mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2024-11-29 04:53:48 +03:00
fix for that -- bug
This commit is contained in:
parent
4e6af8d6c9
commit
bc0eb880df
142
doc/README.sgml
142
doc/README.sgml
|
@ -753,7 +753,7 @@ target urls from.
|
||||||
<sect2>Target URL
|
<sect2>Target URL
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>-u</tt> or <tt>--url</tt>
|
Option: <tt>-u</tt> or <tt>-</tt><tt>-url</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
To run sqlmap on a single target URL.
|
To run sqlmap on a single target URL.
|
||||||
|
@ -920,7 +920,7 @@ These options can be used to specify how to connect to the target url.
|
||||||
<sect2>HTTP method: <tt>GET</tt> or <tt>POST</tt>
|
<sect2>HTTP method: <tt>GET</tt> or <tt>POST</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--method</tt> and <tt>--data</tt>
|
Options: <tt>-</tt><tt>-method</tt> and <tt>-</tt><tt>-data</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
By default the HTTP method used to perform HTTP requests is <tt>GET</tt>,
|
By default the HTTP method used to perform HTTP requests is <tt>GET</tt>,
|
||||||
|
@ -963,7 +963,7 @@ back-end DBMS: Oracle
|
||||||
<sect2>HTTP <tt>Cookie</tt> header
|
<sect2>HTTP <tt>Cookie</tt> header
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--cookie</tt>
|
Option: <tt>-</tt><tt>-cookie</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
This feature can be useful in two scenarios:
|
This feature can be useful in two scenarios:
|
||||||
|
@ -1077,7 +1077,7 @@ values that you provided? [Y/n]
|
||||||
<sect2>HTTP <tt>Referer</tt> header
|
<sect2>HTTP <tt>Referer</tt> header
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--referer</tt>
|
Option: <tt>-</tt><tt>-referer</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to fake the HTTP <tt>Referer</tt> header value with this
|
It is possible to fake the HTTP <tt>Referer</tt> header value with this
|
||||||
|
@ -1110,7 +1110,7 @@ Connection: close
|
||||||
<sect2>HTTP <tt>User-Agent</tt> header
|
<sect2>HTTP <tt>User-Agent</tt> header
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--user-agent</tt> and <tt>-a</tt>
|
Options: <tt>-</tt><tt>-user-agent</tt> and <tt>-a</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
By default sqlmap perform HTTP requests providing the following HTTP
|
By default sqlmap perform HTTP requests providing the following HTTP
|
||||||
|
@ -1121,7 +1121,7 @@ sqlmap/0.7 (http://sqlmap.sourceforge.net)
|
||||||
</verb></tscreen>
|
</verb></tscreen>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to fake it with the <tt>--user-agent</tt> option.
|
It is possible to fake it with the <tt>-</tt><tt>-user-agent</tt> option.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Example on an <bf>Oracle XE 10.2.0.1</bf> target:
|
Example on an <bf>Oracle XE 10.2.0.1</bf> target:
|
||||||
|
@ -1200,10 +1200,10 @@ to force the HTTP User-Agent header with option --user-agent or -a
|
||||||
<sect2>Extra HTTP headers
|
<sect2>Extra HTTP headers
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--headers</tt>
|
Option: <tt>-</tt><tt>-headers</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to provide extra HTTP headers by providing <tt>--headers</tt>
|
It is possible to provide extra HTTP headers by providing <tt>-</tt><tt>-headers</tt>
|
||||||
options. Each header must be separated by a newline and it's much easier
|
options. Each header must be separated by a newline and it's much easier
|
||||||
to provide them from the configuration INI file. Have a look at the sample
|
to provide them from the configuration INI file. Have a look at the sample
|
||||||
<tt>sqlmap.conf</tt> file.
|
<tt>sqlmap.conf</tt> file.
|
||||||
|
@ -1212,7 +1212,7 @@ to provide them from the configuration INI file. Have a look at the sample
|
||||||
<sect2>HTTP <tt>Basic</tt> and <tt>Digest</tt> authentications
|
<sect2>HTTP <tt>Basic</tt> and <tt>Digest</tt> authentications
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--auth-type</tt> and <tt>--auth-cred</tt>
|
Options: <tt>-</tt><tt>-auth-type</tt> and <tt>-</tt><tt>-auth-cred</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
These options can be used to specify which HTTP authentication type the
|
These options can be used to specify which HTTP authentication type the
|
||||||
|
@ -1268,7 +1268,7 @@ Connection: close
|
||||||
<sect2>HTTP proxy
|
<sect2>HTTP proxy
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--proxy</tt>
|
Option: <tt>-</tt><tt>-proxy</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to provide an anonymous HTTP proxy address to pass by the
|
It is possible to provide an anonymous HTTP proxy address to pass by the
|
||||||
|
@ -1309,7 +1309,7 @@ settings.
|
||||||
<sect2>Concurrent HTTP requests
|
<sect2>Concurrent HTTP requests
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--threads</tt>
|
Option: <tt>-</tt><tt>-threads</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to specify the number of maximum concurrent HTTP requests
|
It is possible to specify the number of maximum concurrent HTTP requests
|
||||||
|
@ -1350,14 +1350,14 @@ with the blind SQL injection bisection algorithm implemented in sqlmap.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Note that the multithreading option is not needed if the target is affected
|
Note that the multithreading option is not needed if the target is affected
|
||||||
by an inband SQL injection vulnerability and the <tt>--union-use</tt>
|
by an inband SQL injection vulnerability and the <tt>-</tt><tt>-union-use</tt>
|
||||||
option has been provided.
|
option has been provided.
|
||||||
|
|
||||||
|
|
||||||
<sect2>Delay in seconds between each HTTP request
|
<sect2>Delay in seconds between each HTTP request
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--delay</tt>
|
Option: <tt>-</tt><tt>-delay</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to specify a number of seconds to wait between each HTTP
|
It is possible to specify a number of seconds to wait between each HTTP
|
||||||
|
@ -1367,7 +1367,7 @@ request. The valid value is a float, for instance 0.5 means half a second.
|
||||||
<sect2>Seconds to wait before timeout connection
|
<sect2>Seconds to wait before timeout connection
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--timeout</tt>
|
Option: <tt>-</tt><tt>-timeout</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to specify a number of seconds to wait before considering
|
It is possible to specify a number of seconds to wait before considering
|
||||||
|
@ -1378,7 +1378,7 @@ the HTTP request timed out. The valid value is a float, for instance
|
||||||
<sect2>Maximum number of retries when the HTTP connection timeouts
|
<sect2>Maximum number of retries when the HTTP connection timeouts
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--retries</tt>
|
Option: <tt>-</tt><tt>-retries</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to specify the maximum number of retries when the HTTP
|
It is possible to specify the maximum number of retries when the HTTP
|
||||||
|
@ -1479,7 +1479,7 @@ back-end DBMS: MySQL >= 5.0.0
|
||||||
<sect2>Force the database management system name
|
<sect2>Force the database management system name
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--dbms</tt>
|
Option: <tt>-</tt><tt>-dbms</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
By default sqlmap automatically detects the web application's back-end
|
By default sqlmap automatically detects the web application's back-end
|
||||||
|
@ -1517,7 +1517,7 @@ back-end DBMS: PostgreSQL
|
||||||
</verb></tscreen>
|
</verb></tscreen>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
In case you provide <tt>--fingerprint</tt> together with <tt>--dbms</tt>,
|
In case you provide <tt>-</tt><tt>-fingerprint</tt> together with <tt>-</tt><tt>-dbms</tt>,
|
||||||
sqlmap will only perform the extensive fingerprint for the specified
|
sqlmap will only perform the extensive fingerprint for the specified
|
||||||
database management system, read below for further details.
|
database management system, read below for further details.
|
||||||
|
|
||||||
|
@ -1531,7 +1531,7 @@ automatically identify it for you.
|
||||||
<sect2>Force the database management system operating system name
|
<sect2>Force the database management system operating system name
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--os</tt>
|
Option: <tt>-</tt><tt>-os</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
By default sqlmap automatically detects the web application's back-end
|
By default sqlmap automatically detects the web application's back-end
|
||||||
|
@ -1558,7 +1558,7 @@ not know it, let sqlmap automatically identify it for you.
|
||||||
<sect2>Custom injection payload
|
<sect2>Custom injection payload
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--prefix</tt> and <tt>--postfix</tt>
|
Options: <tt>-</tt><tt>-prefix</tt> and <tt>-</tt><tt>-postfix</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
In some circumstances the vulnerable parameter is exploitable only if the
|
In some circumstances the vulnerable parameter is exploitable only if the
|
||||||
|
@ -1622,7 +1622,7 @@ the real world application it is necessary to provide it.
|
||||||
<sect2>Page comparison
|
<sect2>Page comparison
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--string</tt> and <tt>--regexp</tt>
|
Options: <tt>-</tt><tt>-string</tt> and <tt>-</tt><tt>-regexp</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
By default the distinction of a True query by a False one (basic concept
|
By default the distinction of a True query by a False one (basic concept
|
||||||
|
@ -1805,7 +1805,7 @@ user's input</bf>.
|
||||||
<sect2>Exclude specific page content
|
<sect2>Exclude specific page content
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--excl-str</tt> and <tt>--excl-reg</tt>
|
Options: <tt>-</tt><tt>-excl-str</tt> and <tt>-</tt><tt>-excl-reg</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Another way to get around the dynamicity issue explained above is to exclude
|
Another way to get around the dynamicity issue explained above is to exclude
|
||||||
|
@ -1847,7 +1847,7 @@ stability test.
|
||||||
<sect2>Test for stacked queries (multiple statements) support
|
<sect2>Test for stacked queries (multiple statements) support
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--stacked-test</tt>
|
Option: <tt>-</tt><tt>-stacked-test</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to test if the web application technology supports
|
It is possible to test if the web application technology supports
|
||||||
|
@ -1911,7 +1911,7 @@ stacked queries support: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'wRcBC'=
|
||||||
<sect2>Test for time based blind SQL injection
|
<sect2>Test for time based blind SQL injection
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--time-test</tt> and <tt>--time-sec</tt>
|
Options: <tt>-</tt><tt>-time-test</tt> and <tt>-</tt><tt>-time-sec</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to test if the target URL is affected by a <bf>time based
|
It is possible to test if the target URL is affected by a <bf>time based
|
||||||
|
@ -1979,14 +1979,14 @@ time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is also possible to set the seconds to delay the response by providing
|
It is also possible to set the seconds to delay the response by providing
|
||||||
the <tt>--time-sec</tt> option followed by an integer. By default delay
|
the <tt>-</tt><tt>-time-sec</tt> option followed by an integer. By default delay
|
||||||
is set to five seconds.
|
is set to five seconds.
|
||||||
|
|
||||||
|
|
||||||
<sect2>Test for UNION query SQL injection
|
<sect2>Test for UNION query SQL injection
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--union-test</tt> and <tt>--union-tech</tt>
|
Options: <tt>-</tt><tt>-union-test</tt> and <tt>-</tt><tt>-union-tech</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to test if the target URL is affected by a <bf>UNION query
|
It is possible to test if the target URL is affected by a <bf>UNION query
|
||||||
|
@ -2015,7 +2015,7 @@ NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
|
||||||
By default sqlmap uses the <bf><tt>NULL</tt> bruteforcing</bf> technique to
|
By default sqlmap uses the <bf><tt>NULL</tt> bruteforcing</bf> technique to
|
||||||
detect the number of columns within the original <tt>SELECT</tt> statement.
|
detect the number of columns within the original <tt>SELECT</tt> statement.
|
||||||
It is also possible to change it to <bf><tt>ORDER BY</tt> clause
|
It is also possible to change it to <bf><tt>ORDER BY</tt> clause
|
||||||
bruteforcing</bf> with the <tt>--union-tech</tt> option.
