Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6e548eb

Browse files
bdamelebdamele
committed
Completed support to get the list of targets from WebScarab/Burp proxies
log file and updated the documentation
1 parent 785352d commit 6e548eb

13 files changed

Lines changed: 204 additions & 138 deletions

File tree

‎doc/ChangeLog‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ sqlmap (0.6.3-1) stable; urgency=low
33
* Major enhancement to support stacked queries when the web application
44
supports it which will be used in the long run by takeover
55
functionality;
6+
* Major enhancement to get list of targets to test from Burp proxy
7+
(http://portswigger.net/suite/) requests log file path or WebScarab
8+
proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project)
9+
'conversations/' folder path;
610
* Minor enhancement to test if the injectable parameter is affected by
711
a time based blind SQL injection technique;
812
* Minor enhancement to fingerprint the web server operating system and
@@ -28,6 +32,7 @@ sqlmap (0.6.3-1) stable; urgency=low
2832
* Minor bug fix to correctly enumerate columns on Microsoft SQL Server;
2933
* Minor bug fix to correctly dump table entries when the column is
3034
provided;
35+
* Updated documentation.
3136

3237
-- Bernardo Damele A. G. <[email protected]> Day, X YYY 2008 10:00:00 +0000
3338

@@ -218,14 +223,14 @@ sqlmap (0.4-1) stable; urgency=low
218223
the remote DBMS;
219224
* Major improvements in union.UnionCheck() and union.UnionUse()
220225
functions to make it possible to exploit inband SQL injection also
221-
with database comment characters ('--' and '#') in UNION SELECT
226+
with database comment characters ('--' and '#') in UNION query
222227
statements;
223228
* Added the possibility to save the output into a file while performing
224229
the queries (-o OUTPUTFILE) so it is possible to stop and resume the
225230
same query output retrieving in a second time (--resume);
226231
* Added support to specify the database table column to enumerate
227232
(-C COL);
228-
* Added inband SQL injection (UNION SELECT) support (--union-use);
233+
* Added inband SQL injection (UNION query) support (--union-use);
229234
* Complete code refactoring, a lot of minor and some major fixes in
230235
libraries, many minor improvements;
231236
* Reviewed the directory tree structure;

‎doc/README.html‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
<H1>sqlmap user's manual</H1>
99

1010
<H2>by
11-
<A HREF="mailto:[email protected]">Bernardo Damele A. G.</A></H2>version 0.6.3, DDth of November 2008
11+
<A HREF="mailto:[email protected]">Bernardo Damele A. G.</A></H2>version 0.6.3, DDth of December 2008
1212
<HR>
1313
<EM>This document is the user's manual to use
1414
<A HREF="http://sqlmap.sourceforge.net">sqlmap</A>.
@@ -349,7 +349,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
349349
sqlmap/0.6.3 coded by Bernardo Damele A. G. &lt;[email protected]>
350350
and Daniele Bellucci &lt;[email protected]>
351351

352-
Usage: sqlmap.py [options] {-u &lt;URL> | -g &lt;google dork> | -c &lt;config file>}
352+
Usage: sqlmap.py [options] {-u "&lt;URL>" | -g "&lt;google dork>" | -c "&lt;config file>"}
353353

354354
Options:
355355
--version show program's version number and exit
@@ -384,8 +384,8 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
384384
using the default blind SQL injection technique.
385385

386386
--time-test Test for Time based blind SQL injection
387-
--union-test Test for UNION SELECT (inband) SQL injection
388-
--union-use Use the UNION SELECT (inband) SQL injection to
387+
--union-test Test for UNION query (inband) SQL injection
388+
--union-use Use the UNION query (inband) SQL injection to
389389
retrieve the queries output. No need to go blind
390390

391391
Fingerprint:
@@ -487,7 +487,7 @@ <H3>Target URL and verbosity</H3>
487487
<P>
488488
<BLOCKQUOTE><CODE>
489489
<PRE>
490-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 1
490+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 1
491491

492492
[hh:mm:01] [INFO] testing connection to the target url
493493
[hh:mm:01] [INFO] testing if the url is stable, wait a few seconds
@@ -525,7 +525,7 @@ <H3>Target URL and verbosity</H3>
525525
<P>
526526
<BLOCKQUOTE><CODE>
527527
<PRE>
528-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 2
528+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 2
529529

530530
[hh:mm:34] [DEBUG] initializing the configuration
531531
[hh:mm:34] [DEBUG] initializing the knowledge base
@@ -548,7 +548,7 @@ <H3>Target URL and verbosity</H3>
548548
<P>
549549
<BLOCKQUOTE><CODE>
550550
<PRE>
551-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 3
551+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 3
552552

553553
[...]
554554
[hh:mm:28] [INFO] testing connection to the target url
@@ -575,7 +575,7 @@ <H3>Target URL and verbosity</H3>
575575
<P>
576576
<BLOCKQUOTE><CODE>
577577
<PRE>
578-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 4
578+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 4
579579

