Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 32ca99d

Browse files
stamparmstamparm
committed
minor update of FAQ files
1 parent 17d9cc0 commit 32ca99d

3 files changed

Lines changed: 50 additions & 84 deletions

File tree

‎doc/FAQ.html‎

Lines changed: 39 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -21,22 +21,20 @@ <H2><A NAME="toc1">1.</A> <A HREF="FAQ.html#s1">Frequently Asked Questions</A></
2121
<LI><A NAME="toc1.1">1.1</A> <A HREF="FAQ.html#ss1.1">What is sqlmap?</A>
2222
<LI><A NAME="toc1.2">1.2</A> <A HREF="FAQ.html#ss1.2">How do I execute sqlmap?</A>
2323
<LI><A NAME="toc1.3">1.3</A> <A HREF="FAQ.html#ss1.3">Can I integrate sqlmap with a security tool I am developing?</A>
24-
<LI><A NAME="toc1.4">1.4</A> <A HREF="FAQ.html#ss1.4">How can I integrate sqlmap with my own tool?</A>
25-
<LI><A NAME="toc1.5">1.5</A> <A HREF="FAQ.html#ss1.5">Will you support other database management systems?</A>
26-
<LI><A NAME="toc1.6">1.6</A> <A HREF="FAQ.html#ss1.6">How can I occasionally contribute?</A>
27-
<LI><A NAME="toc1.7">1.7</A> <A HREF="FAQ.html#ss1.7">Can I actively contribute in the long-term development?</A>
28-
<LI><A NAME="toc1.8">1.8</A> <A HREF="FAQ.html#ss1.8">How can I support the development?</A>
29-
<LI><A NAME="toc1.9">1.9</A> <A HREF="FAQ.html#ss1.9">Can you hack a site for me?</A>
30-
<LI><A NAME="toc1.10">1.10</A> <A HREF="FAQ.html#ss1.10">When sqlmap will switch to the Python 3?</A>
31-
<LI><A NAME="toc1.11">1.11</A> <A HREF="FAQ.html#ss1.11">What does <CODE>"WARNING unknown charset '...'"</CODE> mean?</A>
32-
<LI><A NAME="toc1.12">1.12</A> <A HREF="FAQ.html#ss1.12">How to use sqlmap with <CODE>mod_rewrite</CODE> enabled?</A>
33-
<LI><A NAME="toc1.13">1.13</A> <A HREF="FAQ.html#ss1.13">Why is sqlmap not able to get password hashes in some cases?</A>
34-
<LI><A NAME="toc1.14">1.14</A> <A HREF="FAQ.html#ss1.14">What is <CODE>-</CODE><CODE>-text-only</CODE> switch?</A>
35-
<LI><A NAME="toc1.15">1.15</A> <A HREF="FAQ.html#ss1.15">sqlmap is retrieving weird characters for even simplest data (e.g. <CODE>--banner</CODE>)?</A>
36-
<LI><A NAME="toc1.16">1.16</A> <A HREF="FAQ.html#ss1.16">I am getting <CODE>"CRITICAL connection timed"</CODE> while I am able to browse the site normally?</A>
37-
<LI><A NAME="toc1.17">1.17</A> <A HREF="FAQ.html#ss1.17">Is it possible to use <CODE>"INSERT/UPDATE"</CODE> SQL commands via <CODE>-</CODE><CODE>-sql-query</CODE></A>
38-
<LI><A NAME="toc1.18">1.18</A> <A HREF="FAQ.html#ss1.18">I am getting <CODE>"finally: SyntaxError: invalid syntax"</CODE> when trying to run sqlmap?</A>
39-
<LI><A NAME="toc1.19">1.19</A> <A HREF="FAQ.html#ss1.19">sqlmap is not able to detect/exploit injection while other commercial tools are?</A>
24+
<LI><A NAME="toc1.4">1.4</A> <A HREF="FAQ.html#ss1.4">Will you support other database management systems?</A>
25+
<LI><A NAME="toc1.5">1.5</A> <A HREF="FAQ.html#ss1.5">How can I occasionally contribute?</A>
26+
<LI><A NAME="toc1.6">1.6</A> <A HREF="FAQ.html#ss1.6">Can I actively contribute in the long-term development?</A>
27+
<LI><A NAME="toc1.7">1.7</A> <A HREF="FAQ.html#ss1.7">How can I support the development?</A>
28+
<LI><A NAME="toc1.8">1.8</A> <A HREF="FAQ.html#ss1.8">Can you hack a site for me?</A>
29+
<LI><A NAME="toc1.9">1.9</A> <A HREF="FAQ.html#ss1.9">When sqlmap will switch to the Python 3?</A>
30+
<LI><A NAME="toc1.10">1.10</A> <A HREF="FAQ.html#ss1.10">What does <CODE>"WARNING unknown charset '...'"</CODE> mean?</A>
31+
<LI><A NAME="toc1.11">1.11</A> <A HREF="FAQ.html#ss1.11">How to use sqlmap with <CODE>mod_rewrite</CODE> enabled?</A>
32+
<LI><A NAME="toc1.12">1.12</A> <A HREF="FAQ.html#ss1.12">Why is sqlmap not able to get password hashes in some cases?</A>
33+
<LI><A NAME="toc1.13">1.13</A> <A HREF="FAQ.html#ss1.13">What is <CODE>-</CODE><CODE>-text-only</CODE> switch?</A>
34+
<LI><A NAME="toc1.14">1.14</A> <A HREF="FAQ.html#ss1.14">I am getting <CODE>"CRITICAL connection timed"</CODE> while I am able to browse the site normally?</A>
35+
<LI><A NAME="toc1.15">1.15</A> <A HREF="FAQ.html#ss1.15">Is it possible to use <CODE>"INSERT/UPDATE"</CODE> SQL commands via <CODE>-</CODE><CODE>-sql-query</CODE></A>
36+
<LI><A NAME="toc1.16">1.16</A> <A HREF="FAQ.html#ss1.16">I am getting <CODE>"finally: SyntaxError: invalid syntax"</CODE> when trying to run sqlmap?</A>
37+
<LI><A NAME="toc1.17">1.17</A> <A HREF="FAQ.html#ss1.17">sqlmap is not able to detect/exploit injection while other commercial tools are?</A>
4038
</UL>
4139

