fix for that -- bug

This commit is contained in:
Miroslav Stampar 2010-02-08 11:44:32 +00:00
parent 4e6af8d6c9
commit bc0eb880df

View File

@ -753,7 +753,7 @@ target urls from.
<sect2>Target URL <sect2>Target URL
<p> <p>
Option: <tt>-u</tt> or <tt>--url</tt> Option: <tt>-u</tt> or <tt>-</tt><tt>-url</tt>
<p> <p>
To run sqlmap on a single target URL. To run sqlmap on a single target URL.
@ -920,7 +920,7 @@ These options can be used to specify how to connect to the target url.
<sect2>HTTP method: <tt>GET</tt> or <tt>POST</tt> <sect2>HTTP method: <tt>GET</tt> or <tt>POST</tt>
<p> <p>
Options: <tt>--method</tt> and <tt>--data</tt> Options: <tt>-</tt><tt>-method</tt> and <tt>-</tt><tt>-data</tt>
<p> <p>
By default the HTTP method used to perform HTTP requests is <tt>GET</tt>, By default the HTTP method used to perform HTTP requests is <tt>GET</tt>,
@ -963,7 +963,7 @@ back-end DBMS: Oracle
<sect2>HTTP <tt>Cookie</tt> header <sect2>HTTP <tt>Cookie</tt> header
<p> <p>
Option: <tt>--cookie</tt> Option: <tt>-</tt><tt>-cookie</tt>
<p> <p>
This feature can be useful in two scenarios: This feature can be useful in two scenarios:
@ -1077,7 +1077,7 @@ values that you provided? [Y/n]
<sect2>HTTP <tt>Referer</tt> header <sect2>HTTP <tt>Referer</tt> header
<p> <p>
Option: <tt>--referer</tt> Option: <tt>-</tt><tt>-referer</tt>
<p> <p>
It is possible to fake the HTTP <tt>Referer</tt> header value with this It is possible to fake the HTTP <tt>Referer</tt> header value with this
@ -1110,7 +1110,7 @@ Connection: close
<sect2>HTTP <tt>User-Agent</tt> header <sect2>HTTP <tt>User-Agent</tt> header
<p> <p>
Options: <tt>--user-agent</tt> and <tt>-a</tt> Options: <tt>-</tt><tt>-user-agent</tt> and <tt>-a</tt>
<p> <p>
By default sqlmap perform HTTP requests providing the following HTTP By default sqlmap perform HTTP requests providing the following HTTP
@ -1121,7 +1121,7 @@ sqlmap/0.7 (http://sqlmap.sourceforge.net)
</verb></tscreen> </verb></tscreen>
<p> <p>
It is possible to fake it with the <tt>--user-agent</tt> option. It is possible to fake it with the <tt>-</tt><tt>-user-agent</tt> option.
<p> <p>
Example on an <bf>Oracle XE 10.2.0.1</bf> target: Example on an <bf>Oracle XE 10.2.0.1</bf> target:
@ -1200,10 +1200,10 @@ to force the HTTP User-Agent header with option --user-agent or -a
<sect2>Extra HTTP headers <sect2>Extra HTTP headers
<p> <p>
Option: <tt>--headers</tt> Option: <tt>-</tt><tt>-headers</tt>
<p> <p>
It is possible to provide extra HTTP headers by providing <tt>--headers</tt> It is possible to provide extra HTTP headers by providing <tt>-</tt><tt>-headers</tt>
options. Each header must be separated by a newline and it's much easier options. Each header must be separated by a newline and it's much easier
to provide them from the configuration INI file. Have a look at the sample to provide them from the configuration INI file. Have a look at the sample
<tt>sqlmap.conf</tt> file. <tt>sqlmap.conf</tt> file.