580580
[...]
581581
[hh:mm:32] [INFO] testing connection to the target url
@@ -620,7 +620,7 @@ <H3>Target URL and verbosity</H3>
620620
<P>
621621
<BLOCKQUOTE><CODE>
622622
<PRE>
623-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 5
623+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 5
624624

625625
[...]
626626
[hh:mm:23] [INFO] testing connection to the target url
@@ -675,6 +675,13 @@ <H3>Target URL and verbosity</H3>
675675
</P>
676676

677677

678+
<H3>List of targets</H3>
679+
680+
<P>Option: <CODE>-l</CODE></P>
681+
682+
<P>TODO</P>
683+
684+
678685
<H3>Process Google dork results as target urls</H3>
679686

680687
<P>Option: <CODE>-g</CODE></P>
@@ -733,7 +740,7 @@ <H3>Testable parameter(s)</H3>
733740
<BLOCKQUOTE><CODE>
734741
<PRE>
735742
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&amp;cat=2" -v 1 \
736-
-p id
743+
-p "id"
737744

738745
[hh:mm:48] [INFO] testing connection to the target url
739746
[hh:mm:48] [INFO] testing if the url is stable, wait a few seconds
@@ -769,7 +776,7 @@ <H3>Testable parameter(s)</H3>
769776
<BLOCKQUOTE><CODE>
770777
<PRE>
771778
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 1 \
772-
-p user-agent --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
779+
-p "user-agent" --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
773780

774781
[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
775782
[hh:mm:40] [INFO] testing connection to the target url
@@ -816,7 +823,7 @@ <H3>HTTP method: <CODE>GET</CODE> or <CODE>POST</CODE></H3>
816823
<P>
817824
<BLOCKQUOTE><CODE>
818825
<PRE>
819-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/oracle/post_int.php --method POST \
826+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/post_int.php" --method POST \
820827
--data "id=1&amp;cat=2"
821828

822829
[hh:mm:53] [INFO] testing connection to the target url
@@ -1216,7 +1223,7 @@ <H3>Test for Time Based Blind SQL injection</H3>
12161223
<P>TODO</P>
12171224

12181225

1219-
<H3>Test for UNION SELECT query SQL injection</H3>
1226+
<H3>Test for UNION query SQL injection</H3>
12201227

12211228
<P>Option: <CODE>--union-test</CODE></P>
12221229

@@ -1266,7 +1273,7 @@ <H3>Test for UNION SELECT query SQL injection</H3>
12661273
In case this vulnerability is exploitable it is strongly recommended to
12671274
use it.</P>
12681275

1269-
<H3>Use the UNION SELECT query SQL injection</H3>
1276+
<H3>Use the UNION query SQL injection</H3>
12701277

12711278
<P>Option: <CODE>--union-use</CODE></P>
12721279

‎doc/README.pdf‎

398 Bytes
Binary file not shown.

‎doc/README.sgml‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
<title>sqlmap user's manual
66
<author>by <htmlurl url="mailto:[email protected]" name="Bernardo Damele A. G.">
7-
<date>version 0.6.3, DDth of November 2008
7+
<date>version 0.6.3, DDth of December 2008
88
<abstract>
99
This document is the user's manual to use <htmlurl url="http://sqlmap.sourceforge.net" name="sqlmap">.
1010
Check the project <htmlurl url="http://sqlmap.sourceforge.net" name="homepage">
@@ -309,7 +309,7 @@ $ python sqlmap.py -h
309309
sqlmap/0.6.3 coded by Bernardo Damele A. G. <[email protected]>
310310
and Daniele Bellucci <[email protected]>
311311

312-
Usage: sqlmap.py [options] {-u <URL> | -g <google dork> | -c <config file>}
312+
Usage: sqlmap.py [options] {-u "<URL>" | -g "<google dork>" | -c "<config file>"}
313313

314314
Options:
315315
--version show program's version number and exit
@@ -344,8 +344,8 @@ Options:
344344
using the default blind SQL injection technique.
345345

346346
--time-test Test for Time based blind SQL injection
347-
--union-test Test for UNION SELECT (inband) SQL injection
348-
--union-use Use the UNION SELECT (inband) SQL injection to
347+
--union-test Test for UNION query (inband) SQL injection
348+
--union-use Use the UNION query (inband) SQL injection to
349349
retrieve the queries output. No need to go blind
350350

351351
Fingerprint:
@@ -446,7 +446,7 @@ headers and level 5 show also HTTP responses page content.
446446
Example on a <bf>MySQL 5.0.51</bf> target (verbosity level <bf>1</bf>):
447447

448448
<tscreen><verb>
449-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 1
449+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 1
450450

