Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 374b9ba

Browse files
bdamelebdamele
committed
Updated documentation based upon recent developments
1 parent 35708a0 commit 374b9ba

4 files changed

Lines changed: 66 additions & 40 deletions

File tree

‎doc/README.html‎

Lines changed: 30 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -181,35 +181,44 @@ <H2><A NAME="ss1.2">1.2</A> <A HREF="#toc1.2">Scenario</A>
181181
<H2><A NAME="ss1.3">1.3</A> <A HREF="#toc1.3">Techniques</A>
182182
</H2>
183183

184-
<P>sqlmap implements two techniques to exploit a SQL injection vulnerability:</P>
184+
<P>sqlmap implements three techniques to exploit a SQL injection
185+
vulnerability:</P>
185186
<P>
186187
<UL>
187-
<LI><B>Blind SQL injection</B>, also known as <B>Inferential Blind SQL
188-
injection</B> in this implementation: sqlmap appends to the affected
189-
parameter in the HTTP request, a syntatically valid SQL statement string
190-
containing a <CODE>SELECT</CODE> sub-statement, or any other SQL statement
191-
whose the user want to retrieve the output.
188+
<LI><B>Inferential Blind SQL injection</B>: sqlmap appends to the
189+
affected parameter in the HTTP request, a syntatically valid SQL statement
190+
string containing a <CODE>SELECT</CODE> sub-statement, or any other SQL
191+
statement whose the user want to retrieve the output.
192192
For each HTTP response, by making a comparison based upon HTML page
193193
content hashes, or string matches, with the original request, the tool
194194
determines the output value of the statement character by character.
195195
The bisection algorithm implemented in sqlmap to perform this technique
196196
is able to fetch each output character with at maximum seven HTTP
197197
requests.
198198
This is sqlmap default SQL injection technique.</LI>
199-
<LI><B>Inband SQL injection</B>, also known as <B>Full UNION query SQL
200-
injection</B>: sqlmap appends to the affected parameter in the HTTP
201-
request, a syntatically valid SQL statement string starting with a
202-
<CODE>UNION ALL SELECT</CODE>. This techique is useful if the web application
203-
page passes the output of the <CODE>SELECT</CODE> statement to a <CODE>for</CODE>
204-
cycle, or similar, so that each line of the query output is printed on the
205-
page content.
199+
<LI><B>UNION query (inband) SQL injection</B>, also known as <B>Full
200+
UNION query SQL injection</B>: sqlmap appends to the affected parameter
201+
in the HTTP request, a syntatically valid SQL statement string starting
202+
with a <CODE>UNION ALL SELECT</CODE>. This techique is useful if the web
203+
application page passes the output of the <CODE>SELECT</CODE> statement to a
204+
<CODE>for</CODE> cycle, or similar, so that each line of the query output is
205+
printed on the page content.
206206
sqlmap is also able to exploit <B>Partial UNION query SQL injection</B>
207207
vulnerabilities which occur when the output of the statement is not cycled
208208
in a for construct whereas only the first entry output is displayed.
209209
This technique is much faster if the target url is affected by because
210210
in a single HTTP response it returns the whole query output or a entry
211211
per each response within the page content.
212212
This SQL injection technique is an alternative to the first one.</LI>
213+
<LI><B>Stacked queries support</B>, also known as <B>multiple
214+
statements support</B>: sqlmap tests if the web application supports
215+
stacked queries then, in case it does support, it appends to the affected
216+
parameter in the HTTP request, a semi-colon (<CODE>;</CODE>) followed by the
217+
SQL statement to be executed. This technique is useful if to run SQL
218+
statements other than <CODE>SELECT</CODE> like, for instance, <EM>data
219+
definition</EM> or <EM>data manipulation</EM> statements possibly leading
220+
to file system read and write access and operating system command
221+
execution depending on the underlying back-end database management system.</LI>
213222
</UL>
214223
</P>
215224
<P>It is strongly recommended to run at least once sqlmap with the
@@ -241,16 +250,17 @@ <H2><A NAME="s2">2.</A> <A HREF="#toc2">Features</A></H2>
241250
to fingerprint the web server operating system, the web application
242251
technology and, in some circumstances, the back-end DBMS operating system.
243252
</LI>
244-
<LI>Full support for two SQL injection techniques: <B>blind SQL
245-
injection</B> and <B>inband SQL injection</B>. sqlmap can also test for
246-
<B>Time based blind SQL injection</B>.
253+
<LI>Full support for three SQL injection techniques: <B> inferential
254+
blind SQL injection</B>, <B>UNION query (inband) SQL injection</B> and
255+
<B>stacked queries (multiple statements) support</B>. sqlmap can also
256+
test for <B>time based blind SQL injection</B>.
247257
</LI>
248258
<LI>Options to retrieve on all four back-end database management system
249259
<B>banner</B>, <B>current user</B>, <B>current database</B>,
250260
enumerate <B>users</B>, <B>users password hashes</B>, <B>users
251261
privileges</B>, <B>databases</B>, <B>tables</B>, <B>columns</B>,
252262
dump <B>tables entries</B>, dump <B>whole database management
253-
system</B> and run your <B>own SQL <CODE>SELECT</CODE> statement</B>.
263+
system</B> and run your <B>own SQL statement</B>.
254264
</LI>
255265
<LI>If the back-end database management system is MySQL it is also
256266
possible to <B>read a specific file content</B> from the ile system and,
@@ -460,7 +470,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
460470
Enumeration:
461471
These options can be used to enumerate the back-end database
462472
management system information, structure and data contained in the
463-
tables. Moreover you can run your own SQL SELECT queries.
473+
tables. Moreover you can run your own SQL statements.
464474

