DBA
--users Enumerate DBMS users
--passwords Enumerate DBMS users password hashes
--privileges Enumerate DBMS users privileges
--roles Enumerate DBMS users roles
--dbs Enumerate DBMS databases
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--schema Enumerate DBMS schema
--count Retrieve number of entries for table(s)
--dump Dump DBMS database table entries
--dump-all Dump all DBMS databases tables entries
--search Search column(s), table(s) and/or database name(s)
-D DB DBMS database to enumerate
-T TBL DBMS database table to enumerate
-C COL DBMS database table column to enumerate
-U USER DBMS user to enumerate
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
--start=LIMITSTART First query output entry to retrieve
--stop=LIMITSTOP Last query output entry to retrieve
--first=FIRSTCHAR First query output word character to retrieve
--last=LASTCHAR Last query output word character to retrieve
--sql-query=QUERY SQL statement to be executed
--sql-shell Prompt for an interactive SQL shell
--sql-file=SQLFILE Execute SQL statements from given file(s)
--common-tables Check existence of common tables
--common-columns Check existence of common columns
Brute force:
These options can be used to run brute force checks
User-defined function injection:
These options can be used to create custom user-defined functions
--common-tables Check existence of common tables
--common-columns Check existence of common columns
--udf-inject Inject custom user-defined functions
--shared-lib=SHLIB Local path of the shared library
User-defined function injection:
These options can be used to create custom user-defined functions
File system access:
These options can be used to access the back-end database management
system underlying file system
--udf-inject Inject custom user-defined functions
--shared-lib=SHLIB Local path of the shared library
--file-read=RFILE Read a file from the back-end DBMS file system
--file-write=WFILE Write a local file on the back-end DBMS file system
--file-dest=DFILE Back-end DBMS absolute filepath to write to
File system access:
These options can be used to access the back-end database management
system underlying file system
Operating system access:
These options can be used to access the back-end database management
system underlying operating system
--file-read=RFILE Read a file from the back-end DBMS file system
--file-write=WFILE Write a local file on the back-end DBMS file system
--file-dest=DFILE Back-end DBMS absolute filepath to write to
--os-cmd=OSCMD Execute an operating system command
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
--priv-esc Database process' user privilege escalation
--msf-path=MSFPATH Local path where Metasploit Framework is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
Operating system access:
These options can be used to access the back-end database management
system underlying operating system
Windows registry access:
These options can be used to access the back-end database management
system Windows registry
--os-cmd=OSCMD Execute an operating system command
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
--priv-esc Database process' user privilege escalation
--msf-path=MSFPATH Local path where Metasploit Framework is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
--reg-read Read a Windows registry key value
--reg-add Write a Windows registry key value data
--reg-del Delete a Windows registry key value
--reg-key=REGKEY Windows registry key
--reg-value=REGVAL Windows registry key value
--reg-data=REGDATA Windows registry key value data
--reg-type=REGTYPE Windows registry key value type
Windows registry access:
These options can be used to access the back-end database management
system Windows registry
General:
These options can be used to set some general working parameters
--reg-read Read a Windows registry key value
--reg-add Write a Windows registry key value data
--reg-del Delete a Windows registry key value
--reg-key=REGKEY Windows registry key
--reg-value=REGVAL Windows registry key value
--reg-data=REGDATA Windows registry key value data
--reg-type=REGTYPE Windows registry key value type
-t TRAFFICFILE Log all HTTP traffic into a textual file
--batch Never ask for user input, use the default behaviour
--charset=CHARSET Force character encoding used for data retrieval
--check-tor Check to see if Tor is used properly
--crawl=CRAWLDEPTH Crawl the website starting from the target url
--csv-del=CSVDEL Delimiting character used in CSV output (default ",")
--dbms-cred=DBMS.. DBMS authentication credentials (user:password)
--eta Display for each output the estimated time of arrival
--flush-session Flush session files for current target
--forms Parse and test forms on target url
--fresh-queries Ignores query results stored in session file