451451
[hh:mm:01] [INFO] testing connection to the target url
452452
[hh:mm:01] [INFO] testing if the url is stable, wait a few seconds
@@ -482,7 +482,7 @@ back-end DBMS: MySQL >= 5.0.0
482482
Example on a <bf>MySQL 5.0.51</bf> target (verbosity level <bf>2</bf>):
483483

484484
<tscreen><verb>
485-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 2
485+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 2
486486

487487
[hh:mm:34] [DEBUG] initializing the configuration
488488
[hh:mm:34] [DEBUG] initializing the knowledge base
@@ -503,7 +503,7 @@ $ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat
503503
Example on a <bf>MySQL 5.0.51</bf> target (verbosity level <bf>3</bf>):
504504

505505
<tscreen><verb>
506-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 3
506+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 3
507507

508508
[...]
509509
[hh:mm:28] [INFO] testing connection to the target url
@@ -528,7 +528,7 @@ Connection: close
528528
Example on a <bf>MySQL 5.0.51</bf> target (verbosity level <bf>4</bf>):
529529

530530
<tscreen><verb>
531-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 4
531+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 4
532532

533533
[...]
534534
[hh:mm:32] [INFO] testing connection to the target url
@@ -571,7 +571,7 @@ Content-Type: text/html
571571
Example on a <bf>MySQL 5.0.51</bf> target (verbosity level <bf>5</bf>):
572572

573573
<tscreen><verb>
574-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2 -v 5
574+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 5
575575

576576
[...]
577577
[hh:mm:23] [INFO] testing connection to the target url
@@ -624,6 +624,15 @@ Content-Type: text/html
624624
</verb></tscreen>
625625

626626

627+
<sect2>List of targets
628+
629+
<p>
630+
Option: <tt>-l</tt>
631+
632+
<p>
633+
TODO
634+
635+
627636
<sect2>Process Google dork results as target urls
628637

629638
<p>
@@ -685,7 +694,7 @@ Example on a <bf>PostgreSQL 8.2.7</bf> target:
685694

686695
<tscreen><verb>
687696
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&amp;cat=2" -v 1 \
688-
-p id
697+
-p "id"
689698

690699
[hh:mm:48] [INFO] testing connection to the target url
691700
[hh:mm:48] [INFO] testing if the url is stable, wait a few seconds
@@ -718,7 +727,7 @@ Example on a <bf>MySQL 5.0.51</bf> target:
718727

719728
<tscreen><verb>
720729
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&amp;cat=2" -v 1 \
721-
-p user-agent --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
730+
-p "user-agent" --user-agent "sqlmap/0.6.3 (http://sqlmap.sourceforge.net)"
722731

723732
[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
724733
[hh:mm:40] [INFO] testing connection to the target url
@@ -765,7 +774,7 @@ tested for SQL injection like the <tt>GET</tt> parameters.
765774
Example on an <bf>Oracle XE 10.2.0.1</bf> target:
766775

767776
<tscreen><verb>
768-
$ python sqlmap.py -u http://192.168.1.121/sqlmap/oracle/post_int.php --method POST \
777+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/post_int.php" --method POST \
769778
--data "id=1&amp;cat=2"
770779

771780
[hh:mm:53] [INFO] testing connection to the target url
@@ -1158,7 +1167,7 @@ Option: <tt>--time-test</tt>
11581167
TODO
11591168

11601169

1161-
<sect2>Test for UNION SELECT query SQL injection
1170+
<sect2>Test for UNION query SQL injection
11621171

11631172
<p>
11641173
Option: <tt>--union-test</tt>
@@ -1207,7 +1216,7 @@ affected by an inband SQL injection.
12071216
In case this vulnerability is exploitable it is strongly recommended to
12081217
use it.
12091218

1210-
<sect2>Use the UNION SELECT query SQL injection
1219+
<sect2>Use the UNION query SQL injection
12111220

12121221
<p>
12131222
Option: <tt>--union-use</tt>

‎doc/THANKS‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,11 @@ Will Holcomb <[email protected]>
5151
Luke Jahnke <[email protected]>
5252
for reporting a bug when running against MySQL < 5.0
5353

54+
Anant Kochhar <[email protected]>
55+
for providing me with feedback on the user's manual
56+
5457
Nico Leidecker <[email protected]>
55-
for providing with feedback on a few features
58+
for providing me with feedback on a few features
5659

5760
Pavol Luptak <[email protected]>
5861
for reporting a bug when injecting on a POST data parameter
@@ -62,6 +65,10 @@ Michael Majchrowicz <[email protected]>
6265
for providing really appreciated feedback
6366
for suggesting a lot of ideas and features
6467

68+
Ferruh Mavituna <[email protected]>
69+
for providing me with ideas on the implementation on a couple of
70+
new features
71+
6572
Enrico Milanese <[email protected]>
6673
for reporting a bugs when using (-a) a single line User-Agent file
6774
for providing me with some ideas for the PHP backdoor

0 commit comments

Comments
 (0)