88< H1 > sqlmap user's manual</ H1 >
99
1010< H2 > by
11- < A HREF ="
mailto:[email protected] "
> Bernardo Damele A. G.
</ A > </ H2 > version 0.6.
3, 18th of
December 2008 11+ < A HREF ="
mailto:[email protected] "
> Bernardo Damele A. G.
</ A > </ H2 > version 0.6.
4, DDth of
MMM 2009 1212< HR >
1313< EM > This document is the user's manual to use
1414< A HREF ="http://sqlmap.sourceforge.net "> sqlmap</ A > .
@@ -88,8 +88,9 @@ <H2><A NAME="ss1.1">1.1</A> <A HREF="#toc1.1">Requirements</A>
8888< A HREF ="http://ipython.scipy.org/moin/PyReadline/Intro "> PyReadline</ A >
8989library to be able to take advantage of the sqlmap TAB completion and
9090history support functionalities in the SQL shell and OS shell.
91- Note that these functionalities are available natively by Python official
92- readline library on other operating systems.
91+ Note that these functionalities are available natively by Python standard
92+ < A HREF ="http://docs.python.org/library/readline.html "> readline</ A >
93+ library on other operating systems.
9394You can also choose to install
9495< A HREF ="http://psyco.sourceforge.net/ "> Psyco</ A >
9596library to speed up the sqlmap algorithmic operations.</ P >
@@ -347,24 +348,24 @@ <H2><A NAME="s3">3.</A> <A HREF="#toc3">Download and update</A></H2>
347348< P >
348349< UL >
349350< LI >
350- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.3 .tar.gz "> Source gzip compressed</ A > operating system independent.
351+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4 .tar.gz "> Source gzip compressed</ A > operating system independent.
351352</ LI >
352353< LI >
353- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.3 .tar.bz2 "> Source bzip2 compressed</ A > operating system independent.
354+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4 .tar.bz2 "> Source bzip2 compressed</ A > operating system independent.
354355</ LI >
355356< LI >
356- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.3 .zip "> Source zip compressed</ A > operating system independent.
357+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4 .zip "> Source zip compressed</ A > operating system independent.
357358</ LI >
358359< LI >
359- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.3 -1_all.deb "> DEB binary package</ A > architecture independent for Debian and any
360+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.4 -1_all.deb "> DEB binary package</ A > architecture independent for Debian and any
360361other Debian derivated GNU/Linux distribution.
361362</ LI >
362363< LI >
363- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.3 -1.noarch.rpm "> RPM binary package</ A > architecture independent for Fedora and any
364+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4 -1.noarch.rpm "> RPM binary package</ A > architecture independent for Fedora and any
364365other operating system that can install RPM packages.
365366</ LI >
366367< LI >
367- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.3_exe .zip "> Portable executable for Windows</ A > that < B > does not require the Python
368+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4_exe .zip "> Portable executable for Windows</ A > that < B > does not require the Python
368369interpreter</ B > to be installed on the operating system.</ LI >
369370</ UL >
370371</ P >
@@ -402,7 +403,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
402403< PRE >
403404$ python sqlmap.py -h
404405
405- sqlmap/0.6.
3 coded by Bernardo Damele A. G. <
[email protected] > 406+ sqlmap/0.6.
4 coded by Bernardo Damele A. G. <
[email protected] > 406407 and Daniele Bellucci <
[email protected] > 407408
408409Usage: sqlmap.py [options]
@@ -619,7 +620,7 @@ <H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
619620Accept-language: en-us,en;q=0.5
620621Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
621622image/png,*/*;q=0.5
622- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
623+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
623624Connection: close
624625[...]
625626[hh:mm:55] [INFO] testing MySQL
@@ -632,7 +633,7 @@ <H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
632633Accept-language: en-us,en;q=0.5
633634Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
634635image/png,*/*;q=0.5
635- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
636+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
636637Connection: close
637638[...]
638639</ PRE >
@@ -654,7 +655,7 @@ <H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
654655Accept-language: en-us,en;q=0.5
655656Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
656657image/png,*/*;q=0.5
657- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
658+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
658659Connection: close
659660
660661[hh:mm:44] [TRAFFIC IN] HTTP response (OK - 200):
@@ -675,7 +676,7 @@ <H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
675676Accept-language: en-us,en;q=0.5
676677Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
677678image/png,*/*;q=0.5
678- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
679+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
679680Connection: close
680681[...]
