Miroslav Stampar
1d8953ebdb
update of THANKS file
2010-08-08 21:25:21 +00:00
Miroslav Stampar
6a6ff09c9a
fix for a bug reported by Marek Sarvas
2010-07-26 08:11:28 +00:00
Miroslav Stampar
c39d819dd2
fix for a resume bug reported by Augusto Urbieta
2010-07-20 08:13:02 +00:00
Miroslav Stampar
6d11f86fdd
update
2010-07-15 08:51:23 +00:00
Bernardo Damele
82bce81e28
Minor improvements
2010-07-02 13:38:52 +00:00
Bernardo Damele
dc8862a140
Updated
2010-07-01 10:46:59 +00:00
Bernardo Damele
3f2db471f5
Updated thanks
2010-06-30 13:27:07 +00:00
Bernardo Damele
d40a238335
Make --keep-alive public
2010-06-30 11:29:35 +00:00
Bernardo Damele
abc3c24d62
Update
2010-06-30 09:48:48 +00:00
Bernardo Damele
4bba59aaf5
Updated doc
2010-06-29 23:52:22 +00:00
Bernardo Damele
8576817a2b
Added support for SOAP requests: fixed, extended and tested a user's patch - closes #196 .
2010-06-29 21:07:23 +00:00
Bernardo Damele
7cad3cbda6
Minor code refactoring
2010-06-28 13:47:20 +00:00
Bernardo Damele
887adfcf10
Minor adjustments to extra/ libraries
2010-06-09 21:43:22 +00:00
Miroslav Stampar
01f2dfe33f
update
2010-06-04 17:08:32 +00:00
Bernardo Damele
080c71b903
Updated documentation
2010-06-02 16:19:43 +00:00
Bernardo Damele
06af405efd
Adapted and merged in patch to support XML output (-x switch) - still in beta.
...
Minor bug fixes and adjustments.
2010-05-28 16:43:04 +00:00
Miroslav Stampar
2a1dd492f5
updated THANKS
2010-05-25 10:10:27 +00:00
Miroslav Stampar
d2c03c12fd
updated thanks
2010-05-24 20:25:43 +00:00
Bernardo Damele
03fb84e29f
Minor enhancement to internal --profile function
2010-05-21 15:06:05 +00:00
Miroslav Stampar
4c1ad7d8ce
added Jose Fonseca (gprof2dot) to THANKS
2010-05-21 10:22:56 +00:00
Bernardo Damele
bffa06f2ca
Updated user's manual
2010-05-20 10:08:17 +00:00
Bernardo Damele
b2c5807109
Updated
2010-05-12 22:02:18 +00:00
Bernardo Damele
74860fee2a
Updated
2010-05-10 14:52:02 +00:00
Bernardo Damele
7b6050f3c1
Minor update
2010-05-06 14:18:25 +00:00
Bernardo Damele
8dbf89afe4
Minor update
2010-05-06 11:22:53 +00:00
Bernardo Damele
783c48f6e9
Merged history into user's manual
2010-05-06 11:09:03 +00:00
Bernardo Damele
7bf31f54b8
Updated history SGML file
2010-05-06 10:54:13 +00:00
Bernardo Damele
147e14356d
Major bug fix (reported by Thierry Zoller)
2010-05-06 10:52:40 +00:00
Bernardo Damele
107a900f51
Updated
2010-05-03 12:57:17 +00:00
Miroslav Stampar
d8e5585c66
fixed a bug reported by Mosk Dmitri (infoMsg UnboundLocalError)
2010-04-29 08:30:29 +00:00
Bernardo Damele
a588b2020b
Added history SGML file
2010-04-26 15:00:53 +00:00
Bernardo Damele
2665066dae
Updated changelog file
2010-04-26 12:35:39 +00:00
Bernardo Damele
3087c27659
Updated doc
2010-04-22 10:37:58 +00:00
Bernardo Damele
e11d511cad
Updated doc
2010-04-15 12:12:53 +00:00
Bernardo Damele
e0d0913fc6
Updated doc
2010-04-12 09:34:20 +00:00
Bernardo Damele
822d22299f
Updated
2010-04-09 13:48:02 +00:00
Bernardo Damele
bd669dd6fa
Updated
2010-04-06 10:32:56 +00:00
Bernardo Damele
2d55ec19a3
Minor code restyling
2010-04-06 10:15:19 +00:00
Bernardo Damele
f0f1176396
Updated THANKS
2010-03-23 21:24:31 +00:00
Bernardo Damele
9e8a108768
Updated
2010-03-22 15:43:38 +00:00
Miroslav Stampar
f1fde2e443
added basic skeleton for FAQ doc
2010-03-17 12:56:26 +00:00
Bernardo Damele
7f5bc5e3fe
Increased version to 0.9-dev
2010-03-15 11:04:57 +00:00
Bernardo Damele
bfbf58b04e
Generated new user's manual html and pdf
2010-03-13 22:07:08 +00:00
Bernardo Damele
ee89709042
Updated manual
2010-03-13 21:56:38 +00:00
Miroslav Stampar
4bef12a2b4
doc update
2010-03-13 14:35:56 +00:00
Bernardo Damele
c42c4982c3
Updated documentation according to r1460
2010-03-12 22:59:03 +00:00
Bernardo Damele
7d8cc1a482
Get rid of Churrasco (Token kidnapping technique to --priv-esc). Reasons why:
...