@ -1212,7 +1212,7 @@ to provide them from the configuration INI file. Have a look at the sample
<sect2>HTTP <tt>Basic</tt> and <tt>Digest</tt> authentications <sect2>HTTP <tt>Basic</tt> and <tt>Digest</tt> authentications
<p> <p>
Options: <tt>--auth-type</tt> and <tt>--auth-cred</tt> Options: <tt>-</tt><tt>-auth-type</tt> and <tt>-</tt><tt>-auth-cred</tt>
<p> <p>
These options can be used to specify which HTTP authentication type the These options can be used to specify which HTTP authentication type the
@ -1268,7 +1268,7 @@ Connection: close
<sect2>HTTP proxy <sect2>HTTP proxy
<p> <p>
Option: <tt>--proxy</tt> Option: <tt>-</tt><tt>-proxy</tt>
<p> <p>
It is possible to provide an anonymous HTTP proxy address to pass by the It is possible to provide an anonymous HTTP proxy address to pass by the
@ -1309,7 +1309,7 @@ settings.
<sect2>Concurrent HTTP requests <sect2>Concurrent HTTP requests
<p> <p>
Option: <tt>--threads</tt> Option: <tt>-</tt><tt>-threads</tt>
<p> <p>
It is possible to specify the number of maximum concurrent HTTP requests It is possible to specify the number of maximum concurrent HTTP requests
@ -1350,14 +1350,14 @@ with the blind SQL injection bisection algorithm implemented in sqlmap.
<p> <p>
Note that the multithreading option is not needed if the target is affected Note that the multithreading option is not needed if the target is affected
by an inband SQL injection vulnerability and the <tt>--union-use</tt> by an inband SQL injection vulnerability and the <tt>-</tt><tt>-union-use</tt>
option has been provided. option has been provided.
<sect2>Delay in seconds between each HTTP request <sect2>Delay in seconds between each HTTP request
<p> <p>
Option: <tt>--delay</tt> Option: <tt>-</tt><tt>-delay</tt>
<p> <p>
It is possible to specify a number of seconds to wait between each HTTP It is possible to specify a number of seconds to wait between each HTTP
@ -1367,7 +1367,7 @@ request. The valid value is a float, for instance 0.5 means half a second.
<sect2>Seconds to wait before timeout connection <sect2>Seconds to wait before timeout connection
<p> <p>
Option: <tt>--timeout</tt> Option: <tt>-</tt><tt>-timeout</tt>
<p> <p>
It is possible to specify a number of seconds to wait before considering It is possible to specify a number of seconds to wait before considering
@ -1378,7 +1378,7 @@ the HTTP request timed out. The valid value is a float, for instance
<sect2>Maximum number of retries when the HTTP connection timeouts <sect2>Maximum number of retries when the HTTP connection timeouts
<p> <p>
Option: <tt>--retries</tt> Option: <tt>-</tt><tt>-retries</tt>
<p> <p>
It is possible to specify the maximum number of retries when the HTTP It is possible to specify the maximum number of retries when the HTTP
@ -1479,7 +1479,7 @@ back-end DBMS: MySQL >= 5.0.0
<sect2>Force the database management system name <sect2>Force the database management system name
<p> <p>
Option: <tt>--dbms</tt> Option: <tt>-</tt><tt>-dbms</tt>
<p> <p>
By default sqlmap automatically detects the web application's back-end By default sqlmap automatically detects the web application's back-end
@ -1517,7 +1517,7 @@ back-end DBMS: PostgreSQL
</verb></tscreen> </verb></tscreen>
<p> <p>
In case you provide <tt>--fingerprint</tt> together with <tt>--dbms</tt>, In case you provide <tt>-</tt><tt>-fingerprint</tt> together with <tt>-</tt><tt>-dbms</tt>,
sqlmap will only perform the extensive fingerprint for the specified sqlmap will only perform the extensive fingerprint for the specified
database management system, read below for further details. database management system, read below for further details.
@ -1531,7 +1531,7 @@ automatically identify it for you.