681682</ PRE >
@@ -697,7 +698,7 @@ <H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
697698Accept-language: en-us,en;q=0.5
698699Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
699700image/png,*/*;q=0.5
700- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
701+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
701702Connection: close
702703
703704[hh:mm:17] [TRAFFIC IN] HTTP response (OK - 200):
@@ -725,7 +726,7 @@ <H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
725726Accept-language: en-us,en;q=0.5
726727Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
727728image/png,*/*;q=0.5
728- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
729+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
729730Connection: close
730731
731732[hh:mm:18] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1036,7 +1037,7 @@ <H3>HTTP <CODE>Cookie</CODE> header</H3>
10361037Accept-language: en-us,en;q=0.5
10371038Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
10381039image/png,*/*;q=0.5
1039- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1040+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
10401041Cookie: ASPSESSIONIDSABTRCAS=HPCBGONANJBGFJFHGOKDMCGJ
10411042Connection: close
10421043
@@ -1052,7 +1053,7 @@ <H3>HTTP <CODE>Cookie</CODE> header</H3>
10521053Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
10531054image/png,*/*;q=0.5
10541055Cookie: ASPSESSIONIDSABTRCAS=469
1055- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1056+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
10561057Connection: close
10571058
10581059[hh:mm:40] [WARNING] Cookie parameter 'ASPSESSIONIDSABTRCAS' is not dynamic
@@ -1104,7 +1105,7 @@ <H3>HTTP <CODE>Referer</CODE> header</H3>
11041105Referer: http://www.google.com
11051106Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
11061107image/png,*/*;q=0.5
1107- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1108+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
11081109Connection: close
11091110[...]
11101111</ PRE >
@@ -1121,7 +1122,7 @@ <H3>HTTP <CODE>User-Agent</CODE> header</H3>
11211122< P >
11221123< BLOCKQUOTE > < CODE >
11231124< PRE >
1124- sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1125+ sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
11251126</ PRE >
11261127</ CODE > </ BLOCKQUOTE >
11271128</ P >
@@ -1243,7 +1244,7 @@ <H3>HTTP <CODE>Basic</CODE> and <CODE>Digest</CODE> authentications</H3>
12431244Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
12441245image/png,*/*;q=0.5
12451246Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
1246- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1247+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
12471248Connection: close
12481249[...]
12491250
@@ -1264,7 +1265,7 @@ <H3>HTTP <CODE>Basic</CODE> and <CODE>Digest</CODE> authentications</H3>
12641265nonce="Qw52C8RdBAA=2d7eb362292b24718dcb6e4d9a7bf0f13d58fa9d",
12651266uri="/sqlmap/mysql/digest/get_int.php?id=1", response="16d01b08ff2f77d8ff0183d706f96747",
12661267algorithm="MD5", qop=auth, nc=00000001, cnonce="579be5eb8753693a"
1267- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1268+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
12681269Connection: close
12691270[...]
12701271</ PRE >
@@ -1437,7 +1438,7 @@ <H3>Testable parameter(s)</H3>
14371438< BLOCKQUOTE > < CODE >
14381439< PRE >
14391440$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/ua_str.php" -v 1 \
1440- -p "user-agent" --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
1441+ -p "user-agent" --user-agent "sqlmap/0.6.4 (http://sqlmap.sourceforge.net)"
14411442
14421443[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
14431444[hh:mm:40] [INFO] testing connection to the target url
@@ -1551,7 +1552,7 @@ <H3>Custom injection payload</H3>
15511552Accept-language: en-us,en;q=0.5
15521553Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
15531554image/png,*/*;q=0.5
1554- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1555+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
15551556Connection: close
15561557[...]