1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed
2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays.
Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter.
Minor layout adjustments.
2010-03-12 22:43:35 +00:00
Bernardo Damele
054a4aaee7
Updated documentation, almost ready for 0.8 release!
2010-03-12 17:43:38 +00:00
Bernardo Damele
b50a2288f4
Minor layout adjustments
2010-03-11 23:54:07 +00:00
Bernardo Damele
b344a70ba1
Updated changelog
2010-03-11 01:10:55 +00:00
Bernardo Damele
4d53b17320
Updated THANKS
2010-03-10 22:08:54 +00:00
Bernardo Damele
6712b19df2
Updated ChangeLog
2010-03-10 01:14:23 +00:00
Bernardo Damele
8593741358
Minor bug fix
2010-03-05 15:25:53 +00:00
Bernardo Damele
7136c17f19
Minor log adjustments
2010-03-05 14:59:33 +00:00
Miroslav Stampar
d618964ab6
more time adjustments
2010-03-05 14:30:50 +00:00
Miroslav Stampar
45fc58d267
update
2010-03-05 14:24:54 +00:00
Miroslav Stampar
071e897f4e
minor time adjustments
2010-03-05 14:09:20 +00:00
Miroslav Stampar
6fd1f7f77c
update
2010-03-05 14:06:03 +00:00
Bernardo Damele
20d8275f0e
Minor doc adjustment
2010-03-05 10:20:45 +00:00
Bernardo Damele
5209b5929f
update
2010-03-04 17:38:00 +00:00
Miroslav Stampar
5334a40451
added description for --flush-session option
2010-03-04 13:17:11 +00:00
Bernardo Damele
a839566bb2
Added a link
2010-03-04 12:44:23 +00:00
Bernardo Damele
63880e3121
update
2010-03-03 22:02:48 +00:00
Bernardo Damele
1c7943f7b1
Update
2010-03-03 18:58:27 +00:00
Bernardo Damele
1704c73892
Update
2010-03-03 16:25:03 +00:00
Bernardo Damele
e774578180
Updated documentation
2010-03-03 15:16:43 +00:00
Miroslav Stampar
759b720425
documentation update
2010-03-03 13:59:29 +00:00
Miroslav Stampar
ddd8b277a6
updates, added #TODO marks for parts which have to be updated
2010-03-02 12:07:54 +00:00
Miroslav Stampar
0acef530ce
update
2010-03-01 10:51:17 +00:00
Bernardo Damele
dd3f65f0fb
Updated ChangeLog
2010-02-26 15:37:24 +00:00
Bernardo Damele
3c34066d19
Added newly compiled PostgreSQL UDFs for Windows
2010-02-20 20:59:13 +00:00
Bernardo Damele
16599cf2cf
typo fix
2010-02-16 22:54:22 +00:00
Bernardo Damele
7e0c411c0e
Updated THANKS file
2010-02-11 23:46:50 +00:00
Miroslav Stampar
bc0eb880df
fix for that -- bug
2010-02-08 11:44:32 +00:00
Miroslav Stampar
4e6af8d6c9
some syntax corrections
2010-02-08 09:10:32 +00:00
Bernardo Damele
22995787d1
Updated THANKS file
2010-02-04 15:24:13 +00:00
Bernardo Damele
9ed0744510
Added some error messages to detect back-end DBMS
2010-01-30 22:24:20 +00:00
Bernardo Damele
267cf5dd1a
Updated documentation
2010-01-30 00:08:10 +00:00
Bernardo Damele
7b8316728c
Major bug fix in takeover functionalities on Microsoft SQL Server
2010-01-29 00:09:05 +00:00
Bernardo Damele
c6cae7da41
Updated changelog
2010-01-28 23:10:54 +00:00
Bernardo Damele
b4ce8fe361
Updated ChangeLog file
2010-01-18 15:43:06 +00:00
Bernardo Damele
070ccc30e9
Added automatic support in --os-pwn to use the web uploader/backdoor to upload and execute the Metasploit payload stager when stacked queries SQL injection is not supported, for instance on MySQL/PHP and MySQL/ASP.