--hex Uses DBMS hex function(s) for data retrieval
--output-dir=ODIR Custom output directory path
--parse-errors Parse and display DBMS error messages from responses
--replicate Replicate dumped data into a sqlite3 database
--save Save options to a configuration INI file
--tor Use Tor anonymity network
--tor-port=TORPORT Set Tor proxy port other than default
--tor-type=TORTYPE Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5)
--update Update sqlmap
General:
These options can be used to set some general working parameters
-t TRAFFICFILE Log all HTTP traffic into a textual file
--batch Never ask for user input, use the default behaviour
--charset=CHARSET Force character encoding used for data retrieval
--check-tor Check to see if Tor is used properly
--crawl=CRAWLDEPTH Crawl the website starting from the target url
--csv-del=CSVDEL Delimiting character used in CSV output (default ",")
--dbms-cred=DBMS.. DBMS authentication credentials (user:password)
--eta Display for each output the estimated time of arrival
--flush-session Flush session files for current target
--forms Parse and test forms on target url
--fresh-queries Ignores query results stored in session file
--hex Uses DBMS hex function(s) for data retrieval
--output-dir=ODIR Custom output directory path
--parse-errors Parse and display DBMS error messages from responses
--replicate Replicate dumped data into a sqlite3 database
--save Save options to a configuration INI file
--tor Use Tor anonymity network
--tor-port=TORPORT Set Tor proxy port other than default
--tor-type=TORTYPE Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5)
--update Update sqlmap
Miscellaneous:
-z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
--check-payload Offline WAF/IPS/IDS payload detection testing
--check-waf Check for existence of WAF/IPS/IDS protection
--cleanup Clean up the DBMS by sqlmap specific UDF and tables
--dependencies Check for missing sqlmap dependencies
--disable-coloring Disable console output coloring
--gpage=GOOGLEPAGE Use Google dork results from specified page number
--mobile Imitate smartphone through HTTP User-Agent header
--page-rank Display page rank (PR) for Google dork results
--purge-output Safely remove all content from output directory
--smart Conduct through tests only if positive heuristic(s)
--test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW)
--wizard Simple wizard interface for beginner users
Miscellaneous:
-z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
--check-payload Offline WAF/IPS/IDS payload detection testing
--check-waf Check for existence of WAF/IPS/IDS protection
--cleanup Clean up the DBMS by sqlmap specific UDF and tables
--dependencies Check for missing sqlmap dependencies
--disable-coloring Disable console output coloring
--gpage=GOOGLEPAGE Use Google dork results from specified page number
--mobile Imitate smartphone through HTTP User-Agent header
--page-rank Display page rank (PR) for Google dork results
--purge-output Safely remove all content from output directory
--smart Conduct through tests only if positive heuristic(s)
--test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW)
--wizard Simple wizard interface for beginner users
```
## Output verbosity
Switch: `-v`
@ -297,7 +297,7 @@ By default the HTTP method used to perform HTTP requests is `GET`, but you can i
### HTTP `Cookie` header
Switches: `--cookie`, `--drop-set-cookie` and `--cookie-urlencode`
Switches: `--cookie` and `--drop-set-cookie`
This feature can be useful in two ways:
@ -318,8 +318,6 @@ If at any time during the communication, the web application responds with `Set-
Vice versa, if you provide a HTTP `Cookie` header with `--cookie` switch and the target URL sends an HTTP
`Set-Cookie` header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests.
sqlmap by default does **not** URL-encode generated cookie payloads, but you can force it by using the `--cookie-urlencode` switch. Cookie content encoding is not declared by HTTP protocol standard in any way, so it is solely the matter of web application's behaviour.
Note that also the HTTP `Cookie` header is tested against SQL injection if the `--level` is set to **2** or above. Read below for details.
### HTTP `User-Agent` header
@ -329,7 +327,7 @@ Switches: `--user-agent` and `--random-agent`
By default sqlmap performs HTTP requests with the following `User-Agent` header value:
sqlmap/0.9 (http://www.sqlmap.org)
sqlmap/1.0-dev-xxxxxxx (http://sqlmap.org)
However, it is possible to fake it with the `--user-agent` switch by providing custom User-Agent as the switch argument.
@ -1468,4 +1466,4 @@ You can then use sqlmap itself to read and query the locally created SQLite 3 fi
Switch: `--wizard`
Do you really want to know?
Do you really want to know?