sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-25 11:03:47 +03:00
Code Issues Packages Projects Releases Wiki Activity
854a35be6c
sqlmap/index.html
Bernardo Damele 854a35be6c reordered paragraphs
2012-07-16 16:28:52 +01:00

151 lines
9.6 KiB
HTML
Raw Blame History

<!DOCTYPE html>
<html>
<head>
<meta charset='utf-8'>
<meta http-equiv="X-UA-Compatible" content="chrome=1">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
<script src="javascripts/twitter.min.js" type="text/javascript"></script>
<script type="text/javascript" charset="utf-8">
getTwitters('tweet', {
id: 'sqlmap',
count: 6,
enableLinks: true,
ignoreReplies: true,
clearContents: true,
template: '<strong><a href="http://twitter.com/%user_screen_name%/statuses/%id_str%/">%time%</a></strong> - %text%'
});
</script>
<link rel="icon" href="favicon.ico" type="image/x-icon">
<link rel="alternate" type="application/rss+xml" title="Bernardo Damele A. G. - RSS" href="http://feeds2.feedburner.com/BernardoDamele">
<link href='https://fonts.googleapis.com/css?family=Architects+Daughter' rel='stylesheet' type='text/css'>
<link rel="stylesheet" type="text/css" href="stylesheets/stylesheet.css" media="screen" />
<link rel="stylesheet" type="text/css" href="stylesheets/pygment_trac.css" media="screen" />
<link rel="stylesheet" type="text/css" href="stylesheets/print.css" media="print" />
<!--[if lt IE 9]>
<script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>
<![endif]-->
<title>sqlmap: automatic SQL injection and database takeover tool</title>
</head>
<body>
<header>
<div class="inner">
<h1>sqlmap</h1>
<h2>Automatic SQL injection and database takeover tool</h2>
<a href="https://github.com/sqlmapproject/sqlmap" class="button"><small>View project on</small>GitHub</a>
</div>
</header>
<div id="content-wrapper">
<div class="inner clearfix">
<section id="main-content">
<h1>News</h1>
<a href="https://twitter.com/sqlmap"><img src="images/twitter.jpg" alt="Follow sqlmap on Twitter" width="90" height="90" class="left"></a>
<div id="tweet">Loading news.. if you can not wait, click <a href="http://twitter.com/sqlmap">here</a>.</div>
<h1>Introduction</h1>
<p>sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.</p>
<h1>Features</h1>
<ul>
<li>Full support for <strong>MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB</strong> database management systems.</li>
<li>Full support for six SQL injection techniques: <strong>boolean-based blind, time-based blind, error-based, UNION query, stacked queries and out-of-band</strong>.</li>
<li>Support to <strong>directly connect to the database</strong> without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name.</li>
<li>Support to enumerate <strong>database users, users' password hashes, users' privileges, users' roles, databases, tables and columns</strong>.</li>
<li>Automatic recognition of password hash formats and support for <strong>cracking them using a dictionary-based attack</strong>.</li>
<li>Support to <strong>dump database tables</strong> entirely, a range of entries or specific columns as per user's choice. The user can also choose to dump only a range of characters from each column's entry.</li>
<li>Support to <strong>search for specific database names, specific tables across all databases or specific columns across all databases' tables</strong>. This is useful, for instance, to identify tables containing custom application credentials where relevant columns' names contain string like name and pass.</li>
<li>Support to <strong>download and upload any file</strong> from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.</li>
<li>Support to <strong>execute arbitrary commands and retrieve their standard output</strong> on the database server underlying operating system when the database software is MySQL, PostgreSQL or Microsoft SQL Server.</li>
<li>Support to <strong>establish an out-of-band stateful TCP connection between the attacker machine and the database server</strong> underlying operating system. This channel can be an interactive command prompt, a Meterpreter session or a graphical user interface (VNC) session as per user's choice.</li>
<li>Support for <strong>database process' user privilege escalation</strong> via Metasploit's Meterpreter <code>getsystem</code> command.</li>
</ul>
<p>Refer to the <a href="https://github.com/sqlmapproject/sqlmap/wiki/Features">wiki</a> for an exhaustive breakdown of the features.</a>
<h1>Download</h1>
<p>You can download the latest tarball by clicking <a href="https://github.com/sqlmapproject/sqlmap/tarball/master">here</a>.</p>