4240
<HR>
@@ -82,21 +80,15 @@ <H2><A NAME="ss1.3">1.3</A> <A HREF="#toc1.3">Can I integrate sqlmap with a secu
8280

8381
<P>Yes. sqlmap is released under the terms of the GPLv2, which means that any
8482
derivative work must be distributed without further restrictions on the
85-
rights granted by the GPL itself. If this constitutes a problem, feel free
86-
to contact us so we can find a solution.</P>
83+
rights granted by the GPL itself.</P>
8784

88-
<H2><A NAME="ss1.4">1.4</A> <A HREF="#toc1.4">How can I integrate sqlmap with my own tool?</A>
85+
<H2><A NAME="ss1.4">1.4</A> <A HREF="#toc1.4">Will you support other database management systems?</A>
8986
</H2>
9087

91-
<P>TODO</P>
88+
<P>Yes. There are plans to support also Informix and Ingres at some
89+
point of time.</P>
9290

93-
<H2><A NAME="ss1.5">1.5</A> <A HREF="#toc1.5">Will you support other database management systems?</A>
94-
</H2>
95-
96-
<P>Yes. There are plans to support also IBM DB2, Informix and Ingres at some
97-
point.</P>
98-
99-
<H2><A NAME="ss1.6">1.6</A> <A HREF="#toc1.6">How can I occasionally contribute?</A>
91+
<H2><A NAME="ss1.5">1.5</A> <A HREF="#toc1.5">How can I occasionally contribute?</A>
10092
</H2>
10193

10294
<P>All help is greatly appreciated. First of all download the tool, make sure
@@ -108,7 +100,7 @@ <H2><A NAME="ss1.6">1.6</A> <A HREF="#toc1.6">How can I occasionally contribute?
108100
<A HREF="https://svn.sqlmap.org/sqlmap/trunk/sqlmap/doc/THANKS">contributed</A> in different ways to the sqlmap development.
109101
<B>You</B> can be the next!</P>
110102