|
bruteforcing</bf> with the <tt>-</tt><tt>-union-tech</tt> option.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Further details on these techniques can be found <htmlurl
|
Further details on these techniques can be found <htmlurl
|
||||||
|
@ -2046,9 +2046,9 @@ a lot of time.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is strongly recommended to run at least once sqlmap with the
|
It is strongly recommended to run at least once sqlmap with the
|
||||||
<tt>--union-test</tt> option to test if the affected parameter is used
|
<tt>-</tt><tt>-union-test</tt> option to test if the affected parameter is used
|
||||||
within a <tt>for</tt> cycle, or similar, and in case use
|
within a <tt>for</tt> cycle, or similar, and in case use
|
||||||
<tt>--union-use</tt> option to exploit this vulnerability because it
|
<tt>-</tt><tt>-union-use</tt> option to exploit this vulnerability because it
|
||||||
saves a lot of time and it does not weight down the web server log file
|
saves a lot of time and it does not weight down the web server log file
|
||||||
with hundreds of HTTP requests.
|
with hundreds of HTTP requests.
|
||||||
|
|
||||||
|
@ -2056,12 +2056,12 @@ with hundreds of HTTP requests.
|
||||||
<sect2>Use the UNION query SQL injection
|
<sect2>Use the UNION query SQL injection
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--union-use</tt>
|
Option: <tt>-</tt><tt>-union-use</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Providing the <tt>--union-use</tt> parameter, sqlmap will first test if
|
Providing the <tt>-</tt><tt>-union-use</tt> parameter, sqlmap will first test if
|
||||||
the target URL is affected by an <bf>inband SQL injection</bf>
|
the target URL is affected by an <bf>inband SQL injection</bf>
|
||||||
(<tt>--union-test</tt>) vulnerability then, in case it seems to be
|
(<tt>-</tt><tt>-union-test</tt>) vulnerability then, in case it seems to be
|
||||||
vulnerable, it will confirm that the parameter is affected by a <bf>Full
|
vulnerable, it will confirm that the parameter is affected by a <bf>Full
|
||||||
UNION query SQL injection</bf> and use this technique to go ahead with the
|
UNION query SQL injection</bf> and use this technique to go ahead with the
|
||||||
exploiting.
|
exploiting.
|
||||||
|
@ -2228,7 +2228,7 @@ the page content.
|
||||||
<sect2>Extensive database management system fingerprint
|
<sect2>Extensive database management system fingerprint
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>-f</tt> or <tt>--fingerprint</tt>
|
Options: <tt>-f</tt> or <tt>-</tt><tt>-fingerprint</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
By default the web application's back-end database management system
|
By default the web application's back-end database management system
|
||||||
|
@ -2268,7 +2268,7 @@ system and the web application technology by parsing some HTTP response headers.
|
||||||
<p>
|
<p>
|
||||||
If you want to perform an extensive database management system fingerprint
|
If you want to perform an extensive database management system fingerprint
|
||||||
based on various techniques like specific SQL dialects and inband error
|
based on various techniques like specific SQL dialects and inband error
|
||||||
messages, you can provide the <tt>--fingerprint</tt> option.
|
messages, you can provide the <tt>-</tt><tt>-fingerprint</tt> option.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Example on a <bf>MySQL 5.0.67</bf> target:
|
Example on a <bf>MySQL 5.0.67</bf> target:
|
||||||
|
@ -2347,7 +2347,7 @@ back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0
|
||||||
<p>
|
<p>
|
||||||
As you can see from the last example, sqlmap first tested for MySQL,
|
As you can see from the last example, sqlmap first tested for MySQL,
|
||||||
then for Oracle, then for PostgreSQL since the user did not forced the
|
then for Oracle, then for PostgreSQL since the user did not forced the
|
||||||
back-end database management system name with option <tt>--dbms</tt>.
|
back-end database management system name with option <tt>-</tt><tt>-dbms</tt>.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Example on a <bf>Microsoft SQL Server 2000 Service Pack 0</bf> target:
|
Example on a <bf>Microsoft SQL Server 2000 Service Pack 0</bf> target:
|
||||||
|
@ -2385,7 +2385,7 @@ back-end DBMS: active fingerprint: Microsoft SQL Server 2005
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
If you want an even more accurate result, based also on banner parsing,
|
If you want an even more accurate result, based also on banner parsing,
|
||||||
you can also provide the <tt>-b</tt> or <tt>--banner</tt> option.