<p>Preferably, you can download sqlmap by cloning the <a href="https://github.com/sqlmapproject/sqlmap">Git</a> repository:</p>
<pre><code>git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
</code></pre>
<h1>Documentation</h1>
<ul>
<li>sqlmap <a href="https://github.com/sqlmapproject/sqlmap/wiki">user's manual</a>.</li>
<li>sqlmap <a href="https://raw.github.com/sqlmapproject/sqlmap/master/doc/ChangeLog">ChangeLog</a> and <a href="https://github.com/sqlmapproject/sqlmap/wiki/History">history</a>.</li>
<li><a href="https://github.com/sqlmapproject/sqlmap/wiki/Presentations">Material</a> around sqlmap presented at conferences.</li>
</ul>
<h1>Demo</h1>
<p><iframe title="YouTube video player" width="480" height="390" src="http://www.youtube.com/embed/RsQ52eCcTi4?rel=0" frameborder="0"></iframe></p>
<p>Watch more demos on <a href="http://www.youtube.com/user/inquisb/videos">Bernardo</a> and <a href="http://www.youtube.com/user/stamparm/videos">Miroslav</a> YouTube pages.</p>
<h1>Communication</h1>
<p>The <code>sqlmap-users@lists.sourceforge.net</code> <a href="https://lists.sourceforge.net/lists/listinfo/sqlmap-users">mailing list</a> is the preferred way to ask questions and discuss with other users, <a href="https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS">contributors</a> and the <a href="#developers">developers</a>.<br>
To subscribe use the <a href="https://lists.sourceforge.net/lists/listinfo/sqlmap-users">online web form</a>. It is also available via Gmane <a href="http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap">RSS feed</a>. The archives are available online on <a href="http://news.gmane.org/gmane.comp.security.sqlmap">Gmane</a>.</p>
<p><strong>Bug reports are welcome</strong>! Please report all bugs on the <a href="https://github.com/sqlmapproject/sqlmap/issues">issue tracker</a> or, alternatively, to the <a href="https://lists.sourceforge.net/lists/listinfo/sqlmap-users">mailing list</a>.</p>
<h1>Contribute</h1>
<p>All code contributions are greatly appreciated. First off, clone the <a href="https://github.com/sqlmapproject/sqlmap">Git repository</a>, read the <a href="https://github.com/sqlmapproject/sqlmap/wiki">user's manual</a> carefully, go through the code yourself and <a href="mailto:dev@sqlmap.org">drop us</a> an email if you are having a hard time grasping its structure and meaning.</p>
<p>Our preferred method of patch submission is via a Git <a href="https://help.github.com/articles/using-pull-requests">pull request</a>.</p>
<p>Each patch should make one logical change. Please follow the existing stylistic conventions: wrap code to 76 columns when possible. Avoid tabbing, use four blank spaces instead. Before you put time into a nontrivial patch, it is worth discussing it on the <a href="https://lists.sourceforge.net/lists/listinfo/sqlmap-users">mailing list</a> or privately by <a href="mailto:dev@sqlmap.org">email</a>.</p>
<p>Many <a href="https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS">people</a> have contributed in different ways to the sqlmap development. You can be the next!</p>
<h1>Support</h1>
<p>sqlmap is the result of numerous hours of passionated work from a small team of computer security enthusiasts. If you appreciated our work and you want to see sqlmap kept being developed, please consider making a <a href="https://www.paypal.com/uk/cgi-bin/webscr?cmd=_send-money&nav=1">donation</a> to our efforts via <a href="https://www.paypal.com/">PayPal</a> to <code>dev@sqlmap.org</code>.</p>
<h1>License</h1>
<p>sqlmap is released under the terms of the <a href="http://www.gnu.org/licenses/old-licenses/gpl-2.0.html">General Public License v2</a>.<br>
sqlmap is copyrighted by its <a href="#developers">developers</a>.</p>
<h1>Developers</h1>
<ul>
<li><a href="mailto:bernardo@sqlmap.org">Bernardo Damele A. G.</a> (<a href="https://twitter.com/inquisb">@inquisb</a>)</li>
<li><a href="mailto:miroslav@sqlmap.org">Miroslav Stampar</a> (<a href="https://twitter.com/stamparm">@stamparm</a>)</li>
</ul>
<p>You can contact the development team by writing to <code>dev@sqlmap.org</code>.</p>
</section>
<aside id="sidebar">
<a href="https://github.com/sqlmapproject/sqlmap/zipball/master" class="button">
<small>Download</small>
.zip file
</a>
<a href="https://github.com/sqlmapproject/sqlmap/tarball/master" class="button">
<small>Download</small>
.tar.gz file
</a>
</aside>
</div>
</div>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-5076660-1");
pageTracker._trackPageview();
} catch(err) {}
</script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink