From 2ffb3b42d1cd074685645a0ec9b09ac046be2dd8 Mon Sep 17 00:00:00 2001 From: stamparm Date: Sat, 27 Oct 2012 10:34:30 -0700 Subject: [PATCH] Updated Usage (markdown) --- Usage.md | 396 +++++++++++++++++++++++++++---------------------------- 1 file changed, 197 insertions(+), 199 deletions(-) diff --git a/Usage.md b/Usage.md index 804007c8b..83d3512b6 100644 --- a/Usage.md +++ b/Usage.md @@ -1,227 +1,227 @@ # Usage -``` -Usage: python sqlmap.py [options] -Options: - -h, --help Show basic help message and exit - -hh Show advanced help message and exit - -v VERBOSE Verbosity level: 0-6 (default 1) + Usage: python sqlmap.py [options] - Target: - At least one of these options has to be specified to set the source to - get target urls from + Options: + -h, --help Show basic help message and exit + -hh Show advanced help message and exit + -v VERBOSE Verbosity level: 0-6 (default 1) - -d DIRECT Direct connection to the database - -u URL, --url=URL Target url - -l LOGFILE Parse targets from Burp or WebScarab proxy logs - -m BULKFILE Scan multiple targets enlisted in a given textual file - -r REQUESTFILE Load HTTP request from a file - -g GOOGLEDORK Process Google dork results as target urls - -c CONFIGFILE Load options from a configuration INI file + Target: + At least one of these options has to be specified to set the source to + get target urls from - Request: - These options can be used to specify how to connect to the target url + -d DIRECT Direct connection to the database + -u URL, --url=URL Target url + -l LOGFILE Parse targets from Burp or WebScarab proxy logs + -m BULKFILE Scan multiple targets enlisted in a given textual file + -r REQUESTFILE Load HTTP request from a file + -g GOOGLEDORK Process Google dork results as target urls + -c CONFIGFILE Load options from a configuration INI file - --data=DATA Data string to be sent through POST - --param-del=PDEL Character used for splitting parameter values - --cookie=COOKIE HTTP Cookie header - --load-cookies=L.. File containing cookies in Netscape/wget format - --drop-set-cookie Ignore Set-Cookie header from response - --user-agent=AGENT HTTP User-Agent header - --random-agent Use randomly selected HTTP User-Agent header - --randomize=RPARAM Randomly change value for given parameter(s) - --force-ssl Force usage of SSL/HTTPS requests - --host=HOST HTTP Host header - --referer=REFERER HTTP Referer header - --headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123") - --auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM) - --auth-cred=ACRED HTTP authentication credentials (name:password) - --auth-cert=ACERT HTTP authentication certificate (key_file,cert_file) - --proxy=PROXY Use a HTTP proxy to connect to the target url - --proxy-cred=PCRED HTTP proxy authentication credentials (name:password) - --ignore-proxy Ignore system default HTTP proxy - --delay=DELAY Delay in seconds between each HTTP request - --timeout=TIMEOUT Seconds to wait before timeout connection (default 30) - --retries=RETRIES Retries when the connection timeouts (default 3) - --scope=SCOPE Regexp to filter targets from provided proxy log - --safe-url=SAFURL Url address to visit frequently during testing - --safe-freq=SAFREQ Test requests between two visits to a given safe url - --skip-urlencode Skip URL encoding of payload data - --eval=EVALCODE Evaluate provided Python code before the request (e.g. - "import hashlib;id2=hashlib.md5(id).hexdigest()") + Request: + These options can be used to specify how to connect to the target url - Optimization: - These options can be used to optimize the performance of sqlmap + --data=DATA Data string to be sent through POST + --param-del=PDEL Character used for splitting parameter values + --cookie=COOKIE HTTP Cookie header + --load-cookies=L.. File containing cookies in Netscape/wget format + --drop-set-cookie Ignore Set-Cookie header from response + --user-agent=AGENT HTTP User-Agent header + --random-agent Use randomly selected HTTP User-Agent header + --randomize=RPARAM Randomly change value for given parameter(s) + --force-ssl Force usage of SSL/HTTPS requests + --host=HOST HTTP Host header + --referer=REFERER HTTP Referer header + --headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123") + --auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM) + --auth-cred=ACRED HTTP authentication credentials (name:password) + --auth-cert=ACERT HTTP authentication certificate (key_file,cert_file) + --proxy=PROXY Use a HTTP proxy to