sqlmap/doc/ChangeLog

sqlmap (0.6.2-1) stable; urgency=low

  * Major bug fix to correctly dump tables entries when --stop is not
    specified;
  * Major bug fix so that the users' privileges enumeration now works
    properly also on both MySQL < 5.0 and MySQL >= 5.0;
  * Major bug fix when the request is POST to also send the GET parameters
    if any have been provided;
  * Major bug fix so that when the expected value of a query (count
    variable) is an integer and for some reason the resumed value from
    session file is a string or a binary file, the query is executed again
    and and its new output saved to the session file;
  * Minor improvement to correctly enumerate tables, columns and dump
    tables entries on Oracle and on PostgreSQL when the database name is
    not 'public' schema or a system database;
  * Minor improvement to be able to dump entries on MySQL < 5.0 when
    database name, table name and column(s) are provided;
  * Updated the database management system fingerprint checks to correctly
    identify MySQL 5.1.x, MySQL 6.0.x and PostgreSQL 8.3;
  * More user-friendly warnin messages.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Sun,  2 Nov 2008 19:00:00 +0000


sqlmap (0.6.1-1) stable; urgency=low

  * Major bug fix to blind SQL injection bisection algorithm to handle an
    exception;
  * Added a Metasploit Framework 3 auxiliary module to run sqlmap;
  * Implemented possibility to test for and inject also on LIKE
    statements;
  * Implemented --start and --stop options to set the first and the last
    table entry to dump;
  * Added non-interactive/batch-mode (--batch) option to make it easy to
    wrap sqlmap in Metasploit and any other tool;
  * Minor enhancement to save also the length of query output in the
    session file when retrieving the query output length for ETA or for
    resume purposes;
  * Changed the order sqlmap dump table entries from column by column to
    row by row. Now it also dumps entries as they are stored in the tables,
    not forcing the entries' order alphabetically anymore;
  * Minor bug fix to correctly handle parameters' value with % character.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Fri, 20 Oct 2008 10:00:00 +0000


sqlmap (0.6-1) stable; urgency=low

  * Complete code refactor and many bugs fixed;
  * Added multithreading support to set the maximum number of concurrent
    HTTP requests;
  * Implemented SQL shell (--sql-shell) functionality and fixed SQL query
    (--sql-query, before called -e) to be able to run whatever SELECT
    statement and get its output in both inband and blind SQL injection
    attack;
  * Added an option (--privileges) to retrieve DBMS users privileges, it
    also notifies if the user is a DBMS administrator;
  * Added support (-c) to read options from configuration file, an example
    of valid INI file is sqlmap.conf and support (--save) to save command
    line options on a configuration file;
  * Created a function that updates the whole sqlmap to the latest stable
    version available by running sqlmap with --update option;
  * Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.)
    installation binary packages;
  * Created sqlmap .exe (Windows) portable executable;
  * Save a lot of more information to the session file, useful when
    resuming injection on the same target to not loose time on identifying
    injection, UNION fields and back-end DBMS twice or more times;
  * Improved automatic check for parenthesis when testing and forging SQL
    query vector;
  * Now it checks for SQL injection on all GET/POST/Cookie parameters then
    it lets the user select which parameter to perform the injection on in
    case that more than one is injectable;
  * Implemented support for HTTPS requests over HTTP(S) proxy;
  * Added a check to handle NULL or not available queries output;
  * More entropy (randomStr() and randomInt() functions in
    lib/core/common.py) in inband SQL injection concatenated query and in
    AND condition checks;
  * Improved XML files structure;
  * Implemented the possibility to change the HTTP Referer header;
  * Added support to resume from session file also when running with
    inband SQL injection attack;
  * Added an option (--os-shell) to execute operating system commands if
    the back-end DBMS is MySQL, the web server has the PHP engine active
    and permits write access on a directory within the document root;
  * Added a check to assure that the provided string to match (--string)
    is within the page content;
  * Fixed various queries in XML file;
  * Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted
    the library to parse it;
  * Fixed password fetching function, mainly for Microsoft SQL Server and
    reviewed the password hashes parsing function;
  * Major bug fixed to avoid tracebacks when the testable parameter(s) is
    dynamic, but not injectable;
  * Enhanced logging system: added three more levels of verbosity to show
    also HTTP sent and received traffic;
  * Enhancement to handle Set-Cookie from target url and automatically
    re-establish the Session when it expires;
  * Added support to inject also on Set-Cookie parameters;
  * Implemented TAB completion and command history on both --sql-shell and
    --os-shell;
  * Renamed some command line options;
  * Added a conversion library;
  * Added code schema and reminders for future developments;
  * Added Copyright comment and $Id$;
  * Updated the command line layout and help messages;
  * Updated some docstrings;
  * Updated documentation files.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Mon,  1 Sep 2008 10:00:00 +0100