111-
<H2><A NAME="ss1.7">1.7</A> <A HREF="#toc1.7">Can I actively contribute in the long-term development?</A>
103+
<H2><A NAME="ss1.6">1.6</A> <A HREF="#toc1.6">Can I actively contribute in the long-term development?</A>
112104
</H2>
113105

114106
<P>Yes, we are looking for people who can write some clean Python code, are
@@ -118,27 +110,27 @@ <H2><A NAME="ss1.7">1.7</A> <A HREF="#toc1.7">Can I actively contribute in the l
118110
If this sounds interesting to you,
119111
<A HREF="http://www.sqlmap.org/#developers">get in touch</A>!</P>
120112

121-
<H2><A NAME="ss1.8">1.8</A> <A HREF="#toc1.8">How can I support the development?</A>
113+
<H2><A NAME="ss1.7">1.7</A> <A HREF="#toc1.7">How can I support the development?</A>
122114
</H2>
123115

124116
<P>If you think that sqlmap is a great tool, it really played well during
125117
your penetration tests, or you simply like it, you, or your boss, can
126118
<A HREF="http://www.sqlmap.org/#donate">donate some money</A> to the developers via PayPal.</P>
127119

128-
<H2><A NAME="ss1.9">1.9</A> <A HREF="#toc1.9">Can you hack a site for me?</A>
120+
<H2><A NAME="ss1.8">1.8</A> <A HREF="#toc1.8">Can you hack a site for me?</A>
129121
</H2>
130122

131123
<P><B>No</B>.</P>
132124

133-
<H2><A NAME="ss1.10">1.10</A> <A HREF="#toc1.10">When sqlmap will switch to the Python 3?</A>
125+
<H2><A NAME="ss1.9">1.9</A> <A HREF="#toc1.9">When sqlmap will switch to the Python 3?</A>
134126
</H2>
135127

136-
<P>Currently there is no huge pressure on Python projects to switch to the new
128+
<P>Currently there is no pressure on Python projects to switch to the new
137129
version of Python interpreter, as the process of switching, especially on
138130
larger projects can be cumbersome (due to the few backward incompatibilities).
139131
The switch will take place eventually, but currently it's a very low priority task.</P>
140132

141-
<H2><A NAME="ss1.11">1.11</A> <A HREF="#toc1.11">What does <CODE>"WARNING unknown charset '...'"</CODE> mean?</A>
133+
<H2><A NAME="ss1.10">1.10</A> <A HREF="#toc1.10">What does <CODE>"WARNING unknown charset '...'"</CODE> mean?</A>
142134
</H2>
143135

144136
<P>sqlmap needs to properly decode page content to be able to properly
@@ -156,7 +148,7 @@ <H2><A NAME="ss1.11">1.11</A> <A HREF="#toc1.11">What does <CODE>"WARNING unknow
156148
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1232">#2</A>
157149
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1239">#3</A></P>
158150

159-
<H2><A NAME="ss1.12">1.12</A> <A HREF="#toc1.12">How to use sqlmap with <CODE>mod_rewrite</CODE> enabled?</A>
151+
<H2><A NAME="ss1.11">1.11</A> <A HREF="#toc1.11">How to use sqlmap with <CODE>mod_rewrite</CODE> enabled?</A>
160152
</H2>
161153

162154
<P>Just put * to the place where sqlmap should check for injections in URI
@@ -168,7 +160,7 @@ <H2><A NAME="ss1.12">1.12</A> <A HREF="#toc1.12">How to use sqlmap with <CODE>mo
168160
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/728">#2</A>
169161
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1258">#3</A></P>
170162

171-
<H2><A NAME="ss1.13">1.13</A> <A HREF="#toc1.13">Why is sqlmap not able to get password hashes in some cases?</A>
163+
<H2><A NAME="ss1.12">1.12</A> <A HREF="#toc1.12">Why is sqlmap not able to get password hashes in some cases?</A>
172164
</H2>
173165

174166
<P>You most probably don't have enough permissions for querying on a system
@@ -177,7 +169,7 @@ <H2><A NAME="ss1.13">1.13</A> <A HREF="#toc1.13">Why is sqlmap not able to get p
177169
<P>Question(s):
178170
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/714">#1</A></P>
179171