<sect2>Force the database management system operating system name <sect2>Force the database management system operating system name
<p> <p>
Option: <tt>--os</tt> Option: <tt>-</tt><tt>-os</tt>
<p> <p>
By default sqlmap automatically detects the web application's back-end By default sqlmap automatically detects the web application's back-end
@ -1558,7 +1558,7 @@ not know it, let sqlmap automatically identify it for you.
<sect2>Custom injection payload <sect2>Custom injection payload
<p> <p>
Options: <tt>--prefix</tt> and <tt>--postfix</tt> Options: <tt>-</tt><tt>-prefix</tt> and <tt>-</tt><tt>-postfix</tt>
<p> <p>
In some circumstances the vulnerable parameter is exploitable only if the In some circumstances the vulnerable parameter is exploitable only if the
@ -1622,7 +1622,7 @@ the real world application it is necessary to provide it.
<sect2>Page comparison <sect2>Page comparison
<p> <p>
Options: <tt>--string</tt> and <tt>--regexp</tt> Options: <tt>-</tt><tt>-string</tt> and <tt>-</tt><tt>-regexp</tt>
<p> <p>
By default the distinction of a True query by a False one (basic concept By default the distinction of a True query by a False one (basic concept
@ -1805,7 +1805,7 @@ user's input</bf>.
<sect2>Exclude specific page content <sect2>Exclude specific page content
<p> <p>
Options: <tt>--excl-str</tt> and <tt>--excl-reg</tt> Options: <tt>-</tt><tt>-excl-str</tt> and <tt>-</tt><tt>-excl-reg</tt>
<p> <p>
Another way to get around the dynamicity issue explained above is to exclude Another way to get around the dynamicity issue explained above is to exclude
@ -1847,7 +1847,7 @@ stability test.
<sect2>Test for stacked queries (multiple statements) support <sect2>Test for stacked queries (multiple statements) support
<p> <p>
Option: <tt>--stacked-test</tt> Option: <tt>-</tt><tt>-stacked-test</tt>
<p> <p>
It is possible to test if the web application technology supports It is possible to test if the web application technology supports
@ -1911,7 +1911,7 @@ stacked queries support: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'wRcBC'=
<sect2>Test for time based blind SQL injection <sect2>Test for time based blind SQL injection
<p> <p>
Options: <tt>--time-test</tt> and <tt>--time-sec</tt> Options: <tt>-</tt><tt>-time-test</tt> and <tt>-</tt><tt>-time-sec</tt>
<p> <p>
It is possible to test if the target URL is affected by a <bf>time based It is possible to test if the target URL is affected by a <bf>time based
@ -1979,14 +1979,14 @@ time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';
<p> <p>
It is also possible to set the seconds to delay the response by providing It is also possible to set the seconds to delay the response by providing
the <tt>--time-sec</tt> option followed by an integer. By default delay the <tt>-</tt><tt>-time-sec</tt> option followed by an integer. By default delay
is set to five seconds. is set to five seconds.
<sect2>Test for UNION query SQL injection <sect2>Test for UNION query SQL injection
<p> <p>
Options: <tt>--union-test</tt> and <tt>--union-tech</tt> Options: <tt>-</tt><tt>-union-test</tt> and <tt>-</tt><tt>-union-tech</tt>
<p> <p>
It is possible to test if the target URL is affected by a <bf>UNION query It is possible to test if the target URL is affected by a <bf>UNION query
@ -2015,7 +2015,7 @@ NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
By default sqlmap uses the <bf><tt>NULL</tt> bruteforcing</bf> technique to By default sqlmap uses the <bf><tt>NULL</tt> bruteforcing</bf> technique to
detect the number of columns within the original <tt>SELECT</tt> statement. detect the number of columns within the original <tt>SELECT</tt> statement.
It is also possible to change it to <bf><tt>ORDER BY</tt> clause It is also possible to change it to <bf><tt>ORDER BY</tt> clause
bruteforcing</bf> with the <tt>--union-tech</tt> option. bruteforcing</bf> with the <tt>-</tt><tt>-union-tech</tt> option.
<p> <p>
Further details on these techniques can be found <htmlurl Further details on these techniques can be found <htmlurl
@ -2046,9 +2046,9 @@ a lot of time.
<p> <p>
It is strongly recommended to run at least once sqlmap with the It is strongly recommended to run at least once sqlmap with the
<tt>--union-test</tt> option to test if the affected parameter is used <tt>-</tt><tt>-union-test</tt> option to test if the affected parameter is used
within a <tt>for</tt> cycle, or similar, and in case use within a <tt>for</tt> cycle, or similar, and in case use
<tt>--union-use</tt> option to exploit this vulnerability because it <tt>-</tt><tt>-union-use</tt> option to exploit this vulnerability because it
saves a lot of time and it does not weight down the web server log file saves a lot of time and it does not weight down the web server log file
with hundreds of HTTP requests. with hundreds of HTTP requests.
@ -2056,12 +2056,12 @@ with hundreds of HTTP requests.
<sect2>Use the UNION query SQL injection <sect2>Use the UNION query SQL injection
<p> <p>
Option: <tt>--union-use</tt> Option: <tt>-</tt><tt>-union-use</tt>
<p> <p>
Providing the <tt>--union-use</tt> parameter, sqlmap will first test if Providing the <tt>-</tt><tt>-union-use</tt> parameter, sqlmap will first test if
the target URL is affected by an <bf>inband SQL injection</bf> the target URL is affected by an <bf>inband SQL injection</bf>
(<tt>--union-test</tt>) vulnerability then, in case it seems to be (<tt>-</tt><tt>-union-test</tt>) vulnerability then, in case it seems to be
vulnerable, it will confirm that the parameter is affected by a <bf>Full vulnerable, it will confirm that the parameter is affected by a <bf>Full
UNION query SQL injection</bf> and use this technique to go ahead with the UNION query SQL injection</bf> and use this technique to go ahead with the
exploiting. exploiting.
@ -2228,7 +2228,7 @@ the page content.
<sect2>Extensive database management system fingerprint <sect2>Extensive database management system fingerprint
<p> <p>
Options: <tt>-f</tt> or <tt>--fingerprint</tt> Options: <tt>-f</tt> or <tt>-</tt><tt>-fingerprint</tt>
<p> <p>
By default the web application's back-end database management system By default the web application's back-end database management system
@ -2268,7 +2268,7 @@ system and the web application technology by parsing some HTTP response headers.
<p> <p>
If you want to perform an extensive database management system fingerprint If you want to perform an extensive database management system fingerprint
based on various techniques like specific SQL dialects and inband error based on various techniques like specific SQL dialects and inband error
messages, you can provide the <tt>--fingerprint</tt> option. messages, you can provide the <tt>-</tt><tt>-fingerprint</tt> option.
<p> <p>
Example on a <bf>MySQL 5.0.67</bf> target: Example on a <bf>MySQL 5.0.67</bf> target:
@ -2347,7 +2347,7 @@ back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0
<p> <p>
As you can see from the last example, sqlmap first tested for MySQL, As you can see from the last example, sqlmap first tested for MySQL,
then for Oracle, then for PostgreSQL since the user did not forced the then for Oracle, then for PostgreSQL since the user did not forced the
back-end database management system name with option <tt>--dbms</tt>. back-end database management system name with option <tt>-</tt><tt>-dbms</tt>.
<p> <p>
Example on a <bf>Microsoft SQL Server 2000 Service Pack 0</bf> target: Example on a <bf>Microsoft SQL Server 2000 Service Pack 0</bf> target:
@ -2385,7 +2385,7 @@ back-end DBMS: active fingerprint: Microsoft SQL Server 2005
<p> <p>
If you want an even more accurate result, based also on banner parsing, If you want an even more accurate result, based also on banner parsing,
you can also provide the <tt>-b</tt> or <tt>--banner</tt> option. you can also provide the <tt>-b</tt> or <tt>-</tt><tt>-banner</tt> option.
<p> <p>
Example on a <bf>MySQL 5.0.67</bf> target: Example on a <bf>MySQL 5.0.67</bf> target:
@ -2498,7 +2498,7 @@ name="SQLSecurity.com site"> and outputs it to the XML versions file.
<sect2>Banner <sect2>Banner
<p> <p>
Option: <tt>-b</tt> or <tt>--banner</tt> Option: <tt>-b</tt> or <tt>-</tt><tt>-banner</tt>
<p> <p>
Most of the modern database management systems have a function and/or Most of the modern database management systems have a function and/or
@ -2570,7 +2570,7 @@ Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86)
<sect2>Current user <sect2>Current user
<p> <p>
Option: <tt>--current-user</tt> Option: <tt>-</tt><tt>-current-user</tt>
<p> <p>
It is possible to retrieve the database management system's user which is It is possible to retrieve the database management system's user which is
@ -2589,7 +2589,7 @@ current user: 'testuser@localhost'
<sect2>Current database <sect2>Current database
<p> <p>
Option: <tt>--current-db</tt> Option: <tt>-</tt><tt>-current-db</tt>
<p> <p>
It is possible to retrieve the database management system's database the It is possible to retrieve the database management system's database the
@ -2608,7 +2608,7 @@ current database: 'master'
<sect2>Detect if the DBMS current user is a database administrator <sect2>Detect if the DBMS current user is a database administrator
<p> <p>
Option: <tt>--is-dba</tt> Option: <tt>-</tt><tt>-is-dba</tt>
<p> <p>
It is possible to detect if the current database management system session user is It is possible to detect if the current database management system session user is
@ -2653,7 +2653,7 @@ current user is DBA: 'True'
<sect2>Users <sect2>Users
<p> <p>
Option: <tt>--users</tt> Option: <tt>-</tt><tt>-users</tt>
<p> <p>
It is possible to enumerate the list of database management system users. It is possible to enumerate the list of database management system users.
@ -2674,7 +2674,7 @@ database management system users [3]:
<sect2>Users password hashes <sect2>Users password hashes
<p> <p>
Options: <tt>--passwords</tt> and <tt>-U</tt> Options: <tt>-</tt><tt>-passwords</tt> and <tt>-U</tt>
<p> <p>
It is possible to enumerate the password hashes for each database It is possible to enumerate the password hashes for each database
@ -2759,7 +2759,7 @@ database management system users password hashes:
<sect2>Users privileges <sect2>Users privileges
<p> <p>
Options: <tt>--privileges</tt> and <tt>-U</tt> Options: <tt>-</tt><tt>-privileges</tt> and <tt>-U</tt>
<p> <p>
It is possible to enumerate the privileges for each database management It is possible to enumerate the privileges for each database management
@ -2910,7 +2910,7 @@ management system is Microsoft SQL Server.
<sect2>Available databases <sect2>Available databases
<p> <p>
Option: <tt>--dbs</tt> Option: <tt>-</tt><tt>-dbs</tt>
<p> <p>
It is possible to enumerate the list of databases. It is possible to enumerate the list of databases.
@ -2937,7 +2937,7 @@ management system is Oracle.
<sect2>Databases tables <sect2>Databases tables
<p> <p>
Options: <tt>--tables</tt> and <tt>-D</tt> Options: <tt>-</tt><tt>-tables</tt> and <tt>-D</tt>
<p> <p>
It is possible to enumerate the list of tables for all database It is possible to enumerate the list of tables for all database
@ -3049,7 +3049,7 @@ system user.
<sect2>Database table columns <sect2>Database table columns
<p> <p>
Options: <tt>--columns</tt>, <tt>-T</tt> and <tt>-D</tt> Options: <tt>-</tt><tt>-columns</tt>, <tt>-T</tt> and <tt>-D</tt>
<p> <p>
It is possible to enumerate the list of columns for a specific database It is possible to enumerate the list of columns for a specific database
@ -3175,8 +3175,8 @@ Table: users
<sect2>Dump database table entries <sect2>Dump database table entries
<p> <p>
Options: <tt>--dump</tt>, <tt>-C</tt>, <tt>-T</tt>, <tt>-D</tt>, Options: <tt>-</tt><tt>-dump</tt>, <tt>-C</tt>, <tt>-T</tt>, <tt>-D</tt>,
<tt>--start</tt> and <tt>--stop</tt> <tt>-</tt><tt>-start</tt> and <tt>-</tt><tt>-stop</tt>
<p> <p>
It is possible to dump the entries for a specific database table. It is possible to dump the entries for a specific database table.
@ -3287,12 +3287,12 @@ $ cat /software/sqlmap/output/192.168.1.121/dump/public/users.csv
</verb></tscreen> </verb></tscreen>
<p> <p>
You can also provide the <tt>--start</tt> and/or the <tt>--stop</tt> You can also provide the <tt>-</tt><tt>-start</tt> and/or the <tt>-</tt><tt>-stop</tt>
options to limit the dump to a range of entries. options to limit the dump to a range of entries.
<itemize> <itemize>
<item><tt>--start</tt> specifies the first entry to enumerate <item><tt>-</tt><tt>-start</tt> specifies the first entry to enumerate
<item><tt>--stop</tt> specifies the last entry to enumerate <item><tt>-</tt><tt>-stop</tt> specifies the last entry to enumerate
</itemize> </itemize>
<p> <p>
@ -3323,7 +3323,7 @@ table entry.
<sect2>Dump all databases tables entries <sect2>Dump all databases tables entries
<p> <p>
Options: <tt>--dump-all</tt> and <tt>--exclude-sysdbs</tt> Options: <tt>-</tt><tt>-dump-all</tt> and <tt>-</tt><tt>-exclude-sysdbs</tt>
<p> <p>
It is possible to dump all databases tables entries at once. It is possible to dump all databases tables entries at once.
@ -3394,7 +3394,7 @@ Table: CHARACTER_SETS
</verb></tscreen> </verb></tscreen>
<p> <p>
You can also provide the <tt>--exclude-sysdbs</tt> option to exclude all You can also provide the <tt>-</tt><tt>-exclude-sysdbs</tt> option to exclude all
system databases. In that case sqlmap will only dump entries of users' databases system databases. In that case sqlmap will only dump entries of users' databases
tables. tables.
@ -3450,7 +3450,7 @@ as a users' database.
<sect2>Run your own SQL statement <sect2>Run your own SQL statement
<p> <p>
Options: <tt>--sql-query</tt> and <tt>--sql-shell</tt> Options: <tt>-</tt><tt>-sql-query</tt> and <tt>-</tt><tt>-sql-shell</tt>
<p> <p>
The SQL query and the SQL shell features makes the user able to run The SQL query and the SQL shell features makes the user able to run
@ -3835,7 +3835,7 @@ support when the back-end DBMS is PostgreSQL.
<sect2>Read a file from the back-end DBMS file system <sect2>Read a file from the back-end DBMS file system
<p> <p>
Option: <tt>--read-file</tt> Option: <tt>-</tt><tt>-read-file</tt>
<p> <p>
It is possible to retrieve the content of files from the underlying file It is possible to retrieve the content of files from the underlying file
@ -3958,7 +3958,7 @@ output/192.168.1.121/files/C__example.exe: PE32 executable for MS Windows (GUI)
<sect2>Write a local file on the back-end DBMS file system <sect2>Write a local file on the back-end DBMS file system
<p> <p>
Options: <tt>--write-file</tt> and <tt>--dest-file</tt> Options: <tt>-</tt><tt>-write-file</tt> and <tt>-</tt><tt>-dest-file</tt>
<p> <p>
It is possible to upload a local file to the underlying file system when It is possible to upload a local file to the underlying file system when
@ -4012,7 +4012,7 @@ same size as the local file '/tmp/nc.exe.packed'
<sect2>Execute arbitrary operating system command <sect2>Execute arbitrary operating system command
<p> <p>
Options: <tt>--os-cmd</tt> and <tt>--os-shell</tt> Options: <tt>-</tt><tt>-os-cmd</tt> and <tt>-</tt><tt>-os-shell</tt>
<p> <p>
It is possible to execute arbitrary commands on the underlying operating It is possible to execute arbitrary commands on the underlying operating
@ -4044,7 +4044,7 @@ These techniques are detailed in white paper
<p> <p>
It is possible to specify a single command to be executed with the It is possible to specify a single command to be executed with the
<tt>--os-cmd</tt> option. <tt>-</tt><tt>-os-cmd</tt> option.