465475
-b, --banner Retrieve DBMS banner
466476
--current-user Retrieve DBMS current user
@@ -481,7 +491,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
481491
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
482492
--start=LIMITSTART First table entry to dump
483493
--stop=LIMITSTOP Last table entry to dump
484-
--sql-query=QUERY SQL SELECT query to be executed
494+
--sql-query=QUERY SQL statement to be executed
485495
--sql-shell Prompt for an interactive SQL shell
486496

487497
File system access:
@@ -3406,7 +3416,7 @@ <H3>Dump all databases tables entries</H3>
34063416
as a users' database.</P>
34073417

34083418

3409-
<H3>Run your own SQL SELECT statement</H3>
3419+
<H3>Run your own SQL statement</H3>
34103420

34113421
<P>Options: <CODE>--sql-query</CODE> and <CODE>--sql-shell</CODE></P>
34123422

‎doc/README.pdf‎

1.35 KB
Binary file not shown.

‎doc/README.sgml‎

Lines changed: 32 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -138,35 +138,44 @@ in the following section to go ahead with the exploiting.
138138
<sect1>Techniques
139139

140140
<p>
141-
sqlmap implements two techniques to exploit a SQL injection vulnerability:
141+
sqlmap implements three techniques to exploit a SQL injection
142+
vulnerability:
142143

143144
<itemize>
144-
<item><bf>Blind SQL injection</bf>, also known as <bf>Inferential Blind SQL
145-
injection</bf> in this implementation: sqlmap appends to the affected
146-
parameter in the HTTP request, a syntatically valid SQL statement string
147-
containing a <tt>SELECT</tt> sub-statement, or any other SQL statement
148-
whose the user want to retrieve the output.
145+
<item><bf>Inferential Blind SQL injection</bf>: sqlmap appends to the
146+
affected parameter in the HTTP request, a syntatically valid SQL statement
147+
string containing a <tt>SELECT</tt> sub-statement, or any other SQL
148+
statement whose the user want to retrieve the output.
149149
For each HTTP response, by making a comparison based upon HTML page
150150
content hashes, or string matches, with the original request, the tool
151151
determines the output value of the statement character by character.
152152
The bisection algorithm implemented in sqlmap to perform this technique
153153
is able to fetch each output character with at maximum seven HTTP
154154
requests.
155155
This is sqlmap default SQL injection technique.
156-
<item><bf>Inband SQL injection</bf>, also known as <bf>Full UNION query SQL
157-
injection</bf>: sqlmap appends to the affected parameter in the HTTP
158-
request, a syntatically valid SQL statement string starting with a
159-
<tt>UNION ALL SELECT</tt>. This techique is useful if the web application
160-
page passes the output of the <tt>SELECT</tt> statement to a <tt>for</tt>
161-
cycle, or similar, so that each line of the query output is printed on the
162-
page content.
156+
<item><bf>UNION query (inband) SQL injection</bf>, also known as <bf>Full
157+
UNION query SQL injection</bf>: sqlmap appends to the affected parameter
158+
in the HTTP request, a syntatically valid SQL statement string starting
159+
with a <tt>UNION ALL SELECT</tt>. This techique is useful if the web
160+
application page passes the output of the <tt>SELECT</tt> statement to a
161+
<tt>for</tt> cycle, or similar, so that each line of the query output is
162+
printed on the page content.
163163
sqlmap is also able to exploit <bf>Partial UNION query SQL injection</bf>
164164
vulnerabilities which occur when the output of the statement is not cycled
165165
in a for construct whereas only the first entry output is displayed.
166166
This technique is much faster if the target url is affected by because
167167
in a single HTTP response it returns the whole query output or a entry
168168
per each response within the page content.
169169
This SQL injection technique is an alternative to the first one.
170+
<item><bf>Stacked queries support</bf>, also known as <bf>multiple
171+
statements support</bf>: sqlmap tests if the web application supports
172+
stacked queries then, in case it does support, it appends to the affected
173+
parameter in the HTTP request, a semi-colon (<tt>;</tt>) followed by the
174+
SQL statement to be executed. This technique is useful if to run SQL
175+
statements other than <tt>SELECT</tt> like, for instance, <em>data
176+
definition</em> or <em>data manipulation</em> statements possibly leading
177+
to file system read and write access and operating system command
178+
execution depending on the underlying back-end database management system.
170179
</itemize>
171180