connect to the target url + --proxy-cred=PCRED HTTP proxy authentication credentials (name:password) + --ignore-proxy Ignore system default HTTP proxy + --delay=DELAY Delay in seconds between each HTTP request + --timeout=TIMEOUT Seconds to wait before timeout connection (default 30) + --retries=RETRIES Retries when the connection timeouts (default 3) + --scope=SCOPE Regexp to filter targets from provided proxy log + --safe-url=SAFURL Url address to visit frequently during testing + --safe-freq=SAFREQ Test requests between two visits to a given safe url + --skip-urlencode Skip URL encoding of payload data + --eval=EVALCODE Evaluate provided Python code before the request (e.g. + "import hashlib;id2=hashlib.md5(id).hexdigest()") - -o Turn on all optimization switches - --predict-output Predict common queries output - --keep-alive Use persistent HTTP(s) connections - --null-connection Retrieve page length without actual HTTP response body - --threads=THREADS Max number of concurrent HTTP(s) requests (default 1) + Optimization: + These options can be used to optimize the performance of sqlmap - Injection: - These options can be used to specify which parameters to test for, - provide custom injection payloads and optional tampering scripts + -o Turn on all optimization switches + --predict-output Predict common queries output + --keep-alive Use persistent HTTP(s) connections + --null-connection Retrieve page length without actual HTTP response body + --threads=THREADS Max number of concurrent HTTP(s) requests (default 1) - -p TESTPARAMETER Testable parameter(s) - --dbms=DBMS Force back-end DBMS to this value - --os=OS Force back-end DBMS operating system to this value - --invalid-bignum Use big numbers for invalidating values - --invalid-logical Use logical operations for invalidating values - --no-cast Turn off payload casting mechanism - --no-unescape Turn off string unescaping mechanism - --prefix=PREFIX Injection payload prefix string - --suffix=SUFFIX Injection payload suffix string - --skip=SKIP Skip testing for given parameter(s) - --tamper=TAMPER Use given script(s) for tampering injection data + Injection: + These options can be used to specify which parameters to test for, + provide custom injection payloads and optional tampering scripts - Detection: - These options can be used to specify how to parse and compare page - content from HTTP responses when using blind SQL injection technique + -p TESTPARAMETER Testable parameter(s) + --dbms=DBMS Force back-end DBMS to this value + --os=OS Force back-end DBMS operating system to this value + --invalid-bignum Use big numbers for invalidating values + --invalid-logical Use logical operations for invalidating values + --no-cast Turn off payload casting mechanism + --no-unescape Turn off string unescaping mechanism + --prefix=PREFIX Injection payload prefix string + --suffix=SUFFIX Injection payload suffix string + --skip=SKIP Skip testing for given parameter(s) + --tamper=TAMPER Use given script(s) for tampering injection data - --level=LEVEL Level of tests to perform (1-5, default 1) - --risk=RISK Risk of tests to perform (0-3, default 1) - --string=STRING String to match when query is evaluated to True - --not-string=NOT.. String to match when query is evaluated to False - --regexp=REGEXP Regexp to match when query is evaluated to True - --code=CODE HTTP code to match when query is evaluated to True - --text-only Compare pages based only on the textual content - --titles Compare pages based only on their titles + Detection: + These options can be used to specify how to parse and compare page + content from HTTP responses when using blind SQL injection technique - Techniques: - These options can be used to tweak testing of specific SQL injection - techniques + --level=LEVEL Level of tests to perform (1-5, default 1) + --risk=RISK Risk of tests to perform (0-3, default 1) + --string=STRING String to match when query is evaluated to True + --not-string=NOT.. String to match when query is evaluated to False + --regexp=REGEXP Regexp to match when query is evaluated to True + --code=CODE HTTP code to match when query is evaluated to True + --text-only Compare pages based only on the textual content + --titles Compare pages based only on their titles - --technique=TECH SQL injection techniques to test for (default "BEUST") - --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) - --union-cols=UCOLS Range of columns to test for UNION query SQL injection - --union-char=UCHAR Character to use for bruteforcing number of columns - --dns-domain=DNS.. Domain name used for DNS exfiltration attack - --second-order=S.. Resulting page url searched for second-order response + Techniques: + These options can be used to tweak testing of specific SQL injection + techniques - Fingerprint: - -f, --fingerprint Perform an extensive DBMS version fingerprint + --technique=TECH SQL injection techniques to test for (default "BEUST") + --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) + --union-cols=UCOLS Range of columns to test for UNION query SQL injection + --union-char=UCHAR Character to use for bruteforcing number of columns + --dns-domain=DNS.. Domain name used for DNS exfiltration attack + --second-order=S.. Resulting page url searched for second-order response - Enumeration: - These options can be used to enumerate the back-end database - management system information, structure and data contained in the - tables. Moreover you can run your own SQL statements + Fingerprint: + -f, --fingerprint Perform an extensive DBMS version fingerprint - -a, --all Retrieve everything - -b, --banner Retrieve DBMS banner - --current-user Retrieve DBMS current user - --current-db Retrieve DBMS current database - --hostname Retrieve DBMS server hostname - --is-dba Detect if the DBMS current user is DBA - --users Enumerate DBMS users - --passwords Enumerate DBMS users password hashes - --privileges Enumerate DBMS users privileges - --roles Enumerate DBMS users roles - --dbs Enumerate DBMS databases - --tables Enumerate DBMS database tables - --columns Enumerate DBMS database table columns - --schema Enumerate DBMS schema - --count Retrieve number of entries for table(s) - --dump Dump DBMS database table entries - --dump-all Dump all DBMS databases tables entries - --search Search column(s), table(s) and/or database name(s) - -D DB DBMS database to enumerate - -T TBL DBMS database table to enumerate - -C COL DBMS database table column to enumerate - -U USER DBMS user to enumerate - --exclude-sysdbs Exclude DBMS system databases when enumerating tables - --start=LIMITSTART First query output entry to retrieve - --stop=LIMITSTOP Last query output entry to retrieve - --first=FIRSTCHAR First query output word character to retrieve - --last=LASTCHAR Last query output word character to retrieve - --sql-query=QUERY SQL statement to be executed - --sql-shell Prompt for an interactive SQL shell - --sql-file=SQLFILE Execute SQL statements from given file(s) + Enumeration: + These options can be used to enumerate the back-end database + management system information, structure and data contained in the + tables. Moreover you can run your own SQL statements - Brute force: - These options can be used to run brute force checks + -a, --all Retrieve everything + -b, --banner Retrieve DBMS banner + --current-user Retrieve DBMS current user + --current-db Retrieve DBMS current database + --hostname Retrieve DBMS server hostname + --is-dba Detect if the DBMS current user is DBA + --users Enumerate DBMS users + --passwords Enumerate DBMS users password hashes + --privileges Enumerate DBMS users privileges + --roles Enumerate DBMS users roles + --dbs Enumerate DBMS databases + --tables Enumerate DBMS database tables + --columns Enumerate DBMS database table columns + --schema Enumerate DBMS schema + --count Retrieve number of entries for table(s) + --dump Dump DBMS database table entries + --dump-all Dump all DBMS databases tables entries + --search Search column(s), table(s) and/or database name(s) + -D DB DBMS database to enumerate + -T TBL DBMS database table to enumerate + -C COL DBMS database table column to enumerate + -U USER DBMS user to enumerate + --exclude-sysdbs Exclude DBMS system databases when enumerating tables + --start=LIMITSTART First query output entry to retrieve + --stop=LIMITSTOP Last query output entry to retrieve + --first=FIRSTCHAR First query output word character to retrieve + --last=LASTCHAR Last query output word character to retrieve + --sql-query=QUERY SQL statement to be executed + --sql-shell Prompt for an interactive SQL shell + --sql-file=SQLFILE Execute SQL statements from given file(s) - --common-tables Check existence of common tables - --common-columns Check existence of common columns + Brute force: + These options can be used to run brute force checks - User-defined function injection: - These options can be used to create custom user-defined functions + --common-tables Check existence of common tables + --common-columns Check existence of common columns - --udf-inject Inject custom user-defined functions - --shared-lib=SHLIB Local path of the shared library + User-defined function injection: + These options can be used to create custom user-defined functions - File system access: - These options can be used to access the back-end database management - system underlying file system + --udf-inject Inject custom user-defined functions + --shared-lib=SHLIB Local path of the shared library - --file-read=RFILE Read a file from the back-end DBMS file system - --file-write=WFILE Write a local file on the back-end DBMS file system - --file-dest=DFILE Back-end DBMS absolute filepath to write to + File system access: + These options can be used to access the back-end database management + system underlying file system - Operating system access: - These options can be used to access the back-end database management - system underlying operating system + --file-read=RFILE Read a file from the back-end DBMS file system + --file-write=WFILE Write a local file on the back-end DBMS file system + --file-dest=DFILE Back-end DBMS absolute filepath to write to - --os-cmd=OSCMD Execute an operating system command - --os-shell Prompt for an interactive operating system shell - --os-pwn Prompt for an out-of-band shell, meterpreter or VNC - --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC - --os-bof Stored procedure buffer overflow exploitation - --priv-esc Database process' user privilege escalation - --msf-path=MSFPATH Local path where Metasploit Framework is installed - --tmp-path=TMPPATH Remote absolute path of temporary files directory + Operating system access: + These options can be used to access the back-end database management + system underlying operating system - Windows registry access: - These options can be used to access the back-end database management - system Windows registry + --os-cmd=OSCMD Execute an operating system command + --os-shell Prompt for an interactive operating system shell + --os-pwn Prompt for an out-of-band shell, meterpreter or VNC + --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC + --os-bof Stored procedure buffer overflow exploitation + --priv-esc Database process' user privilege escalation + --msf-path=MSFPATH Local path where Metasploit Framework is installed + --tmp-path=TMPPATH Remote absolute path of temporary files directory - --reg-read Read a Windows registry key value - --reg-add Write a Windows registry key value data - --reg-del Delete a Windows registry key value - --reg-key=REGKEY Windows registry key - --reg-value=REGVAL Windows registry key value - --reg-data=REGDATA Windows registry key value data - --reg-type=REGTYPE Windows registry key value type + Windows registry access: + These options can be used to access the back-end database management + system Windows registry - General: - These options can be used to set some general working parameters + --reg-read Read a Windows registry key value + --reg-add Write a Windows registry key value data + --reg-del Delete a Windows registry key value + --reg-key=REGKEY Windows registry key + --reg-value=REGVAL Windows registry key value + --reg-data=REGDATA Windows registry key value data + --reg-type=REGTYPE Windows registry key value type - -t TRAFFICFILE Log all HTTP traffic into a textual file - --batch Never ask for user input, use the default behaviour - --charset=CHARSET Force character encoding used for data retrieval - --check-tor Check to see if Tor is used properly - --crawl=CRAWLDEPTH Crawl the website starting from the target url - --csv-del=CSVDEL Delimiting character used in CSV output (default ",") - --dbms-cred=DBMS.. DBMS authentication credentials (user:password) - --eta Display for each output the estimated time of arrival - --flush-session Flush session files for current target - --forms Parse and test forms on target url - --fresh-queries Ignores query results stored in session file - --hex Uses DBMS hex function(s) for data retrieval - --output-dir=ODIR Custom output directory path - --parse-errors Parse and display DBMS error messages from responses - --replicate Replicate dumped data into a sqlite3 database - --save Save options to a configuration INI file - --tor Use Tor anonymity network - --tor-port=TORPORT Set Tor proxy port other than default - --tor-type=TORTYPE Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5) - --update