Miroslav Stampar
31230c5a42
Minor fix
2013-02-05 11:23:22 +01:00
Miroslav Stampar
87ad96bf01
Minor cosmetic fix
2013-02-05 11:18:46 +01:00
Miroslav Stampar
7e1ff1bb8e
Same refactoring as the last commit
2013-02-04 15:26:44 +01:00
Miroslav Stampar
0cc6e68be2
Refactoring MySQL fingeprint.py (those payloads are now stored into session file too)
2013-02-04 15:12:03 +01:00
Miroslav Stampar
81d4f9f7d1
Bug fix for last regression test (--search related)
2013-01-31 16:41:23 +01:00
Miroslav Stampar
6b6e36b2ec
Continuation of work on fixing DISTINCT/--search issues (Oracle)
2013-01-30 18:08:34 +01:00
Miroslav Stampar
838e98192e
Consistency update (we are not using DISTINCT in inband counterparts too)
2013-01-30 17:25:36 +01:00
Miroslav Stampar
93c59c7277
Fix for a --privileges --technique=B --dbms=Oracle (when one user has no privileges everything is foobared)
2013-01-30 16:41:57 +01:00
Miroslav Stampar
95998e3989
Implementing undocumented way how to retrieve w+ temporary directory name on MsSQL (suggested by Vlado Velichkovski)
2013-01-30 14:38:21 +01:00
Miroslav Stampar
6005046280
Bug fix (--dbms=mysql --tables -D testdb --exclude-sysdbs --technique=E was not working)
2013-01-30 11:36:04 +01:00
Miroslav Stampar
f41460f8d8
Better naming
2013-01-29 20:53:11 +01:00
Miroslav Stampar
7e73825ece
Minor cosmetics
2013-01-29 15:34:41 +01:00
Miroslav Stampar
adfb862cd5
Trivial style update
2013-01-24 15:12:52 +01:00
Miroslav Stampar
c83f468a37
Trivial changes
2013-01-23 15:34:20 +01:00
Miroslav Stampar
9825e247db
Refactoring search module
2013-01-23 14:22:35 +01:00
Bernardo Damele
ff160abf10
minor bug fix
2013-01-23 13:02:02 +00:00
Bernardo Damele
45af22872a
fixes #370 (the bug was introduced with commit edb977a74e)#
2013-01-23 13:00:58 +00:00
Bernardo Damele
f4028bd7d2
minor adjustment
2013-01-23 02:10:38 +00:00
Bernardo Damele
d8a0e7eacb
fixes #187
2013-01-23 01:27:01 +00:00
Bernardo Damele
5635776173
proper SQLite 2 library
2013-01-22 18:56:25 +00:00
Bernardo Damele
bd7fd862b0
forgot import
2013-01-22 10:16:18 +00:00
Bernardo Damele
edb977a74e
bug fix so that if search fails with union/error and blind techniques are available, it falls back to them (like any other enumeration switch) and minor bug fix so that in search mode, the provided table name to search is upped
2013-01-22 10:14:35 +00:00
Bernardo Damele
11413a0f03
added Firebird search test cases
2013-01-22 10:04:17 +00:00
Bernardo Damele
e23340f002
added support for search for tables on Firebird (issue #365 )
2013-01-22 09:53:05 +00:00
Bernardo Damele
e9dea8d394
no need to raise an exception if one enumeration fails
2013-01-21 17:11:46 +00:00
Miroslav Stampar
f9d330ec98
Fix for that Firebird column data types issue (tec=EU)
2013-01-21 17:20:46 +01:00
Miroslav Stampar
457217f2d3
Fix for an Issue #356
2013-01-21 16:46:48 +01:00
Miroslav Stampar
65c55a6a49
Fix for escaping single quote character(s)
2013-01-21 11:21:41 +01:00
Miroslav Stampar
069c6acabd
Another update for an Issue #362
2013-01-20 22:47:26 +01:00
Miroslav Stampar
a7028af2e9
Patch for an Issue #362 (more work required)
2013-01-20 22:16:34 +01:00
Miroslav Stampar
b4a55a809e
Refactoring DBMS string escaping functions
2013-01-20 13:45:58 +01:00
Bernardo Damele
6f61fc04f1
minor bug fix
2013-01-20 01:22:25 +00:00
Bernardo Damele
adf97e630f
add possibility to provide a list of web server document root possible directories for web shell upload in --os-cmd and --os-shell for MySQL
2013-01-19 18:04:33 +00:00
Bernardo Damele
32a12c7e2b
handle exception reported in issue #359
2013-01-19 00:24:15 +00:00
Bernardo Damele
d1acdee9c4
fixed --count for DBMSes that are single-database
2013-01-18 23:07:16 +00:00
Bernardo Damele
8748cceff3
no point enumerating current database for --count on some DBMSes
2013-01-18 23:04:28 +00:00
Bernardo Damele
a390c48692
code refactoring
2013-01-18 23:04:01 +00:00
Bernardo Damele
a4b0b98f8f
aligned Firebird to recent DB2 string escaping syntax fix
2013-01-18 22:57:57 +00:00
Bernardo Damele
4526e31485
bug fix for Firebird fingerprint (issue #357 )
2013-01-18 22:32:58 +00:00
Bernardo Damele
b80e195c78
bug fix for #355
2013-01-18 22:10:10 +00:00
Bernardo Damele
f3d7be9200
more adjustments for #353
2013-01-18 20:44:56 +00:00
Bernardo Damele
2550bbc05e
fix for #353
2013-01-18 20:40:38 +00:00
Bernardo Damele
f49657eacc
minor fix to previous commit
2013-01-18 15:10:34 +00:00
Miroslav Stampar
601eb1e49a
Unescaping is renamed to escaping
2013-01-18 15:40:37 +01:00
Bernardo Damele
a43202f3c0
updated copyright
2013-01-18 14:07:51 +00:00
Miroslav Stampar
aa467cb54c
Merge branch 'master' of github.com:sqlmapproject/sqlmap
2013-01-18 11:31:25 +01:00
Miroslav Stampar
e7576a3b11
Better naming
2013-01-18 11:21:23 +01:00
Miroslav Stampar
caae773b2d
Minor removal of redundant code
2013-01-18 10:44:57 +01:00
Bernardo Damele
a92ae93847
minor bug fix to properly identify if user is admin on Oracle across all techniques
2013-01-18 09:22:53 +00:00
Bernardo Damele
d1b91790f5
fixed --count on DB2
2013-01-17 22:13:59 +00:00
Bernardo Damele
5225375048
proper fix
2013-01-17 22:04:21 +00:00
Bernardo Damele
d2d3878de1
typo fix
2013-01-17 21:58:53 +00:00
Bernardo Damele
a5e9168993
minor fix because boolean-based blind on DB2 is a little bit different from other DBMSes
2013-01-17 21:58:15 +00:00
Miroslav Stampar
14b7e655a9
Minor refactoring
2013-01-16 16:33:04 +01:00
Bernardo Damele
404ecbcaec
typo fix
2013-01-15 17:14:58 +00:00
Miroslav Stampar
7a1d484115
Implementation for an Issue #340
2013-01-15 16:05:33 +01:00
Bernardo Damele
413b5e7ab4
fixed error message
2013-01-14 16:49:05 +00:00
Bernardo Damele
e555c2be30
added support for --search -T for SQLite
2013-01-14 16:26:11 +00:00
Bernardo Damele
e835a2af9a
minor bug fix
2013-01-14 13:43:03 +00:00
Bernardo Damele
279f6cb9ce
minor bug fix for PostgreSQL --file-read
2013-01-14 12:22:15 +00:00
Bernardo Damele
146d9fedf0
fix for bug #337
2013-01-14 10:24:45 +00:00
Bernardo Damele
675e4a026b
Merge branch 'master' of github.com:sqlmapproject/sqlmap
2013-01-11 13:31:49 +00:00
Bernardo Damele
2a2d7e886d
align to MSSQL connector
2013-01-11 10:52:03 +00:00
Miroslav Stampar
bc4d8d3e02
Implementation for an Issue #332
2013-01-11 11:17:41 +01:00
Miroslav Stampar
ec4e49d771
Minor refactoring
2013-01-10 16:09:28 +01:00
Miroslav Stampar
da7f63f125
cx_Oracle.DatabaseError is an ancestor of cx_Oracle.InternalError
2013-01-10 15:33:32 +01:00
Miroslav Stampar
934d41dac2
Minor style update (PEP8)
2013-01-10 15:02:28 +01:00
Miroslav Stampar
ca3d35a878
Some PEP8 related style cleaning
2013-01-10 13:18:44 +01:00
Miroslav Stampar
6cfa9cb0b3
Removing unused imports
2013-01-10 12:15:12 +01:00
Miroslav Stampar
ca1c0c2a1d
Minor style update
2013-01-10 11:54:07 +01:00
Miroslav Stampar
ebde4b190e
Minor update
2013-01-10 11:42:37 +01:00
Miroslav Stampar
25f01a419f
Minor style update (for the sake of consistency over the code and our PEP8 adaptation)
2013-01-09 15:38:41 +01:00
Miroslav Stampar
55a552ddc4
Update for an Issue #24
2013-01-08 10:55:25 +01:00
Miroslav Stampar
ad85c4c964
Minor refactoring for an Issue #295
2013-01-08 10:23:02 +01:00
Bernardo Damele
8ee840bc8e
maintained release is on Google code
2013-01-07 17:11:14 +00:00
Miroslav Stampar
46e2ad53cd
Fix for an Issue #331
2013-01-07 16:36:29 +01:00
Miroslav Stampar
ac407ae4a1
Implementation for an Issue #295
2013-01-07 15:55:40 +01:00
Miroslav Stampar
6270e9337b
Minor cosmetics
2013-01-07 14:34:20 +01:00
Miroslav Stampar
5b77b20e2e
Removing trailing whitespaces (PEP8)
2013-01-03 23:57:07 +01:00
Miroslav Stampar
1712603dce
Replacing deprecated has_key() with operator in (PEP8)
2013-01-03 23:28:07 +01:00
Miroslav Stampar
e4a3c015e5
Replacing old and deprecated raise Exception style (PEP8)
2013-01-03 23:20:55 +01:00
Miroslav Stampar
8b7cbe03b0
Replacing CRLF with LF in rest of files
