sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-06-13 01:23:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

Updated Usage (markdown)

Browse Source
This commit is contained in:
stamparm 2012-10-27 10:34:30 -07:00
parent 5a5d571fa1
commit 2ffb3b42d1
1 changed files with 197 additions and 199 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Usage.md
View File

@ -1,5 +1,5 @@
# Usage
```
Usage: python sqlmap.py [options]
Options:
@ -221,7 +221,7 @@ Options:
--smart Conduct through tests only if positive heuristic(s)
--test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW)
--wizard Simple wizard interface for beginner users
```
## Output verbosity
Switch: `-v`
@ -297,7 +297,7 @@ By default the HTTP method used to perform HTTP requests is `GET`, but you can i
### HTTP `Cookie` header
Switches: `--cookie`, `--drop-set-cookie` and `--cookie-urlencode`
Switches: `--cookie` and `--drop-set-cookie`
This feature can be useful in two ways:
@ -318,8 +318,6 @@ If at any time during the communication, the web application responds with `Set-
Vice versa, if you provide a HTTP `Cookie` header with `--cookie` switch and the target URL sends an HTTP
`Set-Cookie` header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests.
sqlmap by default does **not** URL-encode generated cookie payloads, but you can force it by using the `--cookie-urlencode` switch. Cookie content encoding is not declared by HTTP protocol standard in any way, so it is solely the matter of web application's behaviour.
Note that also the HTTP `Cookie` header is tested against SQL injection if the `--level` is set to **2** or above. Read below for details.
### HTTP `User-Agent` header
@ -329,7 +327,7 @@ Switches: `--user-agent` and `--random-agent`
By default sqlmap performs HTTP requests with the following `User-Agent` header value:
sqlmap/0.9 (http://www.sqlmap.org)
sqlmap/1.0-dev-xxxxxxx (http://sqlmap.org)
However, it is possible to fake it with the `--user-agent` switch by providing custom User-Agent as the switch argument.