180-
<H2><A NAME="ss1.14">1.14</A> <A HREF="#toc1.14">What is <CODE>-</CODE><CODE>-text-only</CODE> switch?</A>
172+
<H2><A NAME="ss1.13">1.13</A> <A HREF="#toc1.13">What is <CODE>-</CODE><CODE>-text-only</CODE> switch?</A>
181173
</H2>
182174

183175
<P>Switch <CODE>-</CODE><CODE>-text-only</CODE> is used for removing non-textual data (tags,
@@ -187,19 +179,7 @@ <H2><A NAME="ss1.14">1.14</A> <A HREF="#toc1.14">What is <CODE>-</CODE><CODE>-te
187179
<P>Question(s):
188180
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/699">#1</A></P>
189181

190-
<H2><A NAME="ss1.15">1.15</A> <A HREF="#toc1.15">sqlmap is retrieving weird characters for even simplest data (e.g. <CODE>--banner</CODE>)?</A>
191-
</H2>
192-
193-
<P>If everything you retrieve from the target is garbled, then you are
194-
most probably dealing with false positive blind injection. Please
195-
report the problem to the
196-
<A HREF="mailto:[email protected]">developers</A>.</P>
197-
198-
<P>Question(s):
199-
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/686">#1</A>
200-
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1181">#2</A></P>
201-
202-
<H2><A NAME="ss1.16">1.16</A> <A HREF="#toc1.16">I am getting <CODE>"CRITICAL connection timed"</CODE> while I am able to browse the site normally?</A>
182+
<H2><A NAME="ss1.14">1.14</A> <A HREF="#toc1.14">I am getting <CODE>"CRITICAL connection timed"</CODE> while I am able to browse the site normally?</A>
203183
</H2>
204184

205185
<P>There are few IDSes that filter out all sqlmap requests based on default
@@ -212,16 +192,17 @@ <H2><A NAME="ss1.16">1.16</A> <A HREF="#toc1.16">I am getting <CODE>"CRITICAL co
212192
<P>Question(s):
213193
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1241">#1</A></P>
214194

215-
<H2><A NAME="ss1.17">1.17</A> <A HREF="#toc1.17">Is it possible to use <CODE>"INSERT/UPDATE"</CODE> SQL commands via <CODE>-</CODE><CODE>-sql-query</CODE></A>
195+
<H2><A NAME="ss1.15">1.15</A> <A HREF="#toc1.15">Is it possible to use <CODE>"INSERT/UPDATE"</CODE> SQL commands via <CODE>-</CODE><CODE>-sql-query</CODE></A>
216196
and/or <CODE>-</CODE><CODE>-sql-shell</CODE>?</H2>
217197

218198
<P>It is possible to use those commands, but only if the stacked injection is supported
219-
by the vulnerable target.</P>
199+
by the vulnerable target. In vast majority of cases affected DBMSes by these kind of
200+
attacks are Microsoft SQL Server and PostgreSQL.</P>
220201

221202
<P>Question(s):
222203
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1237">#1</A></P>
223204

224-
<H2><A NAME="ss1.18">1.18</A> <A HREF="#toc1.18">I am getting <CODE>"finally: SyntaxError: invalid syntax"</CODE> when trying to run sqlmap?</A>
205+
<H2><A NAME="ss1.16">1.16</A> <A HREF="#toc1.16">I am getting <CODE>"finally: SyntaxError: invalid syntax"</CODE> when trying to run sqlmap?</A>
225206
</H2>
226207

227208
<P>You are most probably using outdated version of Python. sqlmap is generally
@@ -231,13 +212,14 @@ <H2><A NAME="ss1.18">1.18</A> <A HREF="#toc1.18">I am getting <CODE>"finally: Sy
231212
<P>Question(s):
232213
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/1231">#1</A></P>
233214

234-
<H2><A NAME="ss1.19">1.19</A> <A HREF="#toc1.19">sqlmap is not able to detect/exploit injection while other commercial tools are?</A>
215+
<H2><A NAME="ss1.17">1.17</A> <A HREF="#toc1.17">sqlmap is not able to detect/exploit injection while other commercial tools are?</A>
235216
</H2>
236217