2012-12-26 17:12:17 +01:00
Miroslav Stampar
a77b7f00d9
Fix for an Issue #323
2012-12-23 19:34:35 +01:00
Miroslav Stampar
2fc187489b
Removing leftover
2012-12-21 14:01:59 +01:00
Miroslav Stampar
35728fa443
Fix (and some hidden bug fixes/improvements) regarding an Issue #317
2012-12-21 10:51:35 +01:00
Miroslav Stampar
0f62e677b5
Minor just in case commit (plural/singular unArrayize())
2012-12-21 10:15:42 +01:00
Miroslav Stampar
18f4a916ea
Minor fix
2012-12-20 14:58:26 +01:00
Bernardo Damele
cefb03c835
fixed bug related to issue #223
2012-12-19 14:12:09 +00:00
Bernardo Damele
4f0f729982
be more specific in standard output message as to whether or not the read file is same as remote file
2012-12-19 13:42:56 +00:00
Bernardo Damele
9b422e1e94
minor fix for issue #309
2012-12-19 09:37:29 +00:00
Bernardo Damele
738dbde16c
avoid displaying "do you want to dump" message if no searched columns have been found
2012-12-18 18:07:34 +00:00
Bernardo Damele
326ed33f31
added support for comma separated list of files for --file-read - fixes issue #223
2012-12-18 17:55:21 +00:00
Bernardo Damele
8d9aa2c384
minor refactoring, added possibility to compare the remote file and downloaded file (--file-read), prepping for #223
2012-12-18 17:49:18 +00:00
Bernardo Damele
9a1eca20b5
lowered gravity
2012-12-18 16:42:03 +00:00
Bernardo Damele
d1d99d930b
proper fix for #306
2012-12-18 15:31:30 +00:00
Bernardo Damele
6b1dd05e62
reverted
2012-12-18 14:51:04 +00:00
Bernardo Damele
e1b7a6350e
consistency between --tables and --columns when -T and -C are respectively provided - there was a leftover from when --search called getColumns() as --columns: this is no longer the case (closes issue #306 )
2012-12-18 14:37:04 +00:00
Bernardo Damele
57412f8475
default to --search shall stay LIKE
2012-12-18 13:55:26 +00:00
Miroslav Stampar
eb23b1b1a5
Minor commit related to the last one (uniq roles/privileges)
2012-12-18 12:47:06 +01:00
Miroslav Stampar
699a0f756a
Minor fix
2012-12-18 12:43:23 +01:00
Miroslav Stampar
f56b846864
Patch for an Issue #300
2012-12-18 09:55:33 +01:00
Bernardo Damele
a00cd9b3ea
syntax fix
2012-12-17 14:13:34 +00:00
Bernardo Damele
d2bd275652
refactoring
2012-12-17 14:07:28 +00:00
Bernardo Damele
3c1cead406
WHERE condition for error-based technique for --tables with --exclude-sysdbs was logically wrong, fixed now
2012-12-17 14:06:12 +00:00
Bernardo Damele
eb44f30d63
minor layout output fix
2012-12-17 13:51:46 +00:00
Miroslav Stampar
cb13735788
Fix for an Issue #294
2012-12-11 12:14:33 +01:00
Miroslav Stampar
9e38ccbc3d
Removing unused imports
2012-12-10 17:47:42 +01:00
Miroslav Stampar
ed1b5d0ada
Minor fix
2012-12-07 10:57:57 +01:00
Miroslav Stampar
b5c8707323
Infinite loop fix when 'SELECT DB_NAME(...)' method used for --dbs in MsSQL
2012-12-06 15:55:33 +01:00
Miroslav Stampar
974407396e
Doing some more style updating (capitalization of exception classes; using _ is enough for private members - __ is used in Python specific methods)
2012-12-06 14:14:19 +01:00
Miroslav Stampar
ab67344448
Removed unused imports and variables (pyflake-ing)
2012-12-06 11:15:05 +01:00
Miroslav Stampar
0f191f624c
Taking some goodies from Pull request #284
2012-12-06 10:21:53 +01:00
Miroslav Stampar
775e0df04b
Update for an Issue #278
2012-12-05 10:45:17 +01:00
Miroslav Stampar
d4b5133df7
Update for an Issue #272
2012-12-04 17:04:32 +01:00
Miroslav Stampar
b250b68231
Bug fix (--users was returning only 1 value because of this bug; probably introduced by mistake months ago)
2012-11-29 12:02:59 +01:00
Miroslav Stampar
ed40f18796
Minor fix
2012-11-26 14:59:44 +01:00
Miroslav Stampar
c1b8226329
Massive renaming (proper naming is inband = union & error techniques! - query naming stays as they are/in code things like forgeInbandQuery are renamed to forgeUnionQuery)
2012-10-28 00:36:09 +02:00
Miroslav Stampar
a435ba6863
Minor fix
2012-10-28 00:19:00 +02:00
Miroslav Stampar
0aeb9dbe8b
Bug fix (in --dump mode if error/inband failed with None other techniques were ignored)
2012-10-27 23:42:52 +02:00
Miroslav Stampar
06805b27f2
Bug fix (time was also meant to be disabled in case of error/inband getvalues)
2012-10-27 23:16:25 +02:00
Miroslav Stampar
ba55bed008
More general approach for PostgreSQL concatenation operator precedence problem (Issue #219 )
2012-10-25 10:41:16 +02:00
Miroslav Stampar
54fbb22ab8
Minor refactoring
2012-10-25 09:56:36 +02:00
Miroslav Stampar
c2058dfc8f
Fix for an Issue #220
2012-10-25 09:42:43 +02:00
Miroslav Stampar
b7429dc6bb
Minor fix for an Issue #219
2012-10-25 00:15:59 +02:00
Miroslav Stampar
c0f57f4e90
Minor fix for an Issue #217
2012-10-24 23:43:28 +02:00
Miroslav Stampar
344ef9af7d
Language fix (in lots of cases wrong statement 'unable to retrieve columns for any table in database' was reported)
2012-10-24 23:38:35 +02:00
Miroslav Stampar
5477c9f7ba
Fix for an Issue #216
2012-10-24 22:59:46 +02:00
Miroslav Stampar
6e2fce66aa
Patch for an Issue #212
2012-10-23 15:34:59 +02:00
Miroslav Stampar
f25f5c9eeb
Minor fix
2012-10-23 10:33:30 +02:00
Miroslav Stampar
3f596cda85
Minor fix for --dump --technique=B when empty strings are returned
2012-10-22 11:49:23 +02:00
Miroslav Stampar
fb1497aa89
Minor update for Issue #209
2012-10-21 18:53:31 +02:00
Miroslav Stampar
ebe3f4c34c
Minor fix
2012-10-15 18:51:42 +02:00
Miroslav Stampar
91ea8e52b7
Minor patch for an Issue #201
2012-10-15 18:01:52 +02:00
Miroslav Stampar
e440b096c5
Fix for an Issue #202
2012-10-15 12:24:30 +02:00
Miroslav Stampar
ed2d163269
Fix for an Issue #201
2012-10-14 17:53:55 +02:00
Miroslav Stampar
f71b937add
Minor language cleanup
2012-10-04 18:28:36 +02:00
Miroslav Stampar
75990b715d
Fix for an Issue #184
2012-09-13 10:20:24 +02:00
Miroslav Stampar
959225af55
Minor fix
2012-09-10 19:28:15 +02:00
Miroslav Stampar
5c21395fe2
Minor update for an Issue #179
2012-09-10 19:26:51 +02:00
Miroslav Stampar
1f49e4ae36
Fix for an Issue #179
2012-09-10 19:23:24 +02:00
Miroslav Stampar
9a631331a5
Fix for an Issue #177
2012-09-08 20:22:13 +02:00
Miroslav Stampar
f26ea04e38
Fix for an Issue #175
2012-09-07 17:06:38 +02:00
Miroslav Stampar
1bcf5a6b88
Some more dict refactorings
2012-08-21 11:30:01 +02:00
Miroslav Stampar
01f481c332
Minor refactoring of dictionaries
2012-08-21 11:19:15 +02:00
Miroslav Stampar
4649450603
Fix for an Issue #137
2012-08-16 22:20:24 +02:00
Miroslav Stampar
74ee0ce78a
Fix for an Issue #148
2012-08-14 23:25:12 +02:00
Miroslav Stampar
b78163f99b
Update for Issue #138
2012-08-08 19:06:47 +02:00
Miroslav Stampar
20a66567a3
Minor refactoring
2012-07-30 10:06:14 +02:00
Miroslav Stampar
ffc520b35f
Minor refactoring
2012-07-24 14:35:56 +02:00
Miroslav Stampar
95e0d46e3e
Fix for an Issue #110
2012-07-21 09:15:54 +02:00
Bernardo Damele
34e77a8801
ported fix for issue #81 also to blind techniques
2012-07-21 00:20:32 +01:00
Bernardo Damele
3e21f3d07a
fixed --search -C too on MSSQL - issue #81
2012-07-21 00:08:40 +01:00
Bernardo Damele
60242f92c5
made --search -D on MSSQL consistent with other DBMSes - issue #81
2012-07-20 23:37:56 +01:00
Bernardo Damele
7f10b01265
same fix as previous commit for blind techniques
2012-07-20 22:35:20 +01:00
Bernardo Damele
b54ae107cc
major bug fix in --search with multiple -C provided
2012-07-20 22:29:48 +01:00
Bernardo Damele
45177cf93d
minor restyling
2012-07-20 22:29:30 +01:00
Bernardo Damele
16668e1b8d
leftover debug message
2012-07-20 21:48:29 +01:00
Bernardo Damele
b0ab837832
minor code refactoring and implemented issue #95
2012-07-20 21:46:36 +01:00
Bernardo Damele
9cb1c4c0d9
plugin refactoring - issue #22
2012-07-20 19:17:35 +01:00
Bernardo Damele
86df6037e3
reverted previous ugly hack for issue #110 , perhaps a better fix is possible
2012-07-20 16:01:04 +01:00
Bernardo Damele
1928d5464d
fixes issue #97
2012-07-20 15:56:14 +01:00
Bernardo Damele
