sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-06-06 06:03:22 +03:00
Code Issues Packages Projects Releases Wiki Activity

more doc updates

Browse Source
This commit is contained in:
Bernardo Damele 2011-04-10 20:31:29 +00:00
parent fbf8e7f32d
commit 9840a0491d
3 changed files with 46 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
doc/README.html
View File

@ -105,9 +105,9 @@ it packaged in their formats and ready to be installed.
Windows users can download and install the Python setup-ready installer Windows users can download and install the Python setup-ready installer
for x86, AMD64 and Itanium too.</P> for x86, AMD64 and Itanium too.</P>
<P>sqlmap relies on the <P>sqlmap relies on the
<A HREF="http://metasploit.com/framework/">Metasploit Framework</A> for some of its post-exploitation takeover <A HREF="http://metasploit.com">Metasploit Framework</A> for some of its post-exploitation takeover
features. You need to grab a copy of it from the features. You need to grab a copy of it from the
<A HREF="http://metasploit.com/framework/download/">download</A> <A HREF="http://metasploit.com/download/">download</A>
page - the required version is <B>3.5</B> or higher. page - the required version is <B>3.5</B> or higher.
For the ICMP tunneling out-of-band takeover technique, sqlmap requires For the ICMP tunneling out-of-band takeover technique, sqlmap requires
<A HREF="http://corelabs.coresecurity.com/index.php?module=Wiki&amp;action=view&amp;type=tool&amp;name=Impacket">Impacket</A> library too.</P> <A HREF="http://corelabs.coresecurity.com/index.php?module=Wiki&amp;action=view&amp;type=tool&amp;name=Impacket">Impacket</A> library too.</P>
@ -418,7 +418,7 @@ subversion repository.
message to the user. message to the user.
</LI> </LI>
<LI>Integration with other IT security open source projects, <LI>Integration with other IT security open source projects,
<A HREF="http://metasploit.com/framework/">Metasploit</A> and <A HREF="http://metasploit.com">Metasploit</A> and
<A HREF="http://w3af.sourceforge.net/">w3af</A>.</LI> <A HREF="http://w3af.sourceforge.net/">w3af</A>.</LI>
</UL> </UL>
</P> </P>
@ -727,7 +727,7 @@ release only.
<LI><B>October 20</B>, sqlmap first point release, <B>0.6.1</B>, goes <LI><B>October 20</B>, sqlmap first point release, <B>0.6.1</B>, goes
public. This includes minor bug fixes and the first contact between the public. This includes minor bug fixes and the first contact between the
tool and tool and
<A HREF="http://metasploit.com/framework">Metasploit</A>: <A HREF="http://metasploit.com">Metasploit</A>:
an auxiliary module to launch sqlmap from within Metasploit Framework. an auxiliary module to launch sqlmap from within Metasploit Framework.
The The
<A HREF="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/">subversion development repository</A> goes public again. <A HREF="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/">subversion development repository</A> goes public again.
@ -1445,16 +1445,16 @@ it.</P>
<P>Switch: <CODE>-</CODE><CODE>-predict-output</CODE></P> <P>Switch: <CODE>-</CODE><CODE>-predict-output</CODE></P>
<P>This switch is used in inference algorithm for sequential statistical <P>This switch is used in inference algorithm for sequential statistical
prediction of characters of value being retrieved. Based on items given in prediction of characters of value being retrieved. Statistical table with
<CODE>txt/common-outputs.txt</CODE> together with the knowledge of current the most promising character values is being built based on items given in
enumeration used statistical table with the most promising values is being <CODE>txt/common-outputs.txt</CODE> combined with the knowledge of current
built. In case that the value can be found among the common output values, enumeration used. In case that the value can be found among the common
as the process progresses, subsequent character tables are being narrowed output values, as the process progresses, subsequent character tables are
more and more. If used in combination with retrieval of common DBMS being narrowed more and more. If used in combination with retrieval of
entities, as with system table names and privileges, speed up is common DBMS entities, as with system table names and privileges, speed up
significant. Of course, you can edit the common outputs file according to is significant. Of course, you can edit the common outputs file according