237-
<P>Currently there are only two of us working on a pure good will and donating our
238-
free time to the community. If you are not willing to help us achive better tool
239-
you are strongly advised to buy those commercial tool(s) and just
240-
forget about the sqlmap.</P>
218+
<P>In most of those kind of cases blatant error message detection is used by commercial
219+
tools making some "false positive" claims. You have to be aware that
220+
DBMS error message doesn't mean that the affected web application is vulnerable to
221+
SQL injection attacks. sqlmap goes several steps further and never claims
222+
an injection point without making through tests if it can be exploited at the first place. </P>
241223

242224
<P>Question(s):
243225
<A HREF="http://thread.gmane.org/gmane.comp.security.sqlmap/970">#1</A></P>

‎doc/FAQ.pdf‎

-4.25 KB
Binary file not shown.

‎doc/FAQ.sgml‎

Lines changed: 11 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -50,19 +50,13 @@ url="http://www.python.org" name="Python"> <bf>>= 2.6</bf>.
5050
<p>
5151
Yes. sqlmap is released under the terms of the GPLv2, which means that any
5252
derivative work must be distributed without further restrictions on the
53-
rights granted by the GPL itself. If this constitutes a problem, feel free
54-
to contact us so we can find a solution.
55-
56-
<sect1>How can I integrate sqlmap with my own tool?
57-
58-
<p>
59-
TODO
53+
rights granted by the GPL itself.
6054

6155
<sect1>Will you support other database management systems?
6256

6357
<p>
64-
Yes. There are plans to support also IBM DB2, Informix and Ingres at some
65-
point.
58+
Yes. There are plans to support also Informix and Ingres at some
59+
point of time.
6660

6761
<sect1>How can I occasionally contribute?
6862

@@ -104,7 +98,7 @@ some money"> to the developers via PayPal.
10498
<sect1>When sqlmap will switch to the Python 3?
10599

106100
<p>
107-
Currently there is no huge pressure on Python projects to switch to the new
101+
Currently there is no pressure on Python projects to switch to the new
108102
version of Python interpreter, as the process of switching, especially on
109103
larger projects can be cumbersome (due to the few backward incompatibilities).
110104
The switch will take place eventually, but currently it's a very low priority task.
@@ -162,18 +156,6 @@ improve detection capabilities.
162156
Question(s):
163157
<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/699" name="#1">
164158

165-
<sect1>sqlmap is retrieving weird characters for even simplest data (e.g. <tt>--banner</tt>)?
166-
167-
<p>
168-
If everything you retrieve from the target is garbled, then you are
169-
most probably dealing with false positive blind injection. Please
170-
report the problem to the <htmlurl url="mailto:[email protected]" name="developers">.
171-
172-
<p>
173-
Question(s):
174-
<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/686" name="#1">
175-
<htmlurl url="http://thread.gmane.org/gmane.comp.security.sqlmap/1181" name="#2">
176-
177159
<sect1>I am getting <tt>"CRITICAL connection timed"</tt> while I am able to browse
178160
the site normally?
179161

@@ -194,7 +176,8 @@ and/or <tt>-</tt><tt>-sql-shell</tt>?
194176

195177
<p>
196178
It is possible to use those commands, but only if the stacked injection is supported
197-
by the vulnerable target.
179+
by the vulnerable target. In vast majority of cases affected DBMSes by these kind of
180+
attacks are Microsoft SQL Server and PostgreSQL.
198181

199182
<p>
200183
Question(s):
@@ -214,10 +197,11 @@ Question(s):
214197
<sect1>sqlmap is not able to detect/exploit injection while other commercial tools are?
215198

216199
<p>
217-
Currently there are only two of us working on a pure good will and donating our
218-
free time to the community. If you are not willing to help us achive better tool
219-
you are strongly advised to buy those commercial tool(s) and just
220-
forget about the sqlmap.
200+
In most of those kind of cases blatant error message detection is used by commercial
201+
tools making some "false positive" claims. You have to be aware that
202+
DBMS error message doesn't mean that the affected web application is vulnerable to
203+
SQL injection attacks. sqlmap goes several steps further and never claims
204+
an injection point without making through tests if it can be exploited at the first place.
221205

222206
<p>
223207
Question(s):

0 commit comments

Comments
 (0)