52431402dd
minor fix to avoid cleanup() if web backdoor upload failed
2012-07-16 17:58:30 +01:00
Miroslav Stampar
c1a14257a4
Removing --disable... switches and making changes in default choice(s) for respectable sections
2012-07-16 11:31:51 +02:00
Bernardo Damele
bb8cd788e1
minor fix
2012-07-16 09:56:41 +01:00
Miroslav Stampar
3f4186ce2c
Removing duplicate user password hashes
2012-07-14 10:57:46 +02:00
Miroslav Stampar
6677da63cd
Fix for an Issue #88
2012-07-13 14:25:39 +02:00
Miroslav Stampar
3c81f74823
Minor style update
2012-07-13 12:22:37 +02:00
Bernardo Damele
162da75a04
modified homepage address
2012-07-12 18:38:03 +01:00
Miroslav Stampar
cba2a26b68
Finishing Issue #75 (inference dumping)
2012-07-12 14:46:57 +02:00
Miroslav Stampar
65639cdda6
First update for Issue #75 (error-based dumping)
2012-07-12 14:31:28 +02:00
Miroslav Stampar
3fd5119f3f
Redesigning for Issue #75
2012-07-12 13:42:22 +02:00
Bernardo Damele
fed178646a
minor refactoring
2012-07-12 01:48:07 +01:00
Bernardo Damele
01474f6272
proper debug message added - issue #75
2012-07-12 01:19:36 +01:00
Bernardo Damele
ee3aeb8dcf
actual implementation of issue #75 , still some work to do
2012-07-12 01:16:00 +01:00
Bernardo Damele
caeddf6822
avoid unescaping user provided queries (--sql-query, --sql-shell, --sql-file). Before it was only applied to --sql-file
2012-07-12 00:17:07 +01:00
Bernardo Damele
66d854c7d8
leftover space
2012-07-12 00:04:56 +01:00
Bernardo Damele
53c0336b48
added --hostname switch to retrieve DBMS server hostname - closes issue #69
2012-07-12 00:01:57 +01:00
Bernardo Damele
6f6cd676b7
clean up the file system from sqlmap created web files
2012-07-11 14:07:20 +01:00
Bernardo Damele
0c5f259481
var renaming
2012-07-11 13:39:33 +01:00
Miroslav Stampar
9c4a62f725
Some work on Issue #68
2012-07-11 11:58:47 +02:00
Miroslav Stampar
8caffac4bc
conf.unescape->kb.unescape
2012-07-10 10:55:04 +02:00
Bernardo Damele
4656d23d82
increased verbosity level of some messages and removed a leftover
2012-07-10 01:43:19 +01:00
Bernardo Damele
00b7411a87
more adjustments for issue #33 , of particular importance the fact that the user's provided statement from a file is never unescaped, should be ok
2012-07-10 01:39:03 +01:00
Bernardo Damele
2527554f8e
more work on #33
2012-07-10 00:53:07 +01:00
Bernardo Damele
c4af7b9aa0
initial work for issue #33
2012-07-10 00:27:08 +01:00
Bernardo Damele
25eca9d671
finally got this working on MSSQL 2005: commands can now be executed as another user (BULK INSERT must be used in such case, see comments in the code) - issue #34
2012-07-09 14:26:23 +01:00
Miroslav Stampar
86c27cc4f2
Merge branch 'master' of github.com:sqlmapproject/sqlmap
2012-07-06 17:28:13 +02:00
Miroslav Stampar
e948e4d45b
Some more refactoring
2012-07-06 17:18:22 +02:00
Bernardo Damele
e673033ac1
minor layout adjustment
2012-07-06 15:26:45 +01:00
Bernardo Damele
fb7fe552b7
proper naming
2012-07-06 15:13:50 +01:00
Miroslav Stampar
6a05e3fd79
Fix for Issue #61
2012-07-06 14:24:44 +02:00
Miroslav Stampar
27fdccc858
Update for Issue #55 (falling back to SELECT DB_NAME(N))
2012-07-03 20:15:17 +02:00
Bernardo Damele
ab412da27f
I am back on stage and here to stay!!! to start.. a removal of confirm switch which masked cases where file write operations failed when set to False automatically, now at least it asks the user and defaults to Yes
2012-07-01 23:25:05 +01:00
Miroslav Stampar
e51d3a02f1
Update for Issue #43 (renamed --disable-cracking to --disable-hash)
2012-06-28 18:53:47 +02:00
Miroslav Stampar
c8bac658f3
Fix for Issue #43
2012-06-28 18:47:55 +02:00
jekil
c39e5a85ba
Removed $id$ tags
2012-06-27 20:56:43 +02:00
Miroslav Stampar
303aa10507
only a small update
2012-06-27 14:43:18 +02:00
Miroslav Stampar
06be7bbb18
few just in case fixes (unarrayizeValue in dumpTable entries) and and some refactoring (unique is now not done for every union case but only if detected that there are duplicates in union test)
2012-06-15 20:41:53 +00:00
Miroslav Stampar
d5e80089ff
minor summer cleanup
2012-06-14 13:44:16 +00:00
Miroslav Stampar
3a90105fbb
minor refactoring
2012-06-14 13:38:53 +00:00
Miroslav Stampar
96177393e1
minor update regarding --exact switch
2012-06-10 13:38:12 +00:00
Miroslav Stampar
10b0639a96
making a "--exact" switch on demand (choosing exact identifier names by default instead of LIKE)
2012-06-04 09:24:46 +00:00
Miroslav Stampar
3f6bc1f3c2
minor fix
2012-05-24 18:05:33 +00:00
Miroslav Stampar
1e18168cc8
fix for one silent bug and small language update
2012-05-23 16:35:40 +00:00
Miroslav Stampar
0e8d8577a7
adding a DB2 patch from smcintyre@securestate.com
2012-05-21 08:26:19 +00:00
Miroslav Stampar
079e0e1434
minor bug fix
2012-05-18 08:51:50 +00:00
Miroslav Stampar
96299d3d5d
minor refactoring
2012-05-03 22:34:18 +00:00
Miroslav Stampar
8013a64f8c
minor refactoring
2012-05-01 19:57:30 +00:00
Miroslav Stampar
c71d435d9f
making "id"-like columns prioritized for ORDER BY in MySQL
2012-05-01 19:52:02 +00:00
Miroslav Stampar
458a73c9b4
few consistency fixes
2012-04-29 23:09:00 +00:00
Miroslav Stampar
c7a606637f
switching few readInput defaults for brute forcing when no table/column found
2012-04-27 12:59:22 +00:00
Bernardo Damele
4da03d898e
Added support to create files with a visual basic script - no longer reliant on debug.exe so works on Windows 64-bit too. Fixes #236
2012-04-25 07:40:42 +00:00
Bernardo Damele
6116853025
Minor layout adjustments
2012-04-24 17:01:24 +00:00
Bernardo Damele
072e08836f
Falling back to unionReadFile() when --file-read does not work against MySQL. This happens when the session user does not have INSERT privilege, required to run LOAD DATA INFILE
2012-04-19 14:05:45 +00:00
Miroslav Stampar
5e358b51f9
few fixes related to bug report by Shadow Folder (AttributeError: 'list' object has no attribute 'isdigit')
2012-04-04 09:25:05 +00:00
Miroslav Stampar
b0787f193c
getting rid of obsolete getCompiledRegex (in newer versions of Python regexes are already cached)
2012-04-03 14:34:15 +00:00
Miroslav Stampar
886aa22efc
minor update
2012-04-03 12:19:37 +00:00
Miroslav Stampar
f7a664b120
enablind DNS server for DNS data exfiltration
2012-03-31 12:08:27 +00:00
Miroslav Stampar
645fc8a21c
minor refactoring
2012-03-27 08:31:48 +00:00
Miroslav Stampar
72c5b034bf
minor update
2012-03-19 11:50:38 +00:00
Miroslav Stampar
cb8caf7e0f
i am not very bright today :)
2012-03-19 11:23:23 +00:00
Miroslav Stampar
d5915e5d44
one other fix
2012-03-19 11:19:26 +00:00
Miroslav Stampar
7abfa2e6d4
minor fix
2012-03-19 11:18:00 +00:00
Miroslav Stampar
cce5c3c009
minor changes for version numbers
2012-03-19 11:07:03 +00:00
Bernardo Damele
48e8c978fb
Minor fix, way more to do for --search -C for MSSQL
2012-03-15 17:55:49 +00:00
Bernardo Damele
0013b0970f
Minor layout adjustments - foundDb is misleading at that stage
2012-03-15 16:07:16 +00:00
Miroslav Stampar
8cf5d260fd
Application Data is not a temporary directory writable by everybody
2012-03-14 23:44:29 +00:00
Bernardo Damele
c735d846ee
The default temporary directory as to stay as is, do not touch this code snippet anymore please
2012-03-14 22:39:46 +00:00
Miroslav Stampar
ca0d068575
distinguishing NULL from BLANK
2012-03-14 13:52:23 +00:00
Miroslav Stampar
1d0c8a7f44
minor update
2012-03-12 15:19:02 +00:00
Bernardo Damele
48592f2515
minor adjustments
2012-03-09 18:34:18 +00:00
Bernardo Damele
be9b103b51
minor bug fix
2012-03-09 18:02:50 +00:00
Bernardo Damele
012fc21b49
Improvements to column(s) search: now it's possible to search column(s) in provided table(s) across all databases, search column(s) across all tables in provided database(s) or let sqlmap alone identify the databases' tables - this is now implemented for error-based, union query and direct connection. Work is still required for boolean-based and time-based.