172181
It is strongly recommended to run at least once sqlmap with the
@@ -199,16 +208,17 @@ database management system name if you already know it. sqlmap is also able
199208
to fingerprint the web server operating system, the web application
200209
technology and, in some circumstances, the back-end DBMS operating system.
201210

202-
<item>Full support for two SQL injection techniques: <bf>blind SQL
203-
injection</bf> and <bf>inband SQL injection</bf>. sqlmap can also test for
204-
<bf>Time based blind SQL injection</bf>.
211+
<item>Full support for three SQL injection techniques: <bf> inferential
212+
blind SQL injection</bf>, <bf>UNION query (inband) SQL injection</bf> and
213+
<bf>stacked queries (multiple statements) support</bf>. sqlmap can also
214+
test for <bf>time based blind SQL injection</bf>.
205215

206216
<item>Options to retrieve on all four back-end database management system
207217
<bf>banner</bf>, <bf>current user</bf>, <bf>current database</bf>,
208218
enumerate <bf>users</bf>, <bf>users password hashes</bf>, <bf>users
209219
privileges</bf>, <bf>databases</bf>, <bf>tables</bf>, <bf>columns</bf>,
210220
dump <bf>tables entries</bf>, dump <bf>whole database management
211-
system</bf> and run your <bf>own SQL <tt>SELECT</tt> statement</bf>.
221+
system</bf> and run your <bf>own SQL statement</bf>.
212222

213223
<item>If the back-end database management system is MySQL it is also
214224
possible to <bf>read a specific file content</bf> from the ile system and,
@@ -416,7 +426,7 @@ Options:
416426
Enumeration:
417427
These options can be used to enumerate the back-end database
418428
management system information, structure and data contained in the
419-
tables. Moreover you can run your own SQL SELECT queries.
429+
tables. Moreover you can run your own SQL statements.
420430

421431
-b, --banner Retrieve DBMS banner
422432
--current-user Retrieve DBMS current user
@@ -437,7 +447,7 @@ Options:
437447
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
438448
--start=LIMITSTART First table entry to dump
439449
--stop=LIMITSTOP Last table entry to dump
440-
--sql-query=QUERY SQL SELECT query to be executed
450+
--sql-query=QUERY SQL statement to be executed
441451
--sql-shell Prompt for an interactive SQL shell
442452

443453
File system access:
@@ -3310,7 +3320,9 @@ considered a system database because some database administrators use it
33103320
as a users' database.
33113321

33123322

3313-
<sect2>Run your own SQL SELECT statement
3323+
<sect2>Run your own SQL statement
3324+
3325+
<!-- TODO: improve -->
33143326

33153327
<p>
33163328
Options: <tt>--sql-query</tt> and <tt>--sql-shell</tt>

‎doc/THANKS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,10 @@ Sven Schluter <[email protected]>
116116
for providing with a patch for waiting a number of seconds between
117117
each HTTP request
118118

119+
Sumit Siddharth <[email protected]>
120+
for providing me with ideas on the implementation on a couple of
121+
features
122+
119123
M Simkin <[email protected]>
120124
for suggesting a feature
121125

0 commit comments

Comments
 (0)