|
you can also provide the <tt>-b</tt> or <tt>-</tt><tt>-banner</tt> option.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Example on a <bf>MySQL 5.0.67</bf> target:
|
Example on a <bf>MySQL 5.0.67</bf> target:
|
||||||
|
@ -2498,7 +2498,7 @@ name="SQLSecurity.com site"> and outputs it to the XML versions file.
|
||||||
<sect2>Banner
|
<sect2>Banner
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>-b</tt> or <tt>--banner</tt>
|
Option: <tt>-b</tt> or <tt>-</tt><tt>-banner</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Most of the modern database management systems have a function and/or
|
Most of the modern database management systems have a function and/or
|
||||||
|
@ -2570,7 +2570,7 @@ Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86)
|
||||||
<sect2>Current user
|
<sect2>Current user
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--current-user</tt>
|
Option: <tt>-</tt><tt>-current-user</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to retrieve the database management system's user which is
|
It is possible to retrieve the database management system's user which is
|
||||||
|
@ -2589,7 +2589,7 @@ current user: 'testuser@localhost'
|
||||||
<sect2>Current database
|
<sect2>Current database
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--current-db</tt>
|
Option: <tt>-</tt><tt>-current-db</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to retrieve the database management system's database the
|
It is possible to retrieve the database management system's database the
|
||||||
|
@ -2608,7 +2608,7 @@ current database: 'master'
|
||||||
<sect2>Detect if the DBMS current user is a database administrator
|
<sect2>Detect if the DBMS current user is a database administrator
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--is-dba</tt>
|
Option: <tt>-</tt><tt>-is-dba</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to detect if the current database management system session user is
|
It is possible to detect if the current database management system session user is
|
||||||
|
@ -2653,7 +2653,7 @@ current user is DBA: 'True'
|
||||||
<sect2>Users
|
<sect2>Users
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--users</tt>
|
Option: <tt>-</tt><tt>-users</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to enumerate the list of database management system users.
|
It is possible to enumerate the list of database management system users.
|
||||||
|
@ -2674,7 +2674,7 @@ database management system users [3]:
|
||||||
<sect2>Users password hashes
|
<sect2>Users password hashes
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--passwords</tt> and <tt>-U</tt>
|
Options: <tt>-</tt><tt>-passwords</tt> and <tt>-U</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to enumerate the password hashes for each database
|
It is possible to enumerate the password hashes for each database
|
||||||
|
@ -2759,7 +2759,7 @@ database management system users password hashes:
|
||||||
<sect2>Users privileges
|
<sect2>Users privileges
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--privileges</tt> and <tt>-U</tt>
|
Options: <tt>-</tt><tt>-privileges</tt> and <tt>-U</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to enumerate the privileges for each database management
|
It is possible to enumerate the privileges for each database management
|
||||||
|
@ -2910,7 +2910,7 @@ management system is Microsoft SQL Server.
|
||||||
<sect2>Available databases
|
<sect2>Available databases
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--dbs</tt>
|
Option: <tt>-</tt><tt>-dbs</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to enumerate the list of databases.
|
It is possible to enumerate the list of databases.
|
||||||
|
@ -2937,7 +2937,7 @@ management system is Oracle.
|
||||||
<sect2>Databases tables
|
<sect2>Databases tables
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--tables</tt> and <tt>-D</tt>
|
Options: <tt>-</tt><tt>-tables</tt> and <tt>-D</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to enumerate the list of tables for all database
|
It is possible to enumerate the list of tables for all database
|
||||||
|
@ -3049,7 +3049,7 @@ system user.
|
||||||
<sect2>Database table columns
|
<sect2>Database table columns
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--columns</tt>, <tt>-T</tt> and <tt>-D</tt>
|
Options: <tt>-</tt><tt>-columns</tt>, <tt>-T</tt> and <tt>-D</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to enumerate the list of columns for a specific database
|
It is possible to enumerate the list of columns for a specific database
|
||||||
|
@ -3175,8 +3175,8 @@ Table: users
|
||||||
<sect2>Dump database table entries
|
<sect2>Dump database table entries
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--dump</tt>, <tt>-C</tt>, <tt>-T</tt>, <tt>-D</tt>,
|
Options: <tt>-</tt><tt>-dump</tt>, <tt>-C</tt>, <tt>-T</tt>, <tt>-D</tt>,
|
||||||
<tt>--start</tt> and <tt>--stop</tt>
|
<tt>-</tt><tt>-start</tt> and <tt>-</tt><tt>-stop</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to dump the entries for a specific database table.