...
Adapted the queries.xml file accordingly
2012-03-09 17:47:50 +00:00
Miroslav Stampar
c878dd3e5a
doing a dummy test for --os-shell in case of xp_cmdshell
2012-03-09 14:21:41 +00:00
Bernardo Damele
d9e499af9f
Set Id property
2012-03-09 12:05:21 +00:00
Bernardo Damele
7330dff255
Minor bug fix for --search -C so that now if not columns are found (with criteria specified, e.g. -D testdb -T testtable), it won't ask to dump for the entries
2012-03-08 16:57:53 +00:00
Miroslav Stampar
e678219a8c
minor update
2012-03-08 15:51:30 +00:00
Bernardo Damele
ae87df5670
leftover
2012-03-08 15:45:33 +00:00
Bernardo Damele
4bc6f3f6c9
Minor bug fix so that --search -T tablename -D db1,db2 now correctly forges the query concatenating db1 and db2 with a OR, not an AND anymore
2012-03-08 15:32:05 +00:00
Miroslav Stampar
68b9d48d0a
minor update
2012-03-08 15:30:23 +00:00
Miroslav Stampar
2ab80bfb2c
minor bug fix
2012-03-08 15:24:05 +00:00
Bernardo Damele
c79807f5fb
Minor layout adjustments
2012-03-08 15:11:24 +00:00
Miroslav Stampar
761ec7529a
minor appereance fix
2012-03-01 11:52:30 +00:00
Miroslav Stampar
8b9c5c66cc
code refactoring regarding charsetType inside inference/bisection
2012-02-29 14:36:23 +00:00
Miroslav Stampar
10dd9096f7
one more just in case fix for safeSQLIdentificator naming on MSSQL --tables
2012-02-29 14:05:53 +00:00
Miroslav Stampar
d06182347f
fixing few potential problems
2012-02-29 13:56:40 +00:00
Miroslav Stampar
74b19a0386
minor update
2012-02-25 10:43:10 +00:00
Miroslav Stampar
26b33154ab
optimal fix related to the last commit
2012-02-24 14:28:41 +00:00
Miroslav Stampar
9d6fd2e507
bug fix for --schema --technique=BST
2012-02-24 14:12:19 +00:00
Miroslav Stampar
f9d2971474
minor just in case fix
2012-02-23 16:37:06 +00:00
Miroslav Stampar
6e54cb171f
minor code restyling
2012-02-22 15:53:36 +00:00
Miroslav Stampar
61a25418a9
minor update
2012-02-22 10:45:10 +00:00
Miroslav Stampar
b3bd4144f5
removing of unused imports together with some general code refactoring
2012-02-22 10:40:11 +00:00
Bernardo Damele
f55ad46119
Use %TEMP% environment variable as temporary directory (--tmp-path overwrites this btw) folder with direct connection (-d). Via SQL injection, env variables do not work apparently
2012-02-20 11:06:55 +00:00
Miroslav Stampar
08bf8c201f
few minor fixes
2012-02-20 10:24:55 +00:00
Bernardo Damele
121148f27f
There was no point relying on a support table (sqlmapoutput) to get the stdout of executed OS commands when using direct connection (-d) and it saves also number of requests.
...
Also, BULK INSERT apparently does not work on MSSQL when running as Network Service (at least on Windows XP) so one more reason to avoid using support table.
Minor fix also to threat MSSQL's EXEC statements as SELECT ones
2012-02-17 15:54:49 +00:00
Bernardo Damele
ebd40b3933
Minor bug fix to make --file-read and --os-bof syntactically work also with -d (direct connection)
2012-02-17 15:16:05 +00:00
Miroslav Stampar
dcf7277a0f
some more refactorings
2012-02-16 14:42:28 +00:00
Miroslav Stampar
e1f86c97c4
minor refactoring
2012-02-16 09:46:41 +00:00
Miroslav Stampar
7bca926a0b
fixes, updates, patches
2012-02-09 10:16:58 +00:00
Miroslav Stampar
948cf25de4
more consistent
2012-02-09 09:53:40 +00:00
Miroslav Stampar
980367b7b2
minor update
2012-02-09 09:48:47 +00:00
Miroslav Stampar
1d4b10dbd1
bug fix
2012-02-08 13:55:50 +00:00
Miroslav Stampar
2662fe84f7
minor update
2012-02-08 12:02:50 +00:00
Miroslav Stampar
85a4ef6593
minor update
2012-02-08 12:00:03 +00:00
Miroslav Stampar
f7bf1fbe94
upgrade/fixes for direct DBMS access
2012-02-07 10:46:55 +00:00
Miroslav Stampar
e94f86a1ad
minor update
2012-02-03 15:46:28 +00:00
Miroslav Stampar
22f4d5650f
fix for retrieving version of backend OS on MSSQL
2012-02-03 15:42:36 +00:00
Miroslav Stampar
a48fc4efec
minor update
2012-02-03 15:32:23 +00:00
Miroslav Stampar
e3466fa5d8
minor update
2012-02-03 15:28:11 +00:00
Miroslav Stampar
2136b3447d
better solution
2012-02-03 15:22:21 +00:00
Miroslav Stampar
f86c365694
added one more failsafe for MSSQL --tables
2012-02-03 10:56:39 +00:00
Miroslav Stampar
a6c2fc7ecc
some refactoring on MSSQL support
2012-02-01 12:53:07 +00:00
Miroslav Stampar
f79d01183d
minor update
2012-02-01 09:23:52 +00:00
Miroslav Stampar
2face9799a
minor fix
2012-02-01 09:17:38 +00:00
Miroslav Stampar
7d37a650d0
minor fix
2012-01-30 14:41:17 +00:00
Miroslav Stampar
91ebadff75
minor update
2012-01-30 13:32:52 +00:00
Miroslav Stampar
d8c343a88a
minor update
2012-01-30 13:29:43 +00:00
Miroslav Stampar
f8ae0e5272
minor update
2012-01-30 13:20:33 +00:00
Miroslav Stampar
de94bee7b5
minor fix
2012-01-20 00:11:19 +00:00
Miroslav Stampar
b2dad63000
some more refactoring
2012-01-13 22:00:34 +00:00
Miroslav Stampar
8e4b8d345f
refactoring
2012-01-13 21:55:39 +00:00
Bernardo Damele
ec9cc19951
Minor bug fixes for -d
2012-01-13 21:46:21 +00:00
Bernardo Damele
5e853cae64
Minor bug fix so now when the back-end DBMS operating system is Windows 2000, it sets the temporary folder automatically to C:\WINNT\Temp - the user does not need to provide it anymore with --tmp-path C:\\WINNT\\Temp
2012-01-13 18:08:44 +00:00
Bernardo Damele
0043336620
Minor fix and removed leftover debug message
2012-01-13 17:04:59 +00:00
Bernardo Damele
b03f91437b
Minor code refactoring
2012-01-13 16:49:52 +00:00
Miroslav Stampar
accac776fe
some fixes
2012-01-13 14:10:53 +00:00
Miroslav Stampar
95f89ab63a
updating copyright date
2012-01-11 14:59:46 +00:00
Miroslav Stampar
fecdce5801
implemented --tables over information_schema for MSSQL as a failover option for BOOLEAN technique too
2012-01-09 21:09:05 +00:00
Miroslav Stampar
ff52931140
some refactoring (skipping duplicate messages in case that UNION/ERROR techniques failed and BOOLEAN/TIMED/STACKED are not available)
2012-01-07 19:30:35 +00:00
Miroslav Stampar
138b8039b3
better language
2012-01-07 17:35:53 +00:00
Miroslav Stampar
f85c5b3f4d
minor update
2012-01-06 00:23:49 +00:00
Miroslav Stampar
f412706fee
minor update for MSSQL --tables (fallback to other method)
2012-01-03 18:01:14 +00:00
Miroslav Stampar
6f5ef23f28
minor update/patch
2012-01-01 22:55:32 +00:00
Miroslav Stampar
300abc2ba2
minor update regarding unicode unescaping
2012-01-01 22:31:09 +00:00
Miroslav Stampar
6c49af090c
minor language patch
2011-12-28 14:18:17 +00:00
Miroslav Stampar
8750532c3d
minor fix
2011-12-28 14:13:36 +00:00
Miroslav Stampar
1ae413a206
some refactoring/speedup around UNION technique
2011-12-22 10:32:21 +00:00
Miroslav Stampar
526aacb640
code cleanup
2011-12-21 22:59:23 +00:00
Miroslav Stampar
41ccf88990
some more refactoring
2011-12-21 22:09:21 +00:00
Miroslav Stampar
0a039d84e0
some more refactoring
2011-12-21 19:40:42 +00:00