your needs if, for instance, you notice common patterns in database table to your needs if, for instance, you notice common patterns in database
names or similar.</P> table names or similar.</P>
<P>Note that this switch is not compatible with <CODE>-</CODE><CODE>-threads</CODE> <P>Note that this switch is not compatible with <CODE>-</CODE><CODE>-threads</CODE>
switch.</P> switch.</P>
@ -1507,9 +1507,8 @@ assigned to retrieve one character of the query output. The thread ends
when that character is retrieved - it takes up to 7 HTTP(S) requests with when that character is retrieved - it takes up to 7 HTTP(S) requests with
the bisection algorithm implemented in sqlmap.</P> the bisection algorithm implemented in sqlmap.</P>
<P>Note that the multi-threading switch does not affect any other SQL <P>The maximum number of concurrent requests is set to <B>10</B> for
injection technique. The maximum number of concurrent requests is set to performance and site reliability reasons.</P>
<B>10</B> for performance and site reliability reasons.</P>
<P>Note that this switch is not compatible with <P>Note that this switch is not compatible with
<CODE>-</CODE><CODE>-predict-output</CODE> switch.</P> <CODE>-</CODE><CODE>-predict-output</CODE> switch.</P>
@ -1682,7 +1681,7 @@ comma-separated as the argument of <CODE>-</CODE><CODE>-tamper</CODE> switch.</P
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
# Define which is the order of application of tamper scripts against the payload # Define which is the order of application of tamper scripts against the payload
__priority__ = PRIORITY.HIGHEST __priority__ = PRIORITY.NORMAL
def tamper(payload): def tamper(payload):
''' '''
@ -1691,8 +1690,9 @@ def tamper(payload):
retVal = payload retVal = payload
# your code to tamper the original payload (retVal) # your code to tamper the original payload
# return the tampered payload
return retVal return retVal
</PRE> </PRE>
</CODE></BLOCKQUOTE> </CODE></BLOCKQUOTE>
@ -1701,12 +1701,12 @@ def tamper(payload):
<P>You can check valid and usable tamper scripts in the <CODE>tamper/</CODE> <P>You can check valid and usable tamper scripts in the <CODE>tamper/</CODE>
directory.</P> directory.</P>
<P>Example against a MySQL target assuming <CODE>&gt;</CODE> character, spaces and <P>Example against a MySQL target assuming that <CODE>&gt;</CODE> character,
<CODE>SELECT</CODE> string are banned:</P> spaces and capital <CODE>SELECT</CODE> string are banned:</P>
<P> <P>
<BLOCKQUOTE><CODE> <BLOCKQUOTE><CODE>
<PRE> <PRE>
$ python sqlmap.py -u "http://debiandev/sqlmap/mysql/get_int.php?id=1" --tamper \ $ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \
tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3 tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3
[hh:mm:03] [DEBUG] cleaning up configuration parameters [hh:mm:03] [DEBUG] cleaning up configuration parameters
@ -1816,7 +1816,7 @@ injected) page content with the injected wrong page content.
This way the distinction will be based upon string presence or regular This way the distinction will be based upon string presence or regular
expression match.</P> expression match.</P>
<P>In cases with lot of active (e.g. scripts, embeds, etc.) content in the <P>In cases with lot of active content (e.g. scripts, embeds, etc.) in the
HTTP responses' body, you can filter pages (<CODE>-</CODE><CODE>-text-only</CODE> HTTP responses' body, you can filter pages (<CODE>-</CODE><CODE>-text-only</CODE>
switch) just for their textual content. This way, in a good number of switch) just for their textual content. This way, in a good number of
cases, you can automatically tune the detection engine.</P> cases, you can automatically tune the detection engine.</P>
@ -2987,7 +2987,7 @@ a <CODE>&lt;DB_NAME&gt;/&lt;TABLE_NAME&gt;.csv</CODE> file into
<P>You can then use sqlmap itself to read and query the locally created <P>You can then use sqlmap itself to read and query the locally created
SQLite 3 file. For instance, <CODE>python sqlmap.py -d SQLite 3 file. For instance, <CODE>python sqlmap.py -d
sqlite:///tmp/sqlmap/output/debiandev/dump/testdb.sqlite3 --table</CODE>.</P> sqlite:///tmp/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table</CODE>.</P>
<H3>Simple wizard interface for beginner users</H3> <H3>Simple wizard interface for beginner users</H3>

BIN
doc/README.pdf
View File

Binary file not shown.

43
doc/README.sgml
View File

@ -40,10 +40,10 @@ it packaged in their formats and ready to be installed.
Windows users can download and install the Python setup-ready installer Windows users can download and install the Python setup-ready installer
for x86, AMD64 and Itanium too. for x86, AMD64 and Itanium too.
sqlmap relies on the <htmlurl url="http://metasploit.com/framework/" sqlmap relies on the <htmlurl url="http://metasploit.com"
name="Metasploit Framework"> for some of its post-exploitation takeover name="Metasploit Framework"> for some of its post-exploitation takeover
features. You need to grab a copy of it from the features. You need to grab a copy of it from the
<htmlurl url="http://metasploit.com/framework/download/" name="download"> <htmlurl url="http://metasploit.com/download/" name="download">
page - the required version is <bf>3.5</bf> or higher. page - the required version is <bf>3.5</bf> or higher.
For the ICMP tunneling out-of-band takeover technique, sqlmap requires For the ICMP tunneling out-of-band takeover technique, sqlmap requires
<htmlurl url="http://corelabs.coresecurity.com/index.php?module=Wiki&amp;action=view&amp;type=tool&amp;name=Impacket" <htmlurl url="http://corelabs.coresecurity.com/index.php?module=Wiki&amp;action=view&amp;type=tool&amp;name=Impacket"
@ -346,7 +346,7 @@ subversion repository.
message to the user. message to the user.
<item>Integration with other IT security open source projects, <item>Integration with other IT security open source projects,
<htmlurl url="http://metasploit.com/framework/" name="Metasploit"> and <htmlurl <htmlurl url="http://metasploit.com" name="Metasploit"> and <htmlurl
url="http://w3af.sourceforge.net/" name="w3af">. url="http://w3af.sourceforge.net/" name="w3af">.
</itemize> </itemize>
@ -650,7 +650,7 @@ release only.
<item><bf>October 20</bf>, sqlmap first point release, <bf>0.6.1</bf>, goes <item><bf>October 20</bf>, sqlmap first point release, <bf>0.6.1</bf>, goes
public. This includes minor bug fixes and the first contact between the public. This includes minor bug fixes and the first contact between the
tool and <htmlurl url="http://metasploit.com/framework" name="Metasploit">: tool and <htmlurl url="http://metasploit.com" name="Metasploit">:
an auxiliary module to launch sqlmap from within Metasploit Framework. an auxiliary module to launch sqlmap from within Metasploit Framework.
The <htmlurl url="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/" The <htmlurl url="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/"
name="subversion development repository"> goes public again. name="subversion development repository"> goes public again.
@ -1403,16 +1403,16 @@ Switch: <tt>-</tt><tt>-predict-output</tt>
<p> <p>
This switch is used in inference algorithm for sequential statistical This switch is used in inference algorithm for sequential statistical
prediction of characters of value being retrieved. Based on items given in prediction of characters of value being retrieved. Statistical table with
<tt>txt/common-outputs.txt</tt> together with the knowledge of current the most promising character values is being built based on items given in
enumeration used statistical table with the most promising values is being <tt>txt/common-outputs.txt</tt> combined with the knowledge of current
built. In case that the value can be found among the common output values, enumeration used. In case that the value can be found among the common
as the process progresses, subsequent character tables are being narrowed output values, as the process progresses, subsequent character tables are
more and more. If used in combination with retrieval of common DBMS being narrowed more and more. If used in combination with retrieval of
entities, as with system table names and privileges, speed up is common DBMS entities, as with system table names and privileges, speed up
significant. Of course, you can edit the common outputs file according to is significant. Of course, you can edit the common outputs file according
your needs if, for instance, you notice common patterns in database table to your needs if, for instance, you notice common patterns in database
names or similar. table names or similar.
<p> <p>
Note that this switch is not compatible with <tt>-</tt><tt>-threads</tt> Note that this switch is not compatible with <tt>-</tt><tt>-threads</tt>
@ -1666,7 +1666,7 @@ The format of a valid tamper script is as follows:
from lib.core.enums import PRIORITY from lib.core.enums import PRIORITY
# Define which is the order of application of tamper scripts against the payload # Define which is the order of application of tamper scripts against the payload
__priority__ = PRIORITY.HIGHEST __priority__ = PRIORITY.NORMAL
def tamper(payload): def tamper(payload):
''' '''
@ -1675,8 +1675,9 @@ def tamper(payload):
retVal = payload retVal = payload
# your code to tamper the original payload (retVal) # your code to tamper the original payload
# return the tampered payload
return retVal return retVal
</verb></tscreen> </verb></tscreen>
@ -1685,11 +1686,11 @@ You can check valid and usable tamper scripts in the <tt>tamper/</tt>
directory. directory.
<p> <p>
Example against a MySQL target assuming <tt>&gt;</tt> character, spaces and Example against a MySQL target assuming that <tt>&gt;</tt> character,
<tt>SELECT</tt> string are banned: spaces and capital <tt>SELECT</tt> string are banned:
<tscreen><verb> <tscreen><verb>
$ python sqlmap.py -u "http://debiandev/sqlmap/mysql/get_int.php?id=1" --tamper \ $ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \
tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3 tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3
[hh:mm:03] [DEBUG] cleaning up configuration parameters [hh:mm:03] [DEBUG] cleaning up configuration parameters
@ -1809,7 +1810,7 @@ This way the distinction will be based upon string presence or regular
expression match. expression match.
<p> <p>
In cases with lot of active (e.g. scripts, embeds, etc.) content in the In cases with lot of active content (e.g. scripts, embeds, etc.) in the
HTTP responses' body, you can filter pages (<tt>-</tt><tt>-text-only</tt> HTTP responses' body, you can filter pages (<tt>-</tt><tt>-text-only</tt>
switch) just for their textual content. This way, in a good number of switch) just for their textual content. This way, in a good number of
cases, you can automatically tune the detection engine. cases, you can automatically tune the detection engine.
@ -3116,7 +3117,7 @@ a <tt>&lt;DB_NAME&gt;/&lt;TABLE_NAME&gt;.csv</tt> file into
<p> <p>
You can then use sqlmap itself to read and query the locally created You can then use sqlmap itself to read and query the locally created
SQLite 3 file. For instance, <tt>python sqlmap.py -d SQLite 3 file. For instance, <tt>python sqlmap.py -d
sqlite:///tmp/sqlmap/output/debiandev/dump/testdb.sqlite3 --table</tt>. sqlite:///tmp/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table</tt>.
<sect2>Simple wizard interface for beginner users <sect2>Simple wizard interface for beginner users