|
It is possible to dump the entries for a specific database table.
|
||||||
|
@ -3287,12 +3287,12 @@ $ cat /software/sqlmap/output/192.168.1.121/dump/public/users.csv
|
||||||
</verb></tscreen>
|
</verb></tscreen>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
You can also provide the <tt>--start</tt> and/or the <tt>--stop</tt>
|
You can also provide the <tt>-</tt><tt>-start</tt> and/or the <tt>-</tt><tt>-stop</tt>
|
||||||
options to limit the dump to a range of entries.
|
options to limit the dump to a range of entries.
|
||||||
|
|
||||||
<itemize>
|
<itemize>
|
||||||
<item><tt>--start</tt> specifies the first entry to enumerate
|
<item><tt>-</tt><tt>-start</tt> specifies the first entry to enumerate
|
||||||
<item><tt>--stop</tt> specifies the last entry to enumerate
|
<item><tt>-</tt><tt>-stop</tt> specifies the last entry to enumerate
|
||||||
</itemize>
|
</itemize>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
|
@ -3323,7 +3323,7 @@ table entry.
|
||||||
<sect2>Dump all databases tables entries
|
<sect2>Dump all databases tables entries
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--dump-all</tt> and <tt>--exclude-sysdbs</tt>
|
Options: <tt>-</tt><tt>-dump-all</tt> and <tt>-</tt><tt>-exclude-sysdbs</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to dump all databases tables entries at once.
|
It is possible to dump all databases tables entries at once.
|
||||||
|
@ -3394,7 +3394,7 @@ Table: CHARACTER_SETS
|
||||||
</verb></tscreen>
|
</verb></tscreen>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
You can also provide the <tt>--exclude-sysdbs</tt> option to exclude all
|
You can also provide the <tt>-</tt><tt>-exclude-sysdbs</tt> option to exclude all
|
||||||
system databases. In that case sqlmap will only dump entries of users' databases
|
system databases. In that case sqlmap will only dump entries of users' databases
|
||||||
tables.
|
tables.
|
||||||
|
|
||||||
|
@ -3450,7 +3450,7 @@ as a users' database.
|
||||||
<sect2>Run your own SQL statement
|
<sect2>Run your own SQL statement
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--sql-query</tt> and <tt>--sql-shell</tt>
|
Options: <tt>-</tt><tt>-sql-query</tt> and <tt>-</tt><tt>-sql-shell</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
The SQL query and the SQL shell features makes the user able to run
|
The SQL query and the SQL shell features makes the user able to run
|
||||||
|
@ -3835,7 +3835,7 @@ support when the back-end DBMS is PostgreSQL.
|
||||||
<sect2>Read a file from the back-end DBMS file system
|
<sect2>Read a file from the back-end DBMS file system
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--read-file</tt>
|
Option: <tt>-</tt><tt>-read-file</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to retrieve the content of files from the underlying file
|
It is possible to retrieve the content of files from the underlying file
|
||||||
|
@ -3958,7 +3958,7 @@ output/192.168.1.121/files/C__example.exe: PE32 executable for MS Windows (GUI)
|
||||||
<sect2>Write a local file on the back-end DBMS file system
|
<sect2>Write a local file on the back-end DBMS file system
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--write-file</tt> and <tt>--dest-file</tt>
|
Options: <tt>-</tt><tt>-write-file</tt> and <tt>-</tt><tt>-dest-file</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to upload a local file to the underlying file system when
|
It is possible to upload a local file to the underlying file system when
|
||||||
|
@ -4012,7 +4012,7 @@ same size as the local file '/tmp/nc.exe.packed'
|
||||||
<sect2>Execute arbitrary operating system command
|
<sect2>Execute arbitrary operating system command
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--os-cmd</tt> and <tt>--os-shell</tt>
|
Options: <tt>-</tt><tt>-os-cmd</tt> and <tt>-</tt><tt>-os-shell</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to execute arbitrary commands on the underlying operating
|
It is possible to execute arbitrary commands on the underlying operating
|
||||||
|
@ -4044,7 +4044,7 @@ These techniques are detailed in white paper
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to specify a single command to be executed with the
|
It is possible to specify a single command to be executed with the
|
||||||
<tt>--os-cmd</tt> option.