<p> <p>
Example on a <bf>PostgreSQL 8.3.5</bf> target: Example on a <bf>PostgreSQL 8.3.5</bf> target:
@ -4119,9 +4119,9 @@ nt authority\network service
<p> <p>
It is also possible to simulate a real shell where you can type as many It is also possible to simulate a real shell where you can type as many
arbitrary commands as you wish. The option is <tt>--os-shell</tt> and has arbitrary commands as you wish. The option is <tt>-</tt><tt>-os-shell</tt> and has
the same TAB completion and history functionalities as provided by the same TAB completion and history functionalities as provided by
<tt>--sql-shell</tt>. <tt>-</tt><tt>-sql-shell</tt>.
<p> <p>
Example on a <bf>MySQL 5.0.67</bf> target: Example on a <bf>MySQL 5.0.67</bf> target:
@ -4237,7 +4237,7 @@ can only be deleted manually
</verb></tscreen> </verb></tscreen>
<p> <p>
Now run it again, but specifying the <tt>--union-use</tt> to retrieve the Now run it again, but specifying the <tt>-</tt><tt>-union-use</tt> to retrieve the
command standard output quicker, via UNION based SQL injection, when the command standard output quicker, via UNION based SQL injection, when the
parameter is affected also by inband SQL injection vulnerability: parameter is affected also by inband SQL injection vulnerability:
@ -4346,7 +4346,7 @@ wants to recreate them or keep them and save time.
<sect2>Prompt for an out-of-band shell, meterpreter or VNC <sect2>Prompt for an out-of-band shell, meterpreter or VNC
<p> <p>
Options: <tt>--os-pwn</tt>, <tt>--priv-esc</tt>, <tt>--msf-path</tt> and <tt>--tmp-path</tt> Options: <tt>-</tt><tt>-os-pwn</tt>, <tt>-</tt><tt>-priv-esc</tt>, <tt>-</tt><tt>-msf-path</tt> and <tt>-</tt><tt>-tmp-path</tt>
<p> <p>
It is possible to establish an <bf>out-of-band TCP stateful channel</bf> It is possible to establish an <bf>out-of-band TCP stateful channel</bf>
@ -4471,7 +4471,7 @@ Microsoft SQL Server 2000 by default runs as <tt>SYSTEM</tt>, whereas
Microsoft SQL Server 2005 and 2008 run most of the times as <tt>NETWORK Microsoft SQL Server 2005 and 2008 run most of the times as <tt>NETWORK
SERVICE</tt> and sometimes as <tt>LOCAL SERVICE</tt>. SERVICE</tt> and sometimes as <tt>LOCAL SERVICE</tt>.
It is possible to provide sqlmap with the <tt>--priv-esc</tt> option to It is possible to provide sqlmap with the <tt>-</tt><tt>-priv-esc</tt> option to
abuse Windows access tokens and escalate privileges to <tt>SYSTEM</tt> abuse Windows access tokens and escalate privileges to <tt>SYSTEM</tt>
within the Meterpreter session created if the underlying operating system within the Meterpreter session created if the underlying operating system
is not patched against Microsoft Security Bulletin is not patched against Microsoft Security Bulletin
@ -4597,7 +4597,7 @@ meterpreter > exit
<sect2>One click prompt for an out-of-band shell, meterpreter or VNC <sect2>One click prompt for an out-of-band shell, meterpreter or VNC
<p> <p>
Options: <tt>--os-smbrelay</tt>, <tt>--priv-esc</tt> and <tt>--msf-path</tt> Options: <tt>-</tt><tt>-os-smbrelay</tt>, <tt>-</tt><tt>-priv-esc</tt> and <tt>-</tt><tt>-msf-path</tt>
<p> <p>
If the back-end database management system runs as <tt>Administrator</tt> If the back-end database management system runs as <tt>Administrator</tt>
@ -4756,7 +4756,7 @@ msf exploit(smb_relay) > exit
<sect2>Stored procedure buffer overflow exploitation <sect2>Stored procedure buffer overflow exploitation
<p> <p>
Options: <tt>--os-bof</tt>, <tt>--priv-esc</tt> and <tt>--msf-path</tt> Options: <tt>-</tt><tt>-os-bof</tt>, <tt>-</tt><tt>-priv-esc</tt> and <tt>-</tt><tt>-msf-path</tt>
<p> <p>
If the back-end database management system is not patched against Microsoft If the back-end database management system is not patched against Microsoft
@ -4863,7 +4863,7 @@ meterpreter > exit
<sect2>Estimated time of arrival <sect2>Estimated time of arrival
<p> <p>
Option: <tt>--eta</tt> Option: <tt>-</tt><tt>-eta</tt>
<p> <p>
It is possible to calculate and show the estimated time of arrival to It is possible to calculate and show the estimated time of arrival to
@ -4947,14 +4947,14 @@ counts the number of retrieved query output characters.
<sect2>Update sqlmap to the latest stable version <sect2>Update sqlmap to the latest stable version
<p> <p>
Option: <tt>--update</tt> Option: <tt>-</tt><tt>-update</tt>
<p> <p>
It is possible to update sqlmap to the latest stable version available on It is possible to update sqlmap to the latest stable version available on
project's <htmlurl url="http://sourceforge.net/projects/sqlmap/files/" project's <htmlurl url="http://sourceforge.net/projects/sqlmap/files/"
name="SourceForge File List page"> by running it with the name="SourceForge File List page"> by running it with the
<tt>--update</tt> option. <tt>-</tt><tt>-update</tt> option.
<tscreen><verb> <tscreen><verb>
$ python sqlmap.py --update -v 4 $ python sqlmap.py --update -v 4
@ -5122,7 +5122,7 @@ banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
<sect2>Save options on a configuration INI file <sect2>Save options on a configuration INI file
<p> <p>
Option: <tt>--save</tt> Option: <tt>-</tt><tt>-save</tt>
<p> <p>
It is possible to save the command line options to a configuration INI It is possible to save the command line options to a configuration INI
@ -5255,11 +5255,11 @@ banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
<sect2>Act in non-interactive mode <sect2>Act in non-interactive mode
<p> <p>
Option: <tt>--batch</tt> Option: <tt>-</tt><tt>-batch</tt>
<p> <p>
If you want sqlmap to run as a batch tool, without any users interaction If you want sqlmap to run as a batch tool, without any users interaction
when a choice has to be done, you can force it by using <tt>--batch</tt> when a choice has to be done, you can force it by using <tt>-</tt><tt>-batch</tt>
option, and leave sqlmap to go for a default behaviour. option, and leave sqlmap to go for a default behaviour.
<p> <p>
@ -5304,7 +5304,7 @@ to the first vulnerable parameter.
<sect2>Clean up the DBMS by sqlmap specific UDF and tables <sect2>Clean up the DBMS by sqlmap specific UDF and tables
<p> <p>
Option: <tt>--cleanup</tt> Option: <tt>-</tt><tt>-cleanup</tt>
<p> <p>
It is recommended to clean up the back-end database management system from It is recommended to clean up the back-end database management system from