Update sqlmap + General: + These options can be used to set some general working parameters + + -t TRAFFICFILE Log all HTTP traffic into a textual file + --batch Never ask for user input, use the default behaviour + --charset=CHARSET Force character encoding used for data retrieval + --check-tor Check to see if Tor is used properly + --crawl=CRAWLDEPTH Crawl the website starting from the target url + --csv-del=CSVDEL Delimiting character used in CSV output (default ",") + --dbms-cred=DBMS.. DBMS authentication credentials (user:password) + --eta Display for each output the estimated time of arrival + --flush-session Flush session files for current target + --forms Parse and test forms on target url + --fresh-queries Ignores query results stored in session file + --hex Uses DBMS hex function(s) for data retrieval + --output-dir=ODIR Custom output directory path + --parse-errors Parse and display DBMS error messages from responses + --replicate Replicate dumped data into a sqlite3 database + --save Save options to a configuration INI file + --tor Use Tor anonymity network + --tor-port=TORPORT Set Tor proxy port other than default + --tor-type=TORTYPE Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5) + --update Update sqlmap + + Miscellaneous: + -z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU") + --check-payload Offline WAF/IPS/IDS payload detection testing + --check-waf Check for existence of WAF/IPS/IDS protection + --cleanup Clean up the DBMS by sqlmap specific UDF and tables + --dependencies Check for missing sqlmap dependencies + --disable-coloring Disable console output coloring + --gpage=GOOGLEPAGE Use Google dork results from specified page number + --mobile Imitate smartphone through HTTP User-Agent header + --page-rank Display page rank (PR) for Google dork results + --purge-output Safely remove all content from output directory + --smart Conduct through tests only if positive heuristic(s) + --test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW) + --wizard Simple wizard interface for beginner users - Miscellaneous: - -z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU") - --check-payload Offline WAF/IPS/IDS payload detection testing - --check-waf Check for existence of WAF/IPS/IDS protection - --cleanup Clean up the DBMS by sqlmap specific UDF and tables - --dependencies Check for missing sqlmap dependencies - --disable-coloring Disable console output coloring - --gpage=GOOGLEPAGE Use Google dork results from specified page number - --mobile Imitate smartphone through HTTP User-Agent header - --page-rank Display page rank (PR) for Google dork results - --purge-output Safely remove all content from output directory - --smart Conduct through tests only if positive heuristic(s) - --test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW) - --wizard Simple wizard interface for beginner users -``` ## Output verbosity Switch: `-v` @@ -297,7 +297,7 @@ By default the HTTP method used to perform HTTP requests is `GET`, but you can i ### HTTP `Cookie` header -Switches: `--cookie`, `--drop-set-cookie` and `--cookie-urlencode` +Switches: `--cookie` and `--drop-set-cookie` This feature can be useful in two ways: @@ -318,8 +318,6 @@ If at any time during the communication, the web application responds with `Set- Vice versa, if you provide a HTTP `Cookie` header with `--cookie` switch and the target URL sends an HTTP `Set-Cookie` header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests. -sqlmap by default does **not** URL-encode generated cookie payloads, but you can force it by using the `--cookie-urlencode` switch. Cookie content encoding is not declared by HTTP protocol standard in any way, so it is solely the matter of web application's behaviour. - Note that also the HTTP `Cookie` header is tested against SQL injection if the `--level` is set to **2** or above. Read below for details. ### HTTP `User-Agent` header @@ -329,7 +327,7 @@ Switches: `--user-agent` and `--random-agent` By default sqlmap performs HTTP requests with the following `User-Agent` header value: - sqlmap/0.9 (http://www.sqlmap.org) + sqlmap/1.0-dev-xxxxxxx (http://sqlmap.org) However, it is possible to fake it with the `--user-agent` switch by providing custom User-Agent as the switch argument. @@ -1468,4 +1466,4 @@ You can then use sqlmap itself to read and query the locally created SQLite 3 fi Switch: `--wizard` -Do you really want to know? +Do you really want to know? \ No newline at end of file