From bf2a857b9aaa3246310b1bd9a75614c4f995c2ed Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Fri, 12 Dec 2008 19:06:31 +0000 Subject: [PATCH] Minor adjustments and minor bug fixes. Documentation almost complete for sqlmap 0.6.3. --- doc/README.html | 1484 +++++++++++++++++++++++----------- doc/README.pdf | Bin 297431 -> 319035 bytes doc/README.sgml | 1445 ++++++++++++++++++++++----------- extra/msfauxmod/README.txt | 7 +- lib/controller/checks.py | 34 + lib/controller/controller.py | 14 +- lib/core/session.py | 36 + lib/core/settings.py | 2 +- lib/parse/cmdline.py | 11 +- lib/utils/parenthesis.py | 4 + sqlmap.conf | 4 +- xml/banner/postgresql.xml | 6 +- 12 files changed, 2077 insertions(+), 970 deletions(-) diff --git a/doc/README.html b/doc/README.html index e065b5464..8b079a87c 100644 --- a/doc/README.html +++ b/doc/README.html @@ -108,19 +108,19 @@ or even be able to access the underlying operating system.

Consider that the target url is:

-http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2 +http://192.168.1.121/sqlmap/mysql/get_int.php?id=1

Assume that:

-http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=1&cat=2 +http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=1

is the same page as the original one and:

-http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=2&cat=2 +http://192.168.1.121/sqlmap/mysql/get_int.php?id=1+AND+1=2

differs from the original one, it means that you are in front of a SQL @@ -133,12 +133,12 @@ does not depend upon the back-end database management system nor on the web application programming language: it is a programmer code's security flaw. The Open Web Application Security Project -recently rated in their +rated on 2007 in their OWASP Top Ten survey this vulnerability as the most common and important web application vulnerability, second only to Cross-Site Scripting.

Back to the scenario, probably the SQL SELECT statemenet into -index.php has a syntax similar to the following SQL query, in +get_int.php has a syntax similar to the following SQL query, in pseudo PHP code:

@@ -154,16 +154,18 @@ same content and without showing any SQL error message.

Moreover, in this simple and easy to inject scenario it would be also possible to append, not just one or more valid SQL condition(s), but also stacked SQL queries, for instance something like [...]&id=1; -ANOTHER SQL QUERY--

+ANOTHER SQL QUERY# if the web application technology supports +stacked queries, also known as multiple statements.

Now that you found this SQL injection vulnerable parameter, you can exploit it by manipulating the id parameter value in the HTTP request.

There exist many -resources -on the Net explaining in depth how to prevent and how to exploit SQL -injection vulnerabilities and it is recommended to read them if you are -not familiar with the issue before going ahead with sqlmap.

-

Passing the original address, http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2 +resources +on the Net explaining in depth how to prevent, how to detect and how to +exploit SQL injection vulnerabilities in web application and it is +recommended to read them if you are not familiar with the issue before +going ahead with sqlmap.

+

Passing the original address, http://192.168.1.121/sqlmap/mysql/get_int.php?id=1 to sqlmap, the tool will automatically: