diff --git a/doc/ChangeLog b/doc/ChangeLog index 38c633893..8ebecd164 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -27,7 +27,7 @@ sqlmap (0.6.4-1) stable; urgency=low provided; * Updated documentation. - -- Bernardo Damele A. G. Day, DD MMM 2009 10:00:00 +0000 + -- Bernardo Damele A. G. Tue, 3 Feb 2009 23:30:00 +0000 sqlmap (0.6.3-1) stable; urgency=low diff --git a/doc/README.html b/doc/README.html index 9e48db94a..497abee0b 100644 --- a/doc/README.html +++ b/doc/README.html @@ -8,7 +8,7 @@

sqlmap user's manual

by -Bernardo Damele A. G.

version 0.6.4, DDth of MMM 2009 +Bernardo Damele A. G.version 0.6.4, 3rd of February 2009
This document is the user's manual to use sqlmap. @@ -407,7 +407,7 @@ $ python sqlmap.py -h sqlmap/0.6.4 coded by Bernardo Damele A. G. <bernardo.damele@gmail.com> and Daniele Bellucci <daniele.bellucci@gmail.com> - + Usage: sqlmap.py [options] Options: @@ -3801,7 +3801,8 @@ back-end DBMS: PostgreSQL sql> SELECT COUNT(name) FROM users [10:11:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users' [10:11:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n -[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) FROM users +[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) +FROM users [10:11:59] [INFO] retrieved: 4 [10:11:59] [INFO] performed 13 queries in 0 seconds SELECT COUNT(name) FROM users: '4' @@ -3809,12 +3810,14 @@ SELECT COUNT(name) FROM users: '4' sql> INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell'); [10:12:35] [INFO] testing stacked queries support on parameter 'id' [10:12:40] [INFO] the web application supports stacked queries on parameter 'id' -[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell');' +[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users (id, name, surname) +VALUES (5, 'from', 'sql shell');' [10:12:40] [INFO] done sql> SELECT COUNT(name) FROM users [10:12:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users' [10:12:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n -[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) FROM users +[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) +FROM users [10:12:53] [INFO] retrieved: 5 [10:12:54] [INFO] performed 20 queries in 0 seconds SELECT COUNT(name) FROM users: '5' @@ -3822,7 +3825,15 @@ SELECT COUNT(name) FROM users: '5'

-

TODO

+

As you can see from this last example, when the user provides a SQL +statement other than SELECT, sqlmap recognizes it, tests if the +web application supports stacked queries and in case it does, it executes +the provided SQL statement in a multiple statement.

+ +

Beware that some web application technologies do not support stacked +queries on specific database management systems. For instance, PHP does not +support stacked queries when the back-end DBMS is MySQL, but it does +support when the back-end DBMS is PostgreSQL.

5.8 File system access diff --git a/doc/README.pdf b/doc/README.pdf index e18c43b52..48d5dc367 100644 Binary files a/doc/README.pdf and b/doc/README.pdf differ diff --git a/doc/README.sgml b/doc/README.sgml index 29e9f3758..cddf7cf53 100644 --- a/doc/README.sgml +++ b/doc/README.sgml @@ -4,7 +4,7 @@ sqlmap user's manual <author>by <htmlurl url="mailto:bernardo.damele@gmail.com" name="Bernardo Damele A. G."> -<date>version 0.6.4, DDth of MMM 2009 +<date>version 0.6.4, 3rd of February 2009 <abstract> This document is the user's manual to use <htmlurl url="http://sqlmap.sourceforge.net" name="sqlmap">. Check the project <htmlurl url="http://sqlmap.sourceforge.net" name="homepage"> @@ -362,7 +362,7 @@ $ python sqlmap.py -h sqlmap/0.6.4 coded by Bernardo Damele A. G. <bernardo.damele@gmail.com> and Daniele Bellucci <daniele.bellucci@gmail.com> - + Usage: sqlmap.py [options] Options: @@ -3698,7 +3698,8 @@ back-end DBMS: PostgreSQL sql> SELECT COUNT(name) FROM users [10:11:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users' [10:11:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n -[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) FROM users +[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) +FROM users [10:11:59] [INFO] retrieved: 4 [10:11:59] [INFO] performed 13 queries in 0 seconds SELECT COUNT(name) FROM users: '4' @@ -3706,19 +3707,30 @@ SELECT COUNT(name) FROM users: '4' sql> INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell'); [10:12:35] [INFO] testing stacked queries support on parameter 'id' [10:12:40] [INFO] the web application supports stacked queries on parameter 'id' -[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell');' +[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users (id, name, surname) +VALUES (5, 'from', 'sql shell');' [10:12:40] [INFO] done sql> SELECT COUNT(name) FROM users [10:12:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users' [10:12:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n -[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) FROM users +[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) +FROM users [10:12:53] [INFO] retrieved: 5 [10:12:54] [INFO] performed 20 queries in 0 seconds SELECT COUNT(name) FROM users: '5' </verb></tscreen> <p> -TODO +As you can see from this last example, when the user provides a SQL +statement other than <tt>SELECT</tt>, sqlmap recognizes it, tests if the +web application supports stacked queries and in case it does, it executes +the provided SQL statement in a multiple statement. + +<p> +Beware that some web application technologies do not support stacked +queries on specific database management systems. For instance, PHP does not +support stacked queries when the back-end DBMS is MySQL, but it does +support when the back-end DBMS is PostgreSQL. <sect1>File system access diff --git a/lib/core/settings.py b/lib/core/settings.py index 6597a63eb..335eeffce 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -30,7 +30,7 @@ import sys # sqlmap version and site -VERSION = "0.6.4-rc6" +VERSION = "0.6.4" VERSION_STRING = "sqlmap/%s" % VERSION SITE = "http://sqlmap.sourceforge.net"