diff --git a/doc/README.html b/doc/README.html index 6d01bf3cb..2e063a14b 100644 --- a/doc/README.html +++ b/doc/README.html @@ -181,14 +181,14 @@ in the following section to go ahead with the exploiting.

1.3 Techniques

-

sqlmap implements two techniques to exploit a SQL injection vulnerability:

+

sqlmap implements three techniques to exploit a SQL injection +vulnerability:

It is strongly recommended to run at least once sqlmap with the @@ -241,16 +250,17 @@ database management system name if you already know it. sqlmap is also able to fingerprint the web server operating system, the web application technology and, in some circumstances, the back-end DBMS operating system. -

  • Full support for two SQL injection techniques: blind SQL -injection and inband SQL injection. sqlmap can also test for -Time based blind SQL injection. +
  • Full support for three SQL injection techniques: inferential +blind SQL injection, UNION query (inband) SQL injection and +stacked queries (multiple statements) support. sqlmap can also +test for time based blind SQL injection.
  • Options to retrieve on all four back-end database management system banner, current user, current database, enumerate users, users password hashes, users privileges, databases, tables, columns, dump tables entries, dump whole database management -system and run your own SQL SELECT statement. +system and run your own SQL statement.
  • If the back-end database management system is MySQL it is also possible to read a specific file content from the ile system and, @@ -460,7 +470,7 @@ Options: Enumeration: These options can be used to enumerate the back-end database management system information, structure and data contained in the - tables. Moreover you can run your own SQL SELECT queries. + tables. Moreover you can run your own SQL statements. -b, --banner Retrieve DBMS banner --current-user Retrieve DBMS current user @@ -481,7 +491,7 @@ Options: --exclude-sysdbs Exclude DBMS system databases when enumerating tables --start=LIMITSTART First table entry to dump --stop=LIMITSTOP Last table entry to dump - --sql-query=QUERY SQL SELECT query to be executed + --sql-query=QUERY SQL statement to be executed --sql-shell Prompt for an interactive SQL shell File system access: @@ -3406,7 +3416,7 @@ considered a system database because some database administrators use it as a users' database.

    -

    Run your own SQL SELECT statement

    +

    Run your own SQL statement

    Options: --sql-query and --sql-shell

    diff --git a/doc/README.pdf b/doc/README.pdf index 5d2b085d5..51966ae50 100644 Binary files a/doc/README.pdf and b/doc/README.pdf differ diff --git a/doc/README.sgml b/doc/README.sgml index c35a2de1f..8f71bcf07 100644 --- a/doc/README.sgml +++ b/doc/README.sgml @@ -138,14 +138,14 @@ in the following section to go ahead with the exploiting. Techniques

    -sqlmap implements two techniques to exploit a SQL injection vulnerability: +sqlmap implements three techniques to exploit a SQL injection +vulnerability: -Blind SQL injection, also known as Inferential Blind SQL -injection in this implementation: sqlmap appends to the affected -parameter in the HTTP request, a syntatically valid SQL statement string -containing a SELECT sub-statement, or any other SQL statement -whose the user want to retrieve the output. +Inferential Blind SQL injection: sqlmap appends to the +affected parameter in the HTTP request, a syntatically valid SQL statement +string containing a SELECT sub-statement, or any other SQL +statement whose the user want to retrieve the output. For each HTTP response, by making a comparison based upon HTML page content hashes, or string matches, with the original request, the tool determines the output value of the statement character by character. @@ -153,13 +153,13 @@ The bisection algorithm implemented in sqlmap to perform this technique is able to fetch each output character with at maximum seven HTTP requests. This is sqlmap default SQL injection technique. -Inband SQL injection, also known as Full UNION query SQL -injection: sqlmap appends to the affected parameter in the HTTP -request, a syntatically valid SQL statement string starting with a -UNION ALL SELECT. This techique is useful if the web application -page passes the output of the SELECT statement to a for -cycle, or similar, so that each line of the query output is printed on the -page content. +UNION query (inband) SQL injection, also known as Full +UNION query SQL injection: sqlmap appends to the affected parameter +in the HTTP request, a syntatically valid SQL statement string starting +with a UNION ALL SELECT. This techique is useful if the web +application page passes the output of the SELECT statement to a +for cycle, or similar, so that each line of the query output is +printed on the page content. sqlmap is also able to exploit Partial UNION query SQL injection vulnerabilities which occur when the output of the statement is not cycled in a for construct whereas only the first entry output is displayed. @@ -167,6 +167,15 @@ This technique is much faster if the target url is affected by because in a single HTTP response it returns the whole query output or a entry per each response within the page content. This SQL injection technique is an alternative to the first one. +Stacked queries support, also known as multiple +statements support: sqlmap tests if the web application supports +stacked queries then, in case it does support, it appends to the affected +parameter in the HTTP request, a semi-colon (;) followed by the +SQL statement to be executed. This technique is useful if to run SQL +statements other than SELECT like, for instance, data +definition or data manipulation statements possibly leading +to file system read and write access and operating system command +execution depending on the underlying back-end database management system. It is strongly recommended to run at least once sqlmap with the @@ -199,16 +208,17 @@ database management system name if you already know it. sqlmap is also able to fingerprint the web server operating system, the web application technology and, in some circumstances, the back-end DBMS operating system. -Full support for two SQL injection techniques: blind SQL -injection and inband SQL injection. sqlmap can also test for -Time based blind SQL injection. +Full support for three SQL injection techniques: inferential +blind SQL injection, UNION query (inband) SQL injection and +stacked queries (multiple statements) support. sqlmap can also +test for time based blind SQL injection. Options to retrieve on all four back-end database management system banner, current user, current database, enumerate users, users password hashes, users privileges, databases, tables, columns, dump tables entries, dump whole database management -system and run your own SQL SELECT statement. +system and run your own SQL statement. If the back-end database management system is MySQL it is also possible to read a specific file content from the ile system and, @@ -416,7 +426,7 @@ Options: Enumeration: These options can be used to enumerate the back-end database management system information, structure and data contained in the - tables. Moreover you can run your own SQL SELECT queries. + tables. Moreover you can run your own SQL statements. -b, --banner Retrieve DBMS banner --current-user Retrieve DBMS current user @@ -437,7 +447,7 @@ Options: --exclude-sysdbs Exclude DBMS system databases when enumerating tables --start=LIMITSTART First table entry to dump --stop=LIMITSTOP Last table entry to dump - --sql-query=QUERY SQL SELECT query to be executed + --sql-query=QUERY SQL statement to be executed --sql-shell Prompt for an interactive SQL shell File system access: @@ -3310,7 +3320,9 @@ considered a system database because some database administrators use it as a users' database. -Run your own SQL SELECT statement +Run your own SQL statement + +

    Options: --sql-query and --sql-shell diff --git a/doc/THANKS b/doc/THANKS index f53a5bb5d..972b04f44 100644 --- a/doc/THANKS +++ b/doc/THANKS @@ -116,6 +116,10 @@ Sven Schluter for providing with a patch for waiting a number of seconds between each HTTP request +Sumit Siddharth + for providing me with ideas on the implementation on a couple of + features + M Simkin for suggesting a feature