|
<tt>-</tt><tt>-os-cmd</tt> option.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Example on a <bf>PostgreSQL 8.3.5</bf> target:
|
Example on a <bf>PostgreSQL 8.3.5</bf> target:
|
||||||
|
@ -4119,9 +4119,9 @@ nt authority\network service
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is also possible to simulate a real shell where you can type as many
|
It is also possible to simulate a real shell where you can type as many
|
||||||
arbitrary commands as you wish. The option is <tt>--os-shell</tt> and has
|
arbitrary commands as you wish. The option is <tt>-</tt><tt>-os-shell</tt> and has
|
||||||
the same TAB completion and history functionalities as provided by
|
the same TAB completion and history functionalities as provided by
|
||||||
<tt>--sql-shell</tt>.
|
<tt>-</tt><tt>-sql-shell</tt>.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Example on a <bf>MySQL 5.0.67</bf> target:
|
Example on a <bf>MySQL 5.0.67</bf> target:
|
||||||
|
@ -4237,7 +4237,7 @@ can only be deleted manually
|
||||||
</verb></tscreen>
|
</verb></tscreen>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Now run it again, but specifying the <tt>--union-use</tt> to retrieve the
|
Now run it again, but specifying the <tt>-</tt><tt>-union-use</tt> to retrieve the
|
||||||
command standard output quicker, via UNION based SQL injection, when the
|
command standard output quicker, via UNION based SQL injection, when the
|
||||||
parameter is affected also by inband SQL injection vulnerability:
|
parameter is affected also by inband SQL injection vulnerability:
|
||||||
|
|
||||||
|
@ -4346,7 +4346,7 @@ wants to recreate them or keep them and save time.
|
||||||
<sect2>Prompt for an out-of-band shell, meterpreter or VNC
|
<sect2>Prompt for an out-of-band shell, meterpreter or VNC
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--os-pwn</tt>, <tt>--priv-esc</tt>, <tt>--msf-path</tt> and <tt>--tmp-path</tt>
|
Options: <tt>-</tt><tt>-os-pwn</tt>, <tt>-</tt><tt>-priv-esc</tt>, <tt>-</tt><tt>-msf-path</tt> and <tt>-</tt><tt>-tmp-path</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to establish an <bf>out-of-band TCP stateful channel</bf>
|
It is possible to establish an <bf>out-of-band TCP stateful channel</bf>
|
||||||
|
@ -4471,7 +4471,7 @@ Microsoft SQL Server 2000 by default runs as <tt>SYSTEM</tt>, whereas
|
||||||
Microsoft SQL Server 2005 and 2008 run most of the times as <tt>NETWORK
|
Microsoft SQL Server 2005 and 2008 run most of the times as <tt>NETWORK
|
||||||
SERVICE</tt> and sometimes as <tt>LOCAL SERVICE</tt>.
|
SERVICE</tt> and sometimes as <tt>LOCAL SERVICE</tt>.