Miroslav Stampar
d9d4e3ea9b
minor fix
2011-12-21 17:43:50 +00:00
Miroslav Stampar
41b60b26fc
minor refactoring
2011-12-21 14:25:39 +00:00
Miroslav Stampar
81bd9a201b
minor refactoring
2011-12-21 11:50:49 +00:00
Miroslav Stampar
d1bfdc6a48
minor fix for --start/--stop mechanism in pivot dumping mode
2011-12-20 13:04:57 +00:00
Miroslav Stampar
641055144a
minor beautification
2011-12-16 11:49:20 +00:00
Miroslav Stampar
ebc04a3d5f
minor fix
2011-12-16 11:44:33 +00:00
Miroslav Stampar
7d2fce16dc
minor fix
2011-12-16 11:40:23 +00:00
Miroslav Stampar
cff21814bb
minor patch for MSSQL 2008
2011-12-16 11:23:41 +00:00
Miroslav Stampar
8793fbc9f5
minor update
2011-12-14 12:59:25 +00:00
Miroslav Stampar
39b406c5c1
fix for --search on Oracle
2011-12-02 18:13:27 +00:00
Miroslav Stampar
96aacbf945
upgrade of --search mechanism (lowest common denominator is now searched for - e.g. if -D -T and -C are given then -C is searched for in -D and -T)
2011-12-02 13:32:30 +00:00
Miroslav Stampar
9697e80013
some more optimizations
2011-11-22 10:54:29 +00:00
Miroslav Stampar
b117c40aa5
major improvement of HashDB speed in multi-threaded mode
2011-11-22 10:09:35 +00:00
Miroslav Stampar
0ce885e6e6
adding base64encode tampering script
2011-11-21 12:47:23 +00:00
Miroslav Stampar
440b7efe55
minor optimization
2011-11-20 20:14:47 +00:00
Miroslav Stampar
f574760c12
minor update
2011-10-28 13:16:22 +00:00
Miroslav Stampar
bd7da45546
minor update
2011-10-28 13:07:23 +00:00
Miroslav Stampar
f7be0ca4e2
minor fix
2011-10-28 12:49:35 +00:00
Miroslav Stampar
6c0e8b0ea8
returning alphabetically sorted database and table names
2011-10-28 12:40:59 +00:00
Miroslav Stampar
9523da7663
minor optimization
2011-10-25 13:21:01 +00:00
Miroslav Stampar
23bf52e496
minor refactoring
2011-10-24 09:55:50 +00:00
Miroslav Stampar
77e630d89e
replaced longer CHAR form of escaped MySQL strings with more compact hex form
2011-10-23 20:19:42 +00:00
Miroslav Stampar
25f0ec3597
some minor range to xrange conversion (where safe to do)
2011-10-21 22:34:27 +00:00
Miroslav Stampar
b6ccc0cc43
minor update
2011-10-18 14:35:42 +00:00
Miroslav Stampar
7f9f744b87
update regarding last commit
2011-10-12 12:37:05 +00:00
Miroslav Stampar
39e33bea99
important fix (LIMIT m,n should not be considered deterministic in column by column table dumping)
2011-10-12 12:31:47 +00:00
Miroslav Stampar
2d7d84e16b
minor fix
2011-09-25 19:42:24 +00:00
Miroslav Stampar
af94ac7f02
minor fix
2011-09-20 22:16:56 +00:00
Miroslav Stampar
9a1ac96756
bug fix
2011-09-11 17:22:27 +00:00
Miroslav Stampar
8a174248dc
fix for a bug reported by blueBoy
2011-08-20 20:08:11 +00:00
Miroslav Stampar
fb6a84b10b
minor update (when columns are missing from information_schema too)
2011-08-18 07:03:53 +00:00
Miroslav Stampar
262996fc5b
bug fix
2011-08-16 06:14:40 +00:00
Miroslav Stampar
10bdd90e60
minor speed optimizations (as a result of profiling)
2011-08-12 13:40:37 +00:00
Miroslav Stampar
41ae9bc7ff
minor bug fix
2011-08-09 14:20:25 +00:00
Miroslav Stampar
9423d15fb3
ORDER BY technique used for finding proper UNION col count (dramatical improvement of speed and capabilities) and one minor bug fix
2011-08-03 09:08:16 +00:00
Bernardo Damele
c15439ab7f
Minor improvement to --passwords output
2011-08-02 09:04:34 +00:00
Bernardo Damele
ad4584da70
Minor bug fix when dumping tables with UNION query technique on Access, Firebird and MaxDB
2011-08-01 23:44:14 +00:00
Miroslav Stampar
4ca81dd345
quick fix
2011-08-01 23:25:58 +00:00
Miroslav Stampar
e0fda9f985
minor fix
2011-08-01 10:13:25 +00:00
Miroslav Stampar
79b4e26e23
bug fix
2011-08-01 00:17:26 +00:00
Miroslav Stampar
0627bb02cb
minor beautification
2011-07-31 10:21:47 +00:00
Miroslav Stampar
4d923ec375
change in invalid logic regarding --sql-shell (retrieving output for non-query commands did nothing at all)
2011-07-30 21:46:59 +00:00
Miroslav Stampar
a6ade08c28
just in case commit to prevent join string iteration over 'None' values
2011-07-30 13:01:37 +00:00
Miroslav Stampar
4ce93221d1
minor update
2011-07-28 09:24:37 +00:00
Miroslav Stampar
684ddc43e6
minor patch
2011-07-28 08:53:09 +00:00
Bernardo Damele
37de709df2
leftover
2011-07-26 11:20:07 +00:00
Bernardo Damele
a2483b3bc4
Aligned OS takeover functionalities to recent Metasploit improvements
2011-07-26 10:29:14 +00:00
Miroslav Stampar
ec1bc0219c
hello big tables, this is sqlmap, sqlmap this is big tables
2011-07-24 09:19:33 +00:00
Bernardo Damele
5a1c9a42a3
Minor bug fix
2011-07-20 13:45:34 +00:00
Bernardo Damele
29b5115906
Minor bug fix
2011-07-20 13:28:10 +00:00
Miroslav Stampar
9c694ce3ec
bug fix (--tables --columns)
2011-07-12 23:27:47 +00:00
Miroslav Stampar
c517e97a44
few fixes and minor cosmetics
2011-07-08 06:02:31 +00:00
Bernardo Damele
aedcf8c8d7
Changed homepage address
2011-07-07 20:10:03 +00:00
Miroslav Stampar
b8ffcf9495
few fixes here and there and multi-core processing for dictionary based hash attack
2011-07-04 19:58:41 +00:00
Bernardo Damele
da049110df
Minor revert
2011-07-04 15:23:05 +00:00
Miroslav Stampar
a1fe9d07ca
minor revert
2011-07-02 23:00:22 +00:00
Miroslav Stampar
34d9a91af1
bulk of fixes
2011-07-02 22:48:56 +00:00
Miroslav Stampar
d063ae91eb
propset update
2011-06-30 07:55:07 +00:00
Miroslav Stampar
8a36f7fc03
fix for a bug reported by aboynes@gmail.com (UnboundLocalError: local variable 'infoMsg' referenced before assignment)
2011-06-29 18:04:58 +00:00
Bernardo Damele
d3b44a5f58
Added copyright
2011-06-28 10:59:20 +00:00
Bernardo Damele
fe686feefa
Added support for direct connection (-d switch) to IBM DB2
2011-06-28 10:52:07 +00:00
Bernardo Damele
36c96ef796
Added DB2 support - patch provided by Sebastian Bittig
2011-06-25 09:44:24 +00:00
Bernardo Damele
f7196007ca
--search on Oracle is now consistent with other plugins
2011-06-24 14:33:30 +00:00
Bernardo Damele
ddfae39d9e
Minor bug fixes for --search with -C
2011-06-24 09:27:54 +00:00
Bernardo Damele
1cb12ea659
replaced third-party library python-mysql with python pymysql, http://code.google.com/p/pymysql/ (MIT license)
2011-06-22 13:31:07 +00:00
Bernardo Damele
f8c32cf6b9
Moved folder
2011-06-18 12:34:41 +00:00
Miroslav Stampar
ca6f9acf30
minor fix for resuming in multi threading mode
2011-06-18 12:23:18 +00:00
Miroslav Stampar
d27afaed7e
some fixes
2011-06-16 14:27:44 +00:00
Miroslav Stampar
0eeb48f8f5
some fixes
2011-06-16 13:41:02 +00:00
Miroslav Stampar
afe0579487
minor fixes for pivot dumping
2011-06-15 19:03:37 +00:00
Miroslav Stampar
4188df0501
fixes for Sybase
2011-06-15 18:49:35 +00:00
Miroslav Stampar
60ecf95383
fix for a bug reported by seyi.akin@gmail.com
2011-06-14 08:40:25 +00:00
Bernardo Damele
9126c84442
Refactoring (standardized with --search -C ...)
