Bernardo Damele
17289c5ff2
Minor bug fix
2009-07-30 12:01:23 +00:00
Bernardo Damele
8096a37940
Major bug fix in --read-file option and minor code refactoring.
2009-07-09 11:50:15 +00:00
Bernardo Damele
ba2e009fd9
Now it's fixed
2009-06-29 10:15:10 +00:00
Bernardo Damele
bc31bd1dd9
Minor bug fix
2009-06-29 10:13:39 +00:00
Bernardo Damele
02f6425db8
Work-around to avoid a TypeError traceback when reading a file content on MySQL/MSSQL
2009-06-02 14:24:48 +00:00
Bernardo Damele
440a52b84d
Major bug fix to sql-query/sql-shell functionalities
2009-05-20 10:19:19 +00:00
Bernardo Damele
a727427299
Minor fix for Python <= 2.5.2 (os.path.normpath function)
2009-05-06 13:37:51 +00:00
Bernardo Damele
c5d20b8a86
Initial support for ASP web backdoor functionality
2009-05-06 12:14:38 +00:00
Bernardo Damele
57b8bb4c8e
Minor syntax adjustment for web backdoor functionality
2009-04-28 21:51:22 +00:00
Bernardo Damele
1d7de719b9
Almost done with web backdoor functionality
2009-04-28 11:05:07 +00:00
Bernardo Damele
16b4530bbe
Minor bug fixes to --os-shell (altought web backdoor functionality still to be reviewed).
...
Minor common library code refactoring.
Code cleanup.
Set back the default User-Agent to sqlmap for comparison algorithm reasons.
Updated THANKS.
2009-04-27 23:05:11 +00:00
Bernardo Damele
aec2419410
Fixed character escaping in SQL shell/query functionalities.
2009-04-23 15:37:12 +00:00
Bernardo Damele
8c0ac767f4
Updated to sqlmap 0.7 release candidate 1
2009-04-22 11:48:07 +00:00
Bernardo Damele
f91843540f
Major bug fix when the CU alias (current user) is given (with -U option)
...
together with --privileges or --password to work properly also on
MySQL >= 5.0.
2009-01-19 21:25:37 +00:00
Bernardo Damele
5560f0b68a
Updated the copyright
2009-01-12 21:35:38 +00:00
Bernardo Damele
f92b76a8b0
Minor bug fix
2008-12-21 16:39:40 +00:00
Bernardo Damele
7e8ac16245
Added preventive check for stacked queries support when executing DDL,
...
DML & co. statements in SQL query and SQL shell. Minor improvements on
this new feature.
Increased default connection timeout to 30 seconds (needed for vmware
machine not correctly synched).
2008-12-19 20:48:33 +00:00
Bernardo Damele
ad228e6947
Ahead with the improvements to the comparison algorithm.
...
Added support internally to forge CASE statements, used only by
--is-dba query at the moment.
Allow DDL, DML (INSERT, UPDATE, etc.) from user in SQL query and
SQL shell.
Minor code adjustments.
2008-12-19 20:09:46 +00:00
Bernardo Damele
3fe493b63d
Minor enhancement to support an option (--is-dba) to show if the
...
current user is a database management system administrator.
2008-12-18 20:41:11 +00:00
Bernardo Damele
072eb7154c
Major enhancement to support Partial UNION query SQL injection technique too.
...
Minor code cleanup.
2008-12-10 17:23:07 +00:00
Bernardo Damele
78e8a83c11
Minor improvement to be able to provide CU as user value (-U) when enumerating
...
users privileges or users passwords.
2008-12-05 15:32:59 +00:00
Bernardo Damele
dc1f2deb74
Minor bug fix to correctly enumerate columns on Microsoft SQL Server.
...
Minor adjustments to XML signatures.
Updated documentation.
2008-11-25 11:33:44 +00:00
Bernardo Damele
7d0724843f
Major enhancement to the engine to parse XML files and matches on DBMS banner
...
and HTTP response headers.
Initial web application technology fingerprint (for the moment based only on
X-Powered-By HTTP response header and not shown yet to the user).
Minor layout adjustments.
2008-11-17 17:41:02 +00:00
Bernardo Damele
ecc4a98071
Properly moved and improved inject.goStacked() function and newly
...
implemented Time based blind SQL injection now is a single test file
within the lib/techniques/ folder.
Renamed lib/techniques/inference to lib/techniques/blind, it is more
approriate and adapted the rest of the libraries.
Updated ChangeLog file.
2008-11-12 23:44:09 +00:00
Bernardo Damele
9329f8c9c4
Minor enhancement to be able to enumerate table columns and dump table
...
entries also if the database name is not provided by using the current
database on MySQL and MSSQL, the 'public' scheme on PostgreSQL and the
'USERS' TABLESPACE_NAME on Oracle.
Minor bug fix so that when the user provide as SELECT statement to be
processed an asterisk, now it also work if in the FROM there is no
database name specified.
Minor layout adjustments.
2008-11-12 22:53:25 +00:00
Bernardo Damele
81ed7c2086
Initial implementation of support for stacked queries.
...
Added method to test for Time based blind SQL injection query stacking
on the affected parameter a SLEEP() or similar DBMS specific function.
Adapted libraries, plugins and XML with the above changes.
Minor layout adjustments.
2008-11-12 00:36:50 +00:00
Bernardo Damele
2a01de3f0b
Minor bug fix to correctly dump table entries when the column is provided
2008-11-04 19:54:44 +00:00
Bernardo Damele
206191d164
Major bug fix so that when the expected value of a query (count variable)
...
is an integer and for some reason the resumed value from session file is
a string or a binary file, the query is executed again and and its new
output saved to the session file
2008-11-02 19:21:19 +00:00
Bernardo Damele
03b90e0a3f
Be more user friendly on messages and minor code layout improvement
2008-11-02 18:23:42 +00:00
Bernardo Damele
09ca578ca1
Major bug fix so that the users' privileges enumeration now works properly also on both MySQL < 5.0 and MySQL >= 5.0 also if the user has provided one or more users with -U option;
2008-11-02 18:17:12 +00:00
Bernardo Damele
342a5436f4
Minor enhancement to be able to dump entries also on MySQL < 5.0 when DB name, table name and column(s) are provided
2008-10-26 17:07:55 +00:00
Bernardo Damele
2fcbb57e1c
Minor code restyling
2008-10-26 17:00:07 +00:00
Bernardo Damele
5216fb6e02
Major bug fix so that the users' privileges enumeration now works properly also on MySQL < 5.0 (fix a traceback)
2008-10-26 16:45:14 +00:00
Bernardo Damele
8f5fb5657d
Major improvement to correctly enumerate tables, columns and dump tables
...
entries on PostgreSQL when the database name is not 'public' or a system
database and on Oracle. Minor code restyle.
2008-10-26 16:19:15 +00:00
Bernardo Damele
38f13932bc
Minor improvements to queries
2008-10-20 10:09:37 +00:00
Bernardo Damele
892a7b2f8a
propsets..
2008-10-15 15:56:32 +00:00
Bernardo Damele
8e3eb45510
After the storm, a restore..
2008-10-15 15:38:22 +00:00
