sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-11-04 01:47:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

Updated Usage (markdown)

Browse Source
This commit is contained in:
stamparm 2012-10-27 10:25:38 -07:00
parent a159c36d5a
commit b02206cb22
1 changed files with 192 additions and 189 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

381
Usage.md
View File

@ -1,223 +1,226 @@
# Usage # Usage
Usage: python sqlmap.py [options] Usage: python sqlmap.py [options]
Options: Options:
-h, --help Show basic help message and exit -h, --help Show basic help message and exit
-hh Show advanced help message and exit -hh Show advanced help message and exit
-v VERBOSE Verbosity level: 0-6 (default 1) -v VERBOSE Verbosity level: 0-6 (default 1)
Target: Target:
At least one of these options has to be specified to set the source to At least one of these options has to be specified to set the source to
get target urls from get target urls from
-d DIRECT Direct connection to the database -d DIRECT Direct connection to the database
-u URL, --url=URL Target url -u URL, --url=URL Target url
-l LOGFILE Parse targets from Burp or WebScarab proxy logs -l LOGFILE Parse targets from Burp or WebScarab proxy logs
-m BULKFILE Scan multiple targets enlisted in a given textual file -m BULKFILE Scan multiple targets enlisted in a given textual file
-r REQUESTFILE Load HTTP request from a file -r REQUESTFILE Load HTTP request from a file
-g GOOGLEDORK Process Google dork results as target urls -g GOOGLEDORK Process Google dork results as target urls
-c CONFIGFILE Load options from a configuration INI file -c CONFIGFILE Load options from a configuration INI file
Request: Request:
These options can be used to specify how to connect to the target url These options can be used to specify how to connect to the target url
--data=DATA Data string to be sent through POST --data=DATA Data string to be sent through POST
--param-del=PDEL Character used for splitting parameter values --param-del=PDEL Character used for splitting parameter values
--cookie=COOKIE HTTP Cookie header --cookie=COOKIE HTTP Cookie header
--load-cookies=LOC File containing cookies in Netscape/wget format --load-cookies=L.. File containing cookies in Netscape/wget format
--cookie-urlencode URL Encode generated cookie injections --drop-set-cookie Ignore Set-Cookie header from response
--drop-set-cookie Ignore Set-Cookie header from response --user-agent=AGENT HTTP User-Agent header
--user-agent=AGENT HTTP User-Agent header --random-agent Use randomly selected HTTP User-Agent header
--random-agent Use randomly selected HTTP User-Agent header --randomize=RPARAM Randomly change value for given parameter(s)
--randomize=RPARAM Randomly change value for given parameter(s) --force-ssl Force usage of SSL/HTTPS requests
--force-ssl Force usage of SSL/HTTPS requests --host=HOST HTTP Host header
--host=HOST HTTP Host header --referer=REFERER HTTP Referer header
--referer=REFERER HTTP Referer header --headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123")
--headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123") --auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)
--auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM) --auth-cred=ACRED HTTP authentication credentials (name:password)
--auth-cred=ACRED HTTP authentication credentials (name:password) --auth-cert=ACERT HTTP authentication certificate (key_file,cert_file)
--auth-cert=ACERT HTTP authentication certificate (key_file,cert_file) --proxy=PROXY Use a HTTP proxy to connect to the target url
--proxy=PROXY Use a HTTP proxy to connect to the target url --proxy-cred=PCRED HTTP proxy authentication credentials (name:password)
--proxy-cred=PCRED HTTP proxy authentication credentials (name:password) --ignore-proxy Ignore system default HTTP proxy
--ignore-proxy Ignore system default HTTP proxy --delay=DELAY Delay in seconds between each HTTP request
--delay=DELAY Delay in seconds between each HTTP request --timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30) --retries=RETRIES Retries when the connection timeouts (default 3)
--retries=RETRIES Retries when the connection timeouts (default 3) --scope=SCOPE Regexp to filter targets from provided proxy log
--scope=SCOPE Regexp to filter targets from provided proxy log --safe-url=SAFURL Url address to visit frequently during testing
--safe-url=SAFURL Url address to visit frequently during testing --safe-freq=SAFREQ Test requests between two visits to a given safe url
--safe-freq=SAFREQ Test requests between two visits to a given safe url --skip-urlencode Skip URL encoding of payload data
--skip-urlencode Skip URL encoding of payload data --eval=EVALCODE Evaluate provided Python code before the request (e.g.
--eval=EVALCODE Evaluate provided Python code before the request (e.g. "import hashlib;id2=hashlib.md5(id).hexdigest()")
"import hashlib;id2=hashlib.md5(id).hexdigest()")
Optimization: Optimization:
These options can be used to optimize the performance of sqlmap These options can be used to optimize the performance of sqlmap
-o Turn on all optimization switches -o Turn on all optimization switches
--predict-output Predict common queries output --predict-output Predict common queries output
--keep-alive Use persistent HTTP(s) connections --keep-alive Use persistent HTTP(s) connections
--null-connection Retrieve page length without actual HTTP response body --null-connection Retrieve page length without actual HTTP response body
--threads=THREADS Max number of concurrent HTTP(s) requests (default 1) --threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
Injection: Injection:
These options can be used to specify which parameters to test for, These options can be used to specify which parameters to test for,
provide custom injection payloads and optional tampering scripts provide custom injection payloads and optional tampering scripts
-p TESTPARAMETER Testable parameter(s) -p TESTPARAMETER Testable parameter(s)
--dbms=DBMS Force back-end DBMS to this value --dbms=DBMS Force back-end DBMS to this value
--os=OS Force back-end DBMS operating system to this value --os=OS Force back-end DBMS operating system to this value
--invalid-bignum Use big numbers for invalidating values --invalid-bignum Use big numbers for invalidating values
--invalid-logical Use logical operations for invalidating values --invalid-logical Use logical operations for invalidating values
--no-cast Turn off payload casting mechanism --no-cast Turn off payload casting mechanism
--no-unescape Turn off string unescaping mechanism --no-unescape Turn off string unescaping mechanism
--prefix=PREFIX Injection payload prefix string --prefix=PREFIX Injection payload prefix string
--suffix=SUFFIX Injection payload suffix string --suffix=SUFFIX Injection payload suffix string
--skip=SKIP Skip testing for given parameter(s) --skip=SKIP Skip testing for given parameter(s)
--tamper=TAMPER Use given script(s) for tampering injection data --tamper=TAMPER Use given script(s) for tampering injection data
Detection: Detection:
These options can be used to specify how to parse and compare page These options can be used to specify how to parse and compare page
content from HTTP responses when using blind SQL injection technique content from HTTP responses when using blind SQL injection technique
--level=LEVEL Level of tests to perform (1-5, default 1) --level=LEVEL Level of tests to perform (1-5, default 1)
--risk=RISK Risk of tests to perform (0-3, default 1) --risk=RISK Risk of tests to perform (0-3, default 1)
--string=STRING String to match when query is evaluated to True --string=STRING String to match when query is evaluated to True
--regexp=REGEXP Regexp to match when query is evaluated to True --not-string=NOT.. String to match when query is evaluated to False
--code=CODE HTTP code to match when query is evaluated to True --regexp=REGEXP Regexp to match when query is evaluated to True
--text-only Compare pages based only on the textual content --code=CODE HTTP code to match when query is evaluated to True
--titles Compare pages based only on their titles --text-only Compare pages based only on the textual content
--titles Compare pages based only on their titles
Techniques: Techniques:
These options can be used to tweak testing of specific SQL injection These options can be used to tweak testing of specific SQL injection
techniques techniques
--technique=TECH SQL injection techniques to test for (default "BEUST") --technique=TECH SQL injection techniques to test for (default "BEUST")
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5) --time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
--union-cols=UCOLS Range of columns to test for UNION query SQL injection --union-cols=UCOLS Range of columns to test for UNION query SQL injection
--union-char=UCHAR Character to use for bruteforcing number of columns --union-char=UCHAR Character to use for bruteforcing number of columns
--dns-domain=DNAME Domain name used for DNS exfiltration attack --dns-domain=DNS.. Domain name used for DNS exfiltration attack
--second-order=S.. Resulting page url searched for second-order response
Fingerprint: Fingerprint:
-f, --fingerprint Perform an extensive DBMS version fingerprint -f, --fingerprint Perform an extensive DBMS version fingerprint
Enumeration: Enumeration:
These options can be used to enumerate the back-end database These options can be used to enumerate the back-end database
management system information, structure and data contained in the management system information, structure and data contained in the
tables. Moreover you can run your own SQL statements tables. Moreover you can run your own SQL statements