2011-06-08 16:39:41 +00:00
Miroslav Stampar
4a9640160e
more concise
2011-06-08 14:35:23 +00:00
Miroslav Stampar
6b81eef65a
refactoring
2011-06-08 14:30:12 +00:00
Bernardo Damele
cce3208b35
Cleanup
2011-06-08 14:15:34 +00:00
Bernardo Damele
161ece5587
Rephrase
2011-06-08 11:33:45 +00:00
Miroslav Stampar
26062ec71e
minor update
2011-06-07 15:13:51 +00:00
Miroslav Stampar
f34b395c65
fixing typo
2011-06-07 14:58:22 +00:00
Miroslav Stampar
89a7516c35
bug fix
2011-06-06 09:55:22 +00:00
Miroslav Stampar
0b875b160f
cosmetics
2011-05-31 20:57:29 +00:00
Miroslav Stampar
3fa8e1db72
better language
2011-05-31 15:45:54 +00:00
Miroslav Stampar
4bb9754dfe
using --dump for msaccess with -C switch was for some reason pain in the ass (you had to do the brute forcing again and again). now -C forces the result in those cases
2011-05-30 23:34:48 +00:00
Miroslav Stampar
bf2b58ba82
minor update
2011-05-26 15:23:28 +00:00
Miroslav Stampar
79f0b3a92a
adding support for --start and --stop for __pivotDumpTable
2011-05-26 15:16:57 +00:00
Miroslav Stampar
b6fe5b12a4
adding --schema to the wizard/Basic as it looks like a cool thingy to put there
2011-05-26 14:30:05 +00:00
Miroslav Stampar
a397baa89a
fix for a bug reported by viniciusmaxdaloop@gmail.com and few related patches
2011-05-26 08:17:21 +00:00
Miroslav Stampar
1067d43f14
minor update
2011-05-23 19:16:29 +00:00
Miroslav Stampar
0ed03d474f
now supporting "blank tables" - schema of the table will be preserved, even if it's empty - especially nice feature for --replicate
2011-05-23 11:09:44 +00:00
Miroslav Stampar
7b52bbe3fb
reverting that ignoreTimeout for --tables (because of this and that)
2011-05-22 09:59:19 +00:00
Miroslav Stampar
9b2623514a
one bug fix for Host header (value should be without port number); one improvement for --tables - when no tables ask user if he wants to brute force them; one tweak - adding kb.ignoreTimeout for --tables
2011-05-22 09:48:46 +00:00
Miroslav Stampar
2ea613b170
type correction and adding global flag kb.ignoreTimeout which could be useful
2011-05-22 08:24:13 +00:00
Miroslav Stampar
126cdf9e19
minor info update
2011-05-19 23:28:27 +00:00
Miroslav Stampar
a034462c31
fixing annoying timeouts for basic DBMS check (reference: http://dev.mysql.com/doc/refman/5.0/en/date-and-time-functions.html#function_timestampadd )
2011-05-19 23:03:00 +00:00
Miroslav Stampar
5a979f7667
minor bug fix for empty colList; also added "do you want to use LIKE" (LIKE is default) question when -C used
2011-05-19 17:35:33 +00:00
Miroslav Stampar
4efc284b83
adding more info for --passwords
2011-05-11 12:35:32 +00:00
Bernardo Damele
b5f090cc4f
Minor bug fix
2011-05-10 15:48:48 +00:00
Miroslav Stampar
b713b18fd2
minor fix for a bug spotted on Sybase
2011-05-09 16:09:18 +00:00
Bernardo Damele
ac74557614
Minor adjustment for --dump-all
2011-05-08 10:25:40 +00:00
Bernardo Damele
356037ca22
cosmetics
2011-05-08 02:11:34 +00:00
Bernardo Damele
9955483052
Major improvement for --dump.
...
Minor improvement for --dump-all.
Minor bug fix for infinite loop
2011-05-08 02:08:18 +00:00
Bernardo Damele
d3589493d1
Temporary fix for bug reported by ultramegaman (infinite loop)
2011-05-07 23:28:59 +00:00
Bernardo Damele
6e784e766b
Minor bug fix
2011-05-07 21:20:47 +00:00
Bernardo Damele
aae140080e
SVN roll back, DB2 patch will be recommitted after testing:
...
$ svn merge https://svn.sqlmap.org/sqlmap/trunk/sqlmap@HEAD https://svn.sqlmap.org/sqlmap/trunk/sqlmap@3847 .
2011-05-06 10:27:43 +00:00
Miroslav Stampar
42bca80968
removing blank lines and adding newline at the end of files
2011-05-06 09:35:53 +00:00
Miroslav Stampar
6e392b6054
applying contributed patch for DB2
2011-05-06 09:30:39 +00:00
Bernardo Damele
dac59a55bc
leftover
2011-05-03 14:14:39 +00:00
Bernardo Damele
c58dc4a6d8
isDbmsWithin() must stay like this, no getIdentifiedDbms() in there
2011-05-03 14:13:45 +00:00
Miroslav Stampar
eceb5eca7b
fix for --file-read on MSSQL for error technique (again that unpacking was causing problems); also reverting that check for file paths as one user mentioned that network paths are also possible for usage on Windows machines (e.g. \\bla\bla)
2011-05-02 21:55:06 +00:00
Miroslav Stampar
b327a78522
minor minor update of the last commit
2011-05-02 19:24:49 +00:00
Miroslav Stampar
0bb7d715a7
more user friendliness/handiness for users which mix Linux and Windows paths where they shouldn't do that
2011-05-02 19:18:28 +00:00
Miroslav Stampar
8e8886cd20
minor improvement for --sql-shell/--sql-query (when non-SELECT default is N for retrieve data output which automatically does STACKED injection)
2011-05-01 21:41:14 +00:00
Bernardo Damele
64bb480414
Do not raise otherwise it won't work with --schema
2011-04-30 23:20:16 +00:00
Bernardo Damele
d5eeb91b35
Aligned Sybase and MaxDB to recent enhancements to --dbs, --tables and --columns
2011-04-30 22:11:36 +00:00
Bernardo Damele
b31b861d7b
Major rewrote of --columns: now it accepts -D only (enumerate all tables' columns of a specific database), -D and -T (enumerate all columns of a specific database's table), -T (enumerate all columns of a current database's table), etc.