sqlmap (0.5-1) stable; urgency=low

  * Added support for Oracle database management system
  * Extended inband SQL injection functionality (--union-use) to all
    other possible queries since it only worked with -e and --file on
    all DMBS plugins;
  * Added support to extract database users password hash on Microsoft
    SQL Server;
  * Added a fuzzer function with the aim to parse HTML page looking
    for standard database error messages consequently improving
    database fingerprinting;
  * Added support for SQL injection on HTTP Cookie and User-Agent headers;
  * Reviewed HTTP request library (lib/request.py) to support the
    extended inband SQL injection functionality. Splitted getValue()
    into getInband() and getBlind();
  * Major enhancements in common library and added checkForBrackets()
    method to check if the bracket(s) are needed to perform a UNION query
    SQL injection attack;
  * Implemented --dump-all functionality to dump entire DBMS data from
    all databases tables;
  * Added support to exclude DBMS system databases' when enumeration
    tables and dumping their entries (--exclude-sysdbs);
  * Implemented in Dump.dbTableValues() method the CSV file dumped data
    automatic saving in csv/ folder by default;
  * Added DB2, Informix and Sybase DBMS error messages and minor
    improvements in xml/errors.xml;
  * Major improvement in all three DBMS plugins so now sqlmap does not
    get entire databases' tables structure when all of database/table/
    column are specified to be dumped;
  * Important fixes in lib/option.py to make sqlmap properly work also
    with python 2.5 and handle the CSV dump files creation work also
    under Windows operating system, function __setCSVDir() and fixed
    also in lib/dump.py;
  * Minor enhancement in lib/injection.py to randomize the number
    requested to test the presence of a SQL injection affected parameter
    and implemented the possibilities to break (q) the for cycle when
    using the google dork option (-g);
  * Minor fix in lib/request.py to properly encode the url to request
    in case the "fixed" part of the url has blank spaces;
  * More minor layout enhancements in some libraries;
  * Renamed DMBS plugins;
  * Complete code refactoring, a lot of minor and some major fixes in
    libraries, many minor improvements;
  * Updated all documentation files.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Sun,  4 Nov 2007 20:00:00 +0100


sqlmap (0.4-1) stable; urgency=low

  * Added DBMS fingerprint based also upon HTML error messages parsing
    defined in lib/parser.py which reads an XML file defining default
    error messages for each supported DBMS;
  * Added Microsoft SQL Server extensive DBMS fingerprint checks based
    upon accurate '@@version' parsing matching on an XML file to get also
    the exact patching level of the DBMS;
  * Added support for query ETA (Estimated Time of Arrival) real time
    calculation (--eta);
  * Added support to extract database management system users password
    hash on MySQL and PostgreSQL (--passwords);
  * Added docstrings to all functions, classes and methods, consequently
    released the sqlmap development documentation
    <http://sqlmap.sourceforge.net/dev/>;
  * Implemented Google dorking feature (-g) to take advantage of Google
    results affected by SQL injection to perform other command line
    argument on their DBMS;
  * Improved logging functionality: passed from banal 'print' to Python
    native logging library;
  * Added support for more than one parameter in '-p' command line
    option;
  * Added support for HTTP Basic and Digest authentication methods
    (--basic-auth and --digest-auth);
  * Added the command line option '--remote-dbms' to manually specify
    the remote DBMS;
  * Major improvements in union.UnionCheck() and union.UnionUse()
    functions to make it possible to exploit inband SQL injection also
    with database comment characters ('--' and '#') in UNION SELECT
    statements;
  * Added the possibility to save the output into a file while performing
    the queries (-o OUTPUTFILE) so it is possible to stop and resume the
    same query output retrieving in a second time (--resume);
  * Added support to specify the database table column to enumerate
    (-C COL);
  * Added inband SQL injection (UNION SELECT) support (--union-use);
  * Complete code refactoring, a lot of minor and some major fixes in
    libraries, many minor improvements;
  * Reviewed the directory tree structure;
  * Splitted lib/common.py: inband injection functionalities now are
    moved to lib/union.py;
  * Updated documentation files.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Fri, 15 Jun 2007 20:00:00 +0100


sqlmap (0.3-1) stable; urgency=low

  * Added module for MS SQL Server;
  * Strongly improved MySQL dbms active fingerprint and added MySQL
    comment injection check;
  * Added PostgreSQL dbms active fingerprint;
  * Added support for string match (--string);
  * Added support for UNION check (--union-check);
  * Removed duplicated code, delegated most of features to the engine
    in common.py and option.py;
  * Added support for --data command line argument to pass the string
    for POST requests;
  * Added encodeParams() method to encode url parameters before making
    http request;
  * Many bug fixes;
  * Rewritten documentation files;
  * Complete code restyling.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Sat, 20 Jan 2007 20:00:00 +0100


sqlmap (0.2-1) stable; urgency=low

  * complete refactor of entire program;
  * added TODO and THANKS files;
  * added some papers references in README file;
  * moved headers to user-agents.txt, now -f parameter specifies a file
    (user-agents.txt) and randomize the selection of User-Agent header;
  * strongly improved program plugins (mysqlmap.py and postgres.py),
    major enhancements:
    * improved active mysql fingerprint check_dbms();
    * improved enumeration functions for both databases;
    * minor changes in the unescape() functions;
  * replaced old inference algorithm with a new bisection algorithm.
  * reviewed command line parameters, now with -p it's possible to
    specify the parameter you know it's vulnerable to sql injection,
    this way the script won't perform the sql injection checks itself;
    removed the TOKEN parameter;
  * improved Common class, adding support for http proxy and http post
    method in hash_page;
  * added OptionCheck class in option.py which performs all needed checks
    on command line parameters and values;
  * added InjectionCheck class in injection.py which performs check on
    url stability, dynamics of parameters and injection on dynamic url
    parameters;
  * improved output methods in dump.py;
  * layout enhancement on main program file (sqlmap.py), adapted to call
    new option/injection classes and improvements on catching of
    exceptions.

 -- Bernardo Damele A. G. <bernardo.damele@gmail.com>  Wed, 13 Dec 2006 20:00:00 +0100