|
||||||
|
|
||||||
It is possible to provide sqlmap with the <tt>--priv-esc</tt> option to
|
It is possible to provide sqlmap with the <tt>-</tt><tt>-priv-esc</tt> option to
|
||||||
abuse Windows access tokens and escalate privileges to <tt>SYSTEM</tt>
|
abuse Windows access tokens and escalate privileges to <tt>SYSTEM</tt>
|
||||||
within the Meterpreter session created if the underlying operating system
|
within the Meterpreter session created if the underlying operating system
|
||||||
is not patched against Microsoft Security Bulletin
|
is not patched against Microsoft Security Bulletin
|
||||||
|
@ -4597,7 +4597,7 @@ meterpreter > exit
|
||||||
<sect2>One click prompt for an out-of-band shell, meterpreter or VNC
|
<sect2>One click prompt for an out-of-band shell, meterpreter or VNC
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--os-smbrelay</tt>, <tt>--priv-esc</tt> and <tt>--msf-path</tt>
|
Options: <tt>-</tt><tt>-os-smbrelay</tt>, <tt>-</tt><tt>-priv-esc</tt> and <tt>-</tt><tt>-msf-path</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
If the back-end database management system runs as <tt>Administrator</tt>
|
If the back-end database management system runs as <tt>Administrator</tt>
|
||||||
|
@ -4756,7 +4756,7 @@ msf exploit(smb_relay) > exit
|
||||||
<sect2>Stored procedure buffer overflow exploitation
|
<sect2>Stored procedure buffer overflow exploitation
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Options: <tt>--os-bof</tt>, <tt>--priv-esc</tt> and <tt>--msf-path</tt>
|
Options: <tt>-</tt><tt>-os-bof</tt>, <tt>-</tt><tt>-priv-esc</tt> and <tt>-</tt><tt>-msf-path</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
If the back-end database management system is not patched against Microsoft
|
If the back-end database management system is not patched against Microsoft
|
||||||
|
@ -4863,7 +4863,7 @@ meterpreter > exit
|
||||||
<sect2>Estimated time of arrival
|
<sect2>Estimated time of arrival
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--eta</tt>
|
Option: <tt>-</tt><tt>-eta</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to calculate and show the estimated time of arrival to
|
It is possible to calculate and show the estimated time of arrival to
|
||||||
|
@ -4947,14 +4947,14 @@ counts the number of retrieved query output characters.
|
||||||
<sect2>Update sqlmap to the latest stable version
|
<sect2>Update sqlmap to the latest stable version
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--update</tt>
|
Option: <tt>-</tt><tt>-update</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
|
|
||||||
It is possible to update sqlmap to the latest stable version available on
|
It is possible to update sqlmap to the latest stable version available on
|
||||||
project's <htmlurl url="http://sourceforge.net/projects/sqlmap/files/"
|
project's <htmlurl url="http://sourceforge.net/projects/sqlmap/files/"
|
||||||
name="SourceForge File List page"> by running it with the
|
name="SourceForge File List page"> by running it with the
|
||||||
<tt>--update</tt> option.
|
<tt>-</tt><tt>-update</tt> option.
|
||||||
|
|
||||||
<tscreen><verb>
|
<tscreen><verb>
|
||||||
$ python sqlmap.py --update -v 4
|
$ python sqlmap.py --update -v 4
|
||||||
|
@ -5122,7 +5122,7 @@ banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
|
||||||
<sect2>Save options on a configuration INI file
|
<sect2>Save options on a configuration INI file
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--save</tt>
|
Option: <tt>-</tt><tt>-save</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is possible to save the command line options to a configuration INI
|
It is possible to save the command line options to a configuration INI
|
||||||
|
@ -5255,11 +5255,11 @@ banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
|
||||||
<sect2>Act in non-interactive mode
|
<sect2>Act in non-interactive mode
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--batch</tt>
|
Option: <tt>-</tt><tt>-batch</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
If you want sqlmap to run as a batch tool, without any users interaction
|
If you want sqlmap to run as a batch tool, without any users interaction
|
||||||
when a choice has to be done, you can force it by using <tt>--batch</tt>
|
when a choice has to be done, you can force it by using <tt>-</tt><tt>-batch</tt>
|
||||||
option, and leave sqlmap to go for a default behaviour.
|
option, and leave sqlmap to go for a default behaviour.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
|
@ -5304,7 +5304,7 @@ to the first vulnerable parameter.
|
||||||
<sect2>Clean up the DBMS by sqlmap specific UDF and tables
|
<sect2>Clean up the DBMS by sqlmap specific UDF and tables
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
Option: <tt>--cleanup</tt>
|
Option: <tt>-</tt><tt>-cleanup</tt>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
It is recommended to clean up the back-end database management system from
|
It is recommended to clean up the back-end database management system from
|
||||||
|
|
Loading…
Reference in New Issue
Block a user