2011-04-30 22:10:27 +00:00
Bernardo Damele
284c69a686
Improved --tables for MSSQL too, like r3798
2011-04-30 22:05:02 +00:00
Bernardo Damele
aeb149db22
Proper ordering of enumeration methods, consistent with the others enumeration classes
2011-04-30 22:04:08 +00:00
Bernardo Damele
955dbc85e7
Minor variable rename
2011-04-30 15:29:59 +00:00
Bernardo Damele
cb9b9c4204
Code refactoring and improvements to --dbs and --tables: now --tables accepts also -D CD as an alias for Current Database and as usual multiple database comma-separated are supported too
2011-04-30 15:29:19 +00:00
Bernardo Damele
b3a0424269
More Backend class method usage refactoring
2011-04-30 15:24:15 +00:00
Bernardo Damele
9a4ae7d9e2
More code refactoring of Backend class methods used
2011-04-30 14:54:29 +00:00
Bernardo Damele
36a9ddaacc
Minor bug fixes and code restyling for --privileges and --passwords
2011-04-30 14:50:27 +00:00
Bernardo Damele
f56d135438
Minor code restyling
2011-04-30 13:20:05 +00:00
Bernardo Damele
1a052245a6
duplicate code
2011-04-30 00:25:15 +00:00
Bernardo Damele
a5968fff3e
Added --count switch to count the number of entries for a specific table (when -T is provided), all database's tables (when only -D is provided) or all databases' tables when neither -D nor -T are provided
2011-04-30 00:22:22 +00:00
Bernardo Damele
529595fd85
Moved method below
2011-04-29 22:37:43 +00:00
Bernardo Damele
14bf6abb7e
Minor layout adjustment
2011-04-29 21:40:48 +00:00
Bernardo Damele
f449688f93
Proper resume of --schema data when calling with --columns switch, minor fixes too
2011-04-29 21:17:59 +00:00
Miroslav Stampar
a6015b59df
fix for a bug reported by jaccovantuijl@gmail.com (entries = zip(*[entries[colName] for colName in colList]))
2011-04-29 14:33:47 +00:00
Bernardo Damele
9927f5a7db
Let --schema work also for Sybase and MaxDB
2011-04-29 00:02:28 +00:00
Bernardo Damele
edac0b2558
Added switch --schema to enumerate DBMS schema and now --columns does not require a mandatory table (-T) anymore, instead it will act as an alias for --schema
2011-04-28 23:59:00 +00:00
Bernardo Damele
e35f25b2cb
Major recode of --os-pwn functionality. Now the Metasploit shellcode can not be run as a Metasploit generated payload stager anymore. Instead it can be run on the target system either via sys_bineval() (as it was before, anti-forensics mode, all the same) or via shellcodeexec executable. Advantages are that:
...
* It is stealthier as the shellcode itself does not touch the filesystem, it's an argument passed to shellcodeexec at runtime.
* shellcodeexec is not (yet) recognized as malicious by any (Avast excluded) AV product.
* shellcodeexec binary size is significantly smaller than a Metasploit payload stager (even when packed with UPX).
* UPX now is not needed anymore, so sqlmap package is also way smaller and less likely to be detected itself as malicious by your AV software.
shellcodeexec source code, compilation files and binaries are in extra/shellcodeexec/ folder now - copied over from https://github.com/inquisb/shellcodeexec .
Minor code refactoring.
2011-04-24 23:01:21 +00:00
Bernardo Damele
d0a534dee5
Do not even prompt for ICMP tunnel if the target OS is not Windows
2011-04-23 21:57:07 +00:00
Bernardo Damele
d0dff82ce0
Minor code refactoring relating set/get back-end DBMS operating system and minor bug fix to properly enforce OS value with --os switch
2011-04-23 16:25:09 +00:00
Miroslav Stampar
148fb26301
quick fix
2011-04-21 17:34:26 +00:00
Miroslav Stampar
e181d5412e
fix for a bug reported by aboynes@gmail.com (@@datadir not available on MySQL 4)
2011-04-21 17:33:07 +00:00
Miroslav Stampar
bd4fbb3251
fix for a bug reported by l0rda@l0rda.biz (TypeError: cannot concatenate 'str' and 'NoneType' objects)
2011-04-21 14:53:02 +00:00
Miroslav Stampar
5052013ffa
minor update
2011-04-20 14:48:23 +00:00
Miroslav Stampar
f909ecb369
bug fix for mssqlserver escape
2011-04-20 13:41:01 +00:00
Miroslav Stampar
88c76147e1
removed few trailing whitespace lines
2011-04-15 20:52:08 +00:00
Miroslav Stampar
c16b74ce1a
covering __pivotDumpTable for keyboard and connection exceptions too
2011-04-15 14:21:13 +00:00
Miroslav Stampar
0387654166
update of copyright string (until year)
2011-04-15 12:33:18 +00:00
Miroslav Stampar
aed994192e
disabling safecharencode for --banner
2011-04-15 08:15:21 +00:00
Miroslav Stampar
8ddac7fe5a
minor fix and speedup when pivoting empty table
2011-04-14 21:11:20 +00:00
Miroslav Stampar
384ca98ded
don't let sqlmapNoneDataException for one table to break whole dumpAll()
2011-04-14 20:56:12 +00:00
Miroslav Stampar
dbbaefa79d
minor update (pivot value should be safechardecoded)
2011-04-14 20:38:03 +00:00
Miroslav Stampar
d06ae9cd47
implemented retrieved items info for partial union too
2011-04-13 14:33:15 +00:00
Bernardo Damele
1c51e11c5c
Minor adjustments to PgSQL fingerprint
2011-04-12 10:35:33 +00:00
Miroslav Stampar
7324d53997
reference ( http://www.enterprisedb.com/docs/en/9.0/pg/release-9-0.html )
2011-04-12 10:30:33 +00:00
Miroslav Stampar
bc4c2f320c
cosmetics
2011-04-12 10:24:09 +00:00
Miroslav Stampar
2f1786e65f
added active fingerprint for pgsql >= 9.0.3 (reference: http://www.postgresql.org/docs/9.0/static/release-9-0.html )
2011-04-12 10:22:54 +00:00
Bernardo Damele
fdbd8bfe37
initial support for PostgreSQL 9.0 - #223
2011-04-11 22:02:00 +00:00
Bernardo Damele
f4745a95ea
Possible fix for bug reported by David
2011-04-11 21:45:25 +00:00
Miroslav Stampar
941daa1645
just in case to prevent "object of type 'NoneType' has no len()" error reports
2011-04-11 11:59:02 +00:00
Miroslav Stampar
e20848c711
first commit toward v1.0 (it's smarter to start testing for pivot point from shorter column names as they tend to be some kind of identifiers)
2011-04-11 09:40:52 +00:00
Bernardo Damele
ea3ebafba1
Removed outdated sentence
2011-04-10 23:59:49 +00:00
Bernardo Damele
572708f184
More version adjustment
2011-04-10 23:28:24 +00:00
Bernardo Damele
fbf8e7f32d
Minor bug fix to --file-read
2011-04-10 19:53:42 +00:00
Bernardo Damele
7dd5bd9d59
Minor fix for --cleanup on MSSQL
2011-04-10 13:48:29 +00:00
Bernardo Damele
6d165861c8
Minor version increase
2011-04-10 13:30:27 +00:00
Miroslav Stampar
c714ac6421
added support for handling binary data values (no more garbish chars)
2011-04-09 23:13:16 +00:00
Miroslav Stampar
6fa2fd139c
implemented support for __pivotDumpTable on MSSQL as normal tables tend to not play well with normal TOP 1 ..NOT IN..ORDER BY mechanism if the argument for ORDER BY is not the unique one (returns only number of rows equal to the number of distinct values for that field)
2011-04-08 15:17:57 +00:00
Bernardo Damele
d5fb1378cc
Gone unnoticed for way too long
2011-04-08 11:15:19 +00:00
Miroslav Stampar
e8259a7665
minor update (now --dump also supports only -D parameter)
2011-04-07 22:38:13 +00:00
Bernardo Damele
bac53eeef1
Allow --dump-all to accept -D switch in order to dump all tables' entries for only one (or more, comma-separated) specified database(s)
2011-04-07 22:08:10 +00:00
Miroslav Stampar
60102209f6
quick fix for a bug reported by Kirill (AttributeError: 'NoneType' object has no attribute 'split')
2011-04-01 11:14:24 +00:00
Miroslav Stampar
b6af80bab3
refactoring, cleanup and improvement
2011-03-29 21:54:15 +00:00
Miroslav Stampar
4312a42b5d
another minor fix
2011-03-28 12:04:39 +00:00
Miroslav Stampar
3173adbf6b
minor update
2011-03-28 12:02:31 +00:00
Miroslav Stampar
73e5d20ade
bulk commit for safe/unsafe identificator naming (done and tested for all 4 major DBMSes) and one bug fix for --search-column on MSSQL (inside queries)
2011-03-28 11:01:55 +00:00
Miroslav Stampar
76b7e3517d
minor update
2011-03-27 07:58:15 +00:00
Miroslav Stampar
04c4578df7
minor fix
2011-03-26 05:55:49 +00:00
Miroslav Stampar
58f8703ecd
minor update before bedtime
2011-03-25 22:59:18 +00:00
Miroslav Stampar
ae12dee990
minor update
2011-03-25 22:08:54 +00:00
Miroslav Stampar
c9baa0094b
going global for protection of non-standard identificator naming
2011-03-25 22:02:28 +00:00
Miroslav Stampar
5a1f733a43
minor update (_ is part of normal identificator naming)