...
Updated ChangeLog.
Major code refactoring.
2010-01-14 14:03:16 +00:00
Bernardo Damele
055b14a11a
Updated Changelog
2010-01-13 12:14:29 +00:00
Bernardo Damele
473024bd6e
Newline
2010-01-04 14:03:31 +00:00
Miroslav Stampar
6319eb6e5c
just added PGP Key ID
2010-01-04 13:08:40 +00:00
Bernardo Damele
232f927dd0
Slightly updated the documentation
2010-01-04 12:53:58 +00:00
Bernardo Damele
d5b1863dec
Updated documentation and svn properties
2010-01-02 02:07:28 +00:00
Bernardo Damele
c1c14dabd9
Minor bug fix
2009-12-21 11:21:18 +00:00
Bernardo Damele
e6c4154cac
Fixed minor bug in --reg-del
2009-12-21 11:04:54 +00:00
Bernardo Damele
e4e081cdc6
sqlmap 0.8-rc2: minor enhancement based on msfencode 3.3.3-dev -t exe-small so that also PostgreSQL supports again the out-of-band via Metasploit payload stager optionally to shellcode execution in-memory via sys_bineval() UDF. Speed up OOB connect back. Cleanup target file system after --os-pwn too. Minor bug fix to correctly forge file system paths with os.path.join() all around. Minor code refactoring and user's manual update.
2009-12-17 22:04:01 +00:00
Bernardo Damele
c332c72808
Minor update to user's manual to reflect new Metasploit release
2009-11-17 23:36:18 +00:00
Bernardo Damele
aa14bea051
Test again
2009-11-01 12:30:30 +00:00
Bernardo Damele
e518ae82e4
Testing post-commit hook on redmine
2009-11-01 12:28:33 +00:00
Bernardo Damele
bfd8128693
Updated name
2009-11-01 12:10:29 +00:00
Bernardo Damele
de68a499f5
Typo fix
2009-11-01 12:08:46 +00:00
Bernardo Damele
bb123b2769
Updated changelog
2009-10-23 10:20:47 +00:00
Bernardo Damele
f1a7d095aa
Minor patch to make the PHP web backdoor work also on Windows
2009-10-22 16:25:19 +00:00
Bernardo Damele
89c43893d4
Merged back from personal branch to trunk (svn merge -r846:940 ...)
...
Changes:
* Major enhancement to the Microsoft SQL Server stored procedure
heap-based buffer overflow exploit (--os-bof) to automatically bypass
DEP memory protection.
* Added support for MySQL and PostgreSQL to execute Metasploit shellcode
via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an
option instead of uploading the standalone payload stager executable.
* Added options for MySQL, PostgreSQL and Microsoft SQL Server to
read/add/delete Windows registry keys.
* Added options for MySQL and PostgreSQL to inject custom user-defined
functions.
* Added support for --first and --last so the user now has even more
granularity in what to enumerate in the query output.
* Minor enhancement to save the session by default in
'output/hostname/session' file if -s option is not specified.
* Minor improvement to automatically remove sqlmap created temporary
files from the DBMS underlying file system.
* Minor bugs fixed.
* Major code refactoring.
2009-09-25 23:03:45 +00:00
Bernardo Damele
458d59416c
Minor bug fix in MSSQL version fingerprint
2009-08-11 09:16:20 +00:00
Bernardo Damele
14578a7a4d
Updated THANKS file
2009-07-30 12:02:34 +00:00
Bernardo Damele
e608a5ca55
Updated THANKS file
2009-07-29 10:44:56 +00:00
Bernardo Damele
2c98c11e80
user's manual PDF recreated
2009-07-25 16:46:30 +00:00
Bernardo Damele
45e3ce798f
Updated documentation with all new features introduced since sqlmap 0.7-rc1
2009-07-25 14:31:44 +00:00
Bernardo Damele
576cc97742
Minor update to the user's manual, almost there to release 0.7 stable!
2009-07-25 00:25:59 +00:00
Bernardo Damele
b2b2ec8a26
Preparing to release sqlmap 0.7 stable
2009-07-24 23:20:57 +00:00
Bernardo Damele
24a3a23159
Minor bug fix to --dbms, updated user's manual
2009-07-09 11:05:24 +00:00
Bernardo Damele
bc31bd1dd9
Minor bug fix
2009-06-29 10:13:39 +00:00
Bernardo Damele
fd7de4bbb8
Updated THANKS file
2009-06-24 13:57:50 +00:00
Bernardo Damele
cfd8a83655
Minor adjustment to get also the port when parsing burp logs
2009-06-04 14:36:31 +00:00
Bernardo Damele
81d1a767ac
Minor bug fix in output manager (dumper) object
2009-05-20 13:56:23 +00:00
Bernardo Damele
37d3b3adda
Updated THANKS
2009-05-20 09:58:22 +00:00
Bernardo Damele
f7ee4d578e
Updated THANKS file
2009-05-19 15:56:30 +00:00
Bernardo Damele
e8c115500d
Now it works also on Mac OS X
2009-04-30 10:46:50 +00:00
Bernardo Damele
16b4530bbe
Minor bug fixes to --os-shell (altought web backdoor functionality still to be reviewed).
...
Minor common library code refactoring.
Code cleanup.
Set back the default User-Agent to sqlmap for comparison algorithm reasons.
Updated THANKS.
2009-04-27 23:05:11 +00:00
Bernardo Damele
69259c5984
Updated THANKS
2009-04-23 08:42:57 +00:00
Bernardo Damele
8c0ac767f4
Updated to sqlmap 0.7 release candidate 1
2009-04-22 11:48:07 +00:00
Bernardo Damele
207e96e2b2
Major bug fix in the comparison algorithm to correctly handle also the
...
case that the url is stable and the False response changes the page
content very little.
2009-02-09 10:28:03 +00:00
Bernardo Damele
c405fb51ab
PDF regenerated
2009-02-04 16:32:06 +00:00
Bernardo Damele
b12d955274
Updated packaging scripts, site and finalized the documentation to release version 0.6.4
2009-02-03 15:38:40 +00:00
Bernardo Damele
770e000cb4
Fixed another bug on Microsoft SQL Server custom "limited" query reported by Konrads Smelkovs
2009-02-02 23:44:19 +00:00
Bernardo Damele
9ab174a444
Almost ready with the user's manual for 0.6.4 release
2009-02-01 13:44:44 +00:00
Bernardo Damele
77d9d22ceb
Minor update to the user's manual
2009-02-01 00:20:08 +00:00
Bernardo Damele
6054090191
sqlmap 0.6-rc5: major bug fix to make --sql-shell and --sql-query work properly also with mixed case statements (i.e oRDeR bY). Thanks Konrads Smelkovs to notifying.
2009-01-28 14:53:11 +00:00
Bernardo Damele
a8d57bb031
Avoid DeprecationWarning with Python 2.6+
2009-01-22 23:53:01 +00:00
Bernardo Damele
193482a62b
Updated user's manual
2009-01-22 23:44:44 +00:00
Bernardo Damele
981c7a4428
Updated Microsoft SQL Server XML signature db
2009-01-22 22:30:45 +00:00
Bernardo Damele
7adbf5892d
Updated user's manual
2009-01-19 23:45:54 +00:00
Bernardo Damele
8f973ce574
Minor layout adjustments
2009-01-18 22:36:48 +00:00
Bernardo Damele
bc3b4c6936
Minor layout adjustments in the user's manual
2009-01-13 23:16:34 +00:00
Bernardo Damele
9c125a2b57
Minor improvement to use Python ConfigParser library when --save if specified.
...
Minor update to the user's manual
2009-01-03 22:59:22 +00:00
Bernardo Damele
6ff8feb5cf
Updated documentation
2009-01-03 01:25:43 +00:00
Bernardo Damele
c1010c20d8
Minor adjustments
2008-12-30 21:24:01 +00:00
Bernardo Damele
0e9873fd4f
Preparing documentation for 0.6.4
2008-12-29 18:44:20 +00:00
Bernardo Damele
b0ad102efb
Better fingerprint technique for Microsoft SQL Server
2008-12-22 23:32:43 +00:00
Bernardo Damele
64bb57d786
Minor bug fix to make the Partial UNION query SQL injection technique
...
work properly also on Oracle and Microsoft SQL Server.
2008-12-22 22:48:44 +00:00
Bernardo Damele
4ae464c80d
Minor enhancement to support an option (--union-tech) to specify the
...
technique to use to detect the number of columns used in the web
application SELECT statement: NULL bruteforcing (default) or ORDER BY
clause.
2008-12-21 21:39:53 +00:00
Bernardo Damele
374b9ba878
Updated documentation based upon recent developments
2008-12-21 16:35:45 +00:00
Bernardo Damele
7e8ac16245
Added preventive check for stacked queries support when executing DDL,
...
DML & co. statements in SQL query and SQL shell. Minor improvements on
this new feature.
Increased default connection timeout to 30 seconds (needed for vmware
machine not correctly synched).
2008-12-19 20:48:33 +00:00
Bernardo Damele
ad228e6947
Ahead with the improvements to the comparison algorithm.
...
Added support internally to forge CASE statements, used only by
--is-dba query at the moment.
Allow DDL, DML (INSERT, UPDATE, etc.) from user in SQL query and
SQL shell.
Minor code adjustments.
2008-12-19 20:09:46 +00:00
Bernardo Damele
3fe493b63d
Minor enhancement to support an option (--is-dba) to show if the
...
current user is a database management system administrator.
2008-12-18 20:41:11 +00:00
Bernardo Damele
c32ef9d751
Major bug fix to avoid tracebacks when multiple targets are specified and one
...
of them is not reachable.
Minor bug fix to make the --postfix work even if --prefix is not provided.
2008-12-18 20:38:57 +00:00
Bernardo Damele
2efb3ae2ba
Documentation updated, now ready for 0.6.3 release
2008-12-17 23:26:14 +00:00
Bernardo Damele
bb9079aa9d
Minor documentation adjustments
2008-12-17 20:58:19 +00:00
Bernardo Damele
94c79e3209
Updated documentation
2008-12-17 20:17:34 +00:00
Bernardo Damele
ec11f502df
Site and documentation updated, ready to release 0.6.3 in two days
2008-12-17 00:19:01 +00:00
Bernardo Damele
36d9ede001
Updated documentation, ready for sqlmap 0.6.3 release
2008-12-16 23:52:16 +00:00
Bernardo Damele
2b0ec1868d
Updated documentation
2008-12-16 21:31:15 +00:00
Bernardo Damele
bf2a857b9a
Minor adjustments and minor bug fixes. Documentation almost complete for sqlmap 0.6.3.
2008-12-12 19:06:31 +00:00
Bernardo Damele
072eb7154c
Major enhancement to support Partial UNION query SQL injection technique too.
...
Minor code cleanup.
2008-12-10 17:23:07 +00:00
Bernardo Damele
9dbad512f1
sqlmap 0.6.3-rc4: minor enhancement to be able to specify extra HTTP headers
...
by providing option --headers. By default Accept, Accept-Language and
Accept-Charset headers are set.
Added support to get the injection payload prefix and postfix from user.
Minor bug fix to exclude image files when parsing (-l) proxies log files.
Minor code adjustments.
Updated documentation.
2008-12-08 21:24:24 +00:00