15571558[hh:mm:17] [INFO] GET parameter 'id' is custom injectable
@@ -1628,7 +1629,7 @@ <H3>Page comparison</H3>
16281629[hh:mm:50] [TRAFFIC OUT] HTTP request:
16291630GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
16301631Host: 192.168.1.121:80
1631- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1632+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
16321633Connection: close
16331634
16341635[hh:mm:50] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1650,7 +1651,7 @@ <H3>Page comparison</H3>
16501651[hh:mm:51] [TRAFFIC OUT] HTTP request:
16511652GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
16521653Host: 192.168.1.121:80
1653- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1654+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
16541655Connection: close
16551656
16561657[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1672,7 +1673,7 @@ <H3>Page comparison</H3>
16721673[hh:mm:51] [TRAFFIC OUT] HTTP request:
16731674GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
16741675Host: 192.168.1.121:80
1675- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
1676+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
16761677Connection: close
16771678
16781679[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
@@ -2083,7 +2084,7 @@ <H3>Use the UNION query SQL injection</H3>
20832084Accept-language: en-us,en;q=0.5
20842085Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
20852086image/png,*/*;q=0.5
2086- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
2087+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
20872088Connection: close
20882089
20892090[hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200):
@@ -3181,7 +3182,7 @@ <H3>Dump database table entries</H3>
31813182| 1 | luther | blissett |
31823183| 2 | fluffy | bunny |
31833184| 3 | wu | ming |
3184- | 4 | sqlmap/0.6.3 (http://sqlmap.sourceforge.net) | user agent header |
3185+ | 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
31853186| 5 | NULL | nameisnull |
31863187+----+----------------------------------------------+-------------------+
31873188</ PRE >
@@ -3235,7 +3236,7 @@ <H3>Dump database table entries</H3>
32353236| 1 | luther | blissett |
32363237| 2 | fluffy | bunny |
32373238| 3 | wu | ming |
3238- | 4 | sqlmap/0.6.3 (http://sqlmap.sourceforge.net) | user agent header |
3239+ | 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
32393240| 5 | | nameisnull |
32403241+----+----------------------------------------------+-------------------+
32413242
@@ -3248,7 +3249,7 @@ <H3>Dump database table entries</H3>
32483249"1","luther","blissett"
32493250"2","fluffy","bunny"
32503251"3","wu","ming"
3251- "4","sqlmap/0.6.3 (http://sqlmap.sourceforge.net)","user agent header"
3252+ "4","sqlmap/0.6.4 (http://sqlmap.sourceforge.net)","user agent header"
32523253"5","","nameisnull"
32533254</ PRE >
32543255</ CODE > </ BLOCKQUOTE >
@@ -3278,7 +3279,7 @@ <H3>Dump database table entries</H3>
32783279+----+----------------------------------------------+-------------------+
32793280| 2 | fluffy | bunny |
32803281| 3 | wu | ming |
3281- | 4 | sqlmap/0.6.3 (http://sqlmap.sourceforge.net) | user agent header |
3282+ | 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
32823283+----+----------------------------------------------+-------------------+
32833284</ PRE >
32843285</ CODE > </ BLOCKQUOTE >
@@ -3309,7 +3310,7 @@ <H3>Dump all databases tables entries</H3>
33093310| 1 | luther | blissett |
33103311| 2 | fluffy | bunny |
33113312| 3 | wu | ming |
3312- | 4 | sqlmap/0.6.3 (http://sqlmap.sourceforge.net) | user agent header |
3313+ | 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
33133314| 5 | NULL | nameisnull |
33143315+----+----------------------------------------------+-------------------+
33153316
@@ -3399,7 +3400,7 @@ <H3>Dump all databases tables entries</H3>
33993400+----+----------------------------------------------+-------------------+
34003401| id | name | surname |
34013402+----+----------------------------------------------+-------------------+
3402- | 4 | sqlmap/0.6.3 (http://sqlmap.sourceforge.net) | user agent header |
3403+ | 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
34033404| 2 | fluffy | bunny |
34043405| 1 | luther | blisset |
34053406| 3 | wu | ming |
@@ -3962,7 +3963,7 @@ <H3>Update sqlmap to the latest stable version</H3>
39623963[hh:mm:55] [TRAFFIC OUT] HTTP request:
39633964GET /doc/VERSION HTTP/1.1
39643965Host: sqlmap.sourceforge.net
3965- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
3966+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
39663967Connection: close
39673968
39683969[hh:mm:55] [TRAFFIC IN] HTTP response (OK - 200):
@@ -3981,7 +3982,7 @@ <H3>Update sqlmap to the latest stable version</H3>
39813982[hh:mm:56] [TRAFFIC OUT] HTTP request:
39823983GET /FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx HTTP/1.1
39833984Host: www.sqlsecurity.com
3984- User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
3985+ User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
39853986Cookie: .ASPXANONYMOUS=dvus03cqyQEkAAAANDI0M2QzZmUtOGRkOS00ZDQxLThhMTUtN2ExMWJiNWVjN2My0;
39863987language=en-US
39873988Connection: close
0 commit comments