2011-03-25 21:49:20 +00:00
Miroslav Stampar
1a98095a93
minor improvement for that MySQL identification naming
2011-03-25 21:46:49 +00:00
Miroslav Stampar
48c4460e2c
bug fixed (there was a huge problem with space containing identifiers - fixed and tested for MySQL)
2011-03-25 21:22:06 +00:00
Miroslav Stampar
af39a441fa
minor improvement when --dbs returns no database names (like in many cases with MySQL 4)
2011-03-25 19:50:06 +00:00
Miroslav Stampar
f3858a5fcf
another fix related to the bug reported by Alone Shell
2011-03-24 17:08:14 +00:00
Miroslav Stampar
02379c01a2
minor update (will do "schema update" for sybase some other time; that COUNT(*) blew my mind)
2011-03-23 11:42:36 +00:00
Miroslav Stampar
0f7bce5c66
fixing a huge mess going on because of counting on error and union techniques
2011-03-23 11:36:40 +00:00
Miroslav Stampar
7ea45e9032
minor update for Sybase regarding last commit
2011-03-23 11:04:15 +00:00
Miroslav Stampar
b72cdfe9e6
fix for mssql regarding usage of schema names reported by jabra@spl0it.org
2011-03-23 10:40:34 +00:00
Miroslav Stampar
4889764114
minor update regarding last commit
2011-03-21 11:40:27 +00:00
Miroslav Stampar
5291fe35c9
proper implementation of --dbs on Oracle (we are using now schema names as a counterpart to dbs in other DBMSes)
2011-03-21 11:29:43 +00:00
Bernardo Damele
74ef1e53c7
Minor bug fixes to --privileges for PostgreSQL query (corner case)
2011-03-11 14:54:41 +00:00
Miroslav Stampar
eb1cda7065
minor refactoring (more consistent)
2011-03-09 12:06:32 +00:00
Miroslav Stampar
62e3510387
minor refactoring
2011-03-09 11:37:37 +00:00
Miroslav Stampar
68c7247ee4
bug fix (pgsql drop function requires input arguments - at cleanup() in plugins/generic/misc.py it's already fixed before)
2011-03-08 10:46:23 +00:00
Miroslav Stampar
16b286982d
fix for a bug reported by nightman (AttributeError: 'list' object has no attribute 'split')
2011-03-07 09:50:43 +00:00
Bernardo Damele
7524a0c0cf
Proper error message
2011-03-04 11:59:09 +00:00
Bernardo Damele
60605b6e7c
Major bug fix to make --first and --last apply only to --dump's entries dump phase (in either of the blind SQL injection techs only)
2011-02-27 12:14:13 +00:00
Miroslav Stampar
13f0d5ce00
minor bug fix
2011-02-22 14:51:42 +00:00
Miroslav Stampar
640ba5d744
minor refactoring
2011-02-22 14:19:39 +00:00
Bernardo Damele
3e8c204121
Major bug fix to properly prepare UNION technique statement for --os-pwn and --is-dba
2011-02-21 16:00:56 +00:00
Miroslav Stampar
68a95fd1b1
minor update
2011-02-20 22:45:23 +00:00
Miroslav Stampar
aac817935a
further improvement of MaxDB support
2011-02-20 22:41:42 +00:00
Miroslav Stampar
a3ba8b6928
--dump now works on MaxDB too
2011-02-20 22:07:12 +00:00
Miroslav Stampar
0e512d3c09
minor update for MaxDB
2011-02-20 21:17:16 +00:00
Miroslav Stampar
59e666d16e
--is-dba (related) update for Sybase
2011-02-20 17:28:06 +00:00
Miroslav Stampar
4d52f7fc6e
minor fix regarding --dump-table on Sybase for --technique=23
2011-02-20 16:58:01 +00:00
Miroslav Stampar
67ec691eb1
more updates regarding Sybase
2011-02-20 16:28:48 +00:00
Miroslav Stampar
cc47737c44
minor update
2011-02-20 16:00:13 +00:00
Miroslav Stampar
2f9227bcce
Sybase update (--passwords)
2011-02-20 12:07:32 +00:00
Miroslav Stampar
f30dea74f3
more Sybase updates
2011-02-19 18:36:26 +00:00
Miroslav Stampar
b71bb321dd
some more Sybase updates
2011-02-19 18:04:27 +00:00
Miroslav Stampar
cec7694aac
some progress regarding SYBASE
2011-02-19 14:56:58 +00:00
Miroslav Stampar
e0efe453ab
minor update regarding Sybase support
2011-02-19 14:07:08 +00:00
Miroslav Stampar
de7ca5a27c
minor update
2011-02-19 09:40:41 +00:00
Miroslav Stampar
72fc0a0565
minor refactoring
2011-02-19 09:36:57 +00:00
Miroslav Stampar
5f4ffc9287
update regarding Sybase dumping
2011-02-19 00:36:47 +00:00
Miroslav Stampar
199f14df46
implementation of MySQL GROUP_CONCAT technique
2011-02-15 00:28:27 +00:00
Bernardo Damele
7253362114
Minor bug fix so that --file-write on MySQL via UNION query now works again
2011-02-11 23:35:45 +00:00
Bernardo Damele
c078de894f
Added support for --privileges on MSSQL to test wheter or not the DBMS users are DBA
2011-02-10 14:24:04 +00:00
Bernardo Damele
a2c20acf94
Minor fixes once more
2011-02-10 11:34:16 +00:00
Bernardo Damele
d0ddaee3c8
Minor bug fix
2011-02-10 11:28:24 +00:00
Miroslav Stampar
7539881ffa
fix for dump on Oracle but we still need to discuss some things around
2011-02-09 14:52:07 +00:00
Miroslav Stampar
caf6220c53
done with implementation for retrieving table names via access system table(s)
2011-02-09 10:50:38 +00:00
Miroslav Stampar
5050a76b59
update regarding reading of table names from access system tables
2011-02-09 10:33:29 +00:00
Bernardo Damele
b48213783a
Removed senseless debug messsage
2011-02-08 17:09:35 +00:00
Bernardo Damele
e16bab7117
re-enabled --read-file for MySQL with all techniques
2011-02-08 17:03:57 +00:00
Bernardo Damele
008d434325
Important fix now that the file writing is unescaped too
2011-02-07 00:56:15 +00:00
Bernardo Damele
db77f8b055
Code cleanup
2011-02-06 22:33:08 +00:00
Miroslav Stampar
ecaf5729fd
revert
2011-02-06 22:14:18 +00:00
Miroslav Stampar
caaac72029
minor update regarding last commit
2011-02-06 20:15:03 +00:00
Bernardo Damele
8980227d30
Minor bug fix
2011-02-06 15:32:16 +00:00
Bernardo Damele
2afc1e5021
Layout adjustments
2011-02-06 15:28:23 +00:00
Bernardo Damele
a5a648f4fe
Correctly handle --read-file and --write-file if neither stacked queries nor union query SQL injection has been detected.
...
Support to read files on MySQL via error-based SQL injection technique will come as soon as we fix the MySQL/trim/error-based bug
2011-02-06 15:23:27 +00:00
Miroslav Stampar
14c87ec80d
minor fix
2011-02-04 13:29:02 +00:00
Bernardo Damele
a37f5e05b9
Refactoring
2011-02-01 22:27:36 +00:00
Bernardo Damele
e3a3ae11cc
Proper return from error-based technique enumeration
2011-01-31 21:13:29 +00:00
Bernardo Damele
9fc0bedea8
Minor bug fixes
2011-01-30 21:01:57 +00:00
Miroslav Stampar
ddf23ba7cc
refactoring
2011-01-30 11:36:03 +00:00
Miroslav Stampar
367d0639f0
refactoring (class names should always be Capital cased)
2011-01-28 16:36:09 +00:00
Miroslav Stampar
50969d238b
minor update
2011-01-24 17:51:56 +00:00
Miroslav Stampar
0eea5665b2
minor update
2011-01-24 17:41:36 +00:00
Miroslav Stampar
a3e3387113
fix for proper Firebird resume of version
2011-01-24 11:04:32 +00:00
Miroslav Stampar
eb33612736
fix
2011-01-24 10:20:17 +00:00
Bernardo Damele
77999fb39d
Allow in --sql-shell to always ('a') retrieve query output.
...
Minor bug fix in case with --columns it is not possible to retrieve a column datatype.
2011-01-20 21:49:06 +00:00
Bernardo Damele
b1d6040a48
Minor bug fix so that --search also works when the technique is error-based (which always return a list with lists inside)
2011-01-20 21:46:56 +00:00
Bernardo Damele
50c02fbb37
Done with previous refactoring
2011-01-20 00:01:06 +00:00
Bernardo Damele
bade0e3124
Major code refactoring - centralized all kb.dbms* info for both retrieval and set.
2011-01-19 23:06:15 +00:00
Bernardo Damele
daebb0010b
Major bug fix to properly process custom queries (--sql-query/--sql-shell) when technique in use is error-based.
...
Alignment of SQL statement payload packing/unpacking between all of the techniques.
Minor bug fix to use the proper charset (2, numbers) when dealing with COUNT() in custom queries too.
Minor code cleanup.
2011-01-18 23:02:11 +00:00
Bernardo Damele
47565f9459
Minor code refactoring
2011-01-17 21:13:59 +00:00
Bernardo Damele
02b333e30b
Minor improvement
2011-01-15 23:54:03 +00:00
Miroslav Stampar
1fa8f0cba7
code reviewing part 2
2011-01-15 12:53:40 +00:00
Bernardo Damele
2d9b151883
Minor bug fix
2011-01-15 10:14:05 +00:00
Bernardo Damele
e4e9b11b79
Minor code refactoring and adjustments - kb.dbms is needed in fingerprint.py, not getIdentifiedDBMS because when checkDbms() method is called, it's within the fingerprint phase and at that stage, getIdentifiedDBMS() would always return kb.misc.fpDbms.
2011-01-14 12:47:07 +00:00