-b, --banner Retrieve DBMS banner -a, --all Retrieve everything
--current-user Retrieve DBMS current user -b, --banner Retrieve DBMS banner
--current-db Retrieve DBMS current database --current-user Retrieve DBMS current user
--hostname Retrieve DBMS server hostname --current-db Retrieve DBMS current database
--is-dba Detect if the DBMS current user is DBA --hostname Retrieve DBMS server hostname
--users Enumerate DBMS users --is-dba Detect if the DBMS current user is DBA
--passwords Enumerate DBMS users password hashes --users Enumerate DBMS users
--privileges Enumerate DBMS users privileges --passwords Enumerate DBMS users password hashes
--roles Enumerate DBMS users roles --privileges Enumerate DBMS users privileges
--dbs Enumerate DBMS databases --roles Enumerate DBMS users roles
--tables Enumerate DBMS database tables --dbs Enumerate DBMS databases
--columns Enumerate DBMS database table columns --tables Enumerate DBMS database tables
--schema Enumerate DBMS schema --columns Enumerate DBMS database table columns
--count Retrieve number of entries for table(s) --schema Enumerate DBMS schema
--dump Dump DBMS database table entries --count Retrieve number of entries for table(s)
--dump-all Dump all DBMS databases tables entries --dump Dump DBMS database table entries
--search Search column(s), table(s) and/or database name(s) --dump-all Dump all DBMS databases tables entries
-D DB DBMS database to enumerate --search Search column(s), table(s) and/or database name(s)
-T TBL DBMS database table to enumerate -D DB DBMS database to enumerate
-C COL DBMS database table column to enumerate -T TBL DBMS database table to enumerate
-U USER DBMS user to enumerate -C COL DBMS database table column to enumerate
--exclude-sysdbs Exclude DBMS system databases when enumerating tables -U USER DBMS user to enumerate
--start=LIMITSTART First query output entry to retrieve --exclude-sysdbs Exclude DBMS system databases when enumerating tables
--stop=LIMITSTOP Last query output entry to retrieve --start=LIMITSTART First query output entry to retrieve
--first=FIRSTCHAR First query output word character to retrieve --stop=LIMITSTOP Last query output entry to retrieve
--last=LASTCHAR Last query output word character to retrieve --first=FIRSTCHAR First query output word character to retrieve
--sql-query=QUERY SQL statement to be executed --last=LASTCHAR Last query output word character to retrieve
--sql-shell Prompt for an interactive SQL shell --sql-query=QUERY SQL statement to be executed
--sql-file=SQLFILE Execute SQL statements from given file(s) --sql-shell Prompt for an interactive SQL shell
--sql-file=SQLFILE Execute SQL statements from given file(s)
Brute force: Brute force:
These options can be used to run brute force checks These options can be used to run brute force checks
--common-tables Check existence of common tables --common-tables Check existence of common tables
--common-columns Check existence of common columns --common-columns Check existence of common columns
User-defined function injection: User-defined function injection:
These options can be used to create custom user-defined functions These options can be used to create custom user-defined functions
--udf-inject Inject custom user-defined functions --udf-inject Inject custom user-defined functions
--shared-lib=SHLIB Local path of the shared library --shared-lib=SHLIB Local path of the shared library
File system access: File system access:
These options can be used to access the back-end database management These options can be used to access the back-end database management
system underlying file system system underlying file system
--file-read=RFILE Read a file from the back-end DBMS file system --file-read=RFILE Read a file from the back-end DBMS file system
--file-write=WFILE Write a local file on the back-end DBMS file system --file-write=WFILE Write a local file on the back-end DBMS file system
--file-dest=DFILE Back-end DBMS absolute filepath to write to --file-dest=DFILE Back-end DBMS absolute filepath to write to
Operating system access: Operating system access:
These options can be used to access the back-end database management These options can be used to access the back-end database management
system underlying operating system system underlying operating system
--os-cmd=OSCMD Execute an operating system command --os-cmd=OSCMD Execute an operating system command
--os-shell Prompt for an interactive operating system shell --os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC --os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation --os-bof Stored procedure buffer overflow exploitation
--priv-esc Database process' user privilege escalation --priv-esc Database process' user privilege escalation
--msf-path=MSFPATH Local path where Metasploit Framework is installed --msf-path=MSFPATH Local path where Metasploit Framework is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory --tmp-path=TMPPATH Remote absolute path of temporary files directory
Windows registry access: Windows registry access:
These options can be used to access the back-end database management These options can be used to access the back-end database management
system Windows registry system Windows registry
--reg-read Read a Windows registry key value --reg-read Read a Windows registry key value
--reg-add Write a Windows registry key value data --reg-add Write a Windows registry key value data
--reg-del Delete a Windows registry key value --reg-del Delete a Windows registry key value
--reg-key=REGKEY Windows registry key --reg-key=REGKEY Windows registry key
--reg-value=REGVAL Windows registry key value --reg-value=REGVAL Windows registry key value
--reg-data=REGDATA Windows registry key value data --reg-data=REGDATA Windows registry key value data
--reg-type=REGTYPE Windows registry key value type --reg-type=REGTYPE Windows registry key value type
General: General:
These options can be used to set some general working parameters These options can be used to set some general working parameters
-t TRAFFICFILE Log all HTTP traffic into a textual file -t TRAFFICFILE Log all HTTP traffic into a textual file
--batch Never ask for user input, use the default behaviour --batch Never ask for user input, use the default behaviour
--charset=CHARSET Force character encoding used for data retrieval --charset=CHARSET Force character encoding used for data retrieval
--check-tor Check to see if Tor is used properly --check-tor Check to see if Tor is used properly
--crawl=CRAWLDEPTH Crawl the website starting from the target url --crawl=CRAWLDEPTH Crawl the website starting from the target url
--csv-del=CSVDEL Delimiting character used in CSV output (default ",") --csv-del=CSVDEL Delimiting character used in CSV output (default ",")
--dbms-cred=DCRED DBMS authentication credentials (user:password) --dbms-cred=DBMS.. DBMS authentication credentials (user:password)
--eta Display for each output the estimated time of arrival --eta Display for each output the estimated time of arrival
--flush-session Flush session files for current target --flush-session Flush session files for current target
--forms Parse and test forms on target url --forms Parse and test forms on target url
--fresh-queries Ignores query results stored in session file --fresh-queries Ignores query results stored in session file
--hex Uses DBMS hex function(s) for data retrieval --hex Uses DBMS hex function(s) for data retrieval
--output-dir=ODIR Custom output directory path --output-dir=ODIR Custom output directory path
--parse-errors Parse and display DBMS error messages from responses --parse-errors Parse and display DBMS error messages from responses
--replicate Replicate dumped data into a sqlite3 database --replicate Replicate dumped data into a sqlite3 database
--save Save options to a configuration INI file --save Save options to a configuration INI file
--tor Use Tor anonymity network --tor Use Tor anonymity network
--tor-port=TORPORT Set Tor proxy port other than default --tor-port=TORPORT Set Tor proxy port other than default
--tor-type=TORTYPE Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5) --tor-type=TORTYPE Set Tor proxy type (HTTP - default, SOCKS4 or SOCKS5)
--update Update sqlmap --update Update sqlmap
Miscellaneous: Miscellaneous:
-z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU") -z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
--check-payload Offline WAF/IPS/IDS payload detection testing --check-payload Offline WAF/IPS/IDS payload detection testing
--check-waf Check for existence of WAF/IPS/IDS protection --check-waf Check for existence of WAF/IPS/IDS protection
--cleanup Clean up the DBMS by sqlmap specific UDF and tables --cleanup Clean up the DBMS by sqlmap specific UDF and tables
--dependencies Check for missing sqlmap dependencies --dependencies Check for missing sqlmap dependencies
--gpage=GOOGLEPAGE Use Google dork results from specified page number --disable-coloring Disable console output coloring
--mobile Imitate smartphone through HTTP User-Agent header --gpage=GOOGLEPAGE Use Google dork results from specified page number
--page-rank Display page rank (PR) for Google dork results --mobile Imitate smartphone through HTTP User-Agent header
--purge-output Safely remove all content from output directory --page-rank Display page rank (PR) for Google dork results
--smart Conduct through tests only if positive heuristic(s) --purge-output Safely remove all content from output directory
--test-filter=TSTF Select tests by payloads and/or titles (e.g. ROW) --smart Conduct through tests only if positive heuristic(s)
--wizard Simple wizard interface for beginner users --test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW)
--wizard Simple wizard interface for beginner users
## Output verbosity ## Output verbosity