* Implemented mechanism for proper data dumping on DBMSes not supporting ```LIMIT/OFFSET``` like mechanism(s) (e.g. Microsoft SQL Server, Sybase, etc.).

* Added option ```-m``` for scanning multiple targets enlisted in a given textual file.

* Added option ```--randomize``` for randomly changing value of a given parameter(s) based on it's original form.

* Added switch ```--force-ssl``` for forcing usage of SSL/HTTPS requests.

* Added option ```--host``` for manually setting HTTP Host header value.

* Added option ```--eval``` for evaluating provided Python code (with resulting parameter values) right before the request itself.

* Added option ```--skip``` for skipping tests for given parameter(s).

* Added switch ```--titles``` for comparing pages based only on their titles.

* Added option ```--charset``` for forcing character encoding used for data retrieval.

* Added switch ```--check-tor``` for checking if Tor is used properly.

* Added option ```--crawl``` for multithreaded crawling of a given website starting from the target url.

* Added option ```--csv-del``` for manually setting delimiting character used in CSV output.

* Added switch ```--hex``` for using DBMS hex conversion function(s) for data retrieval.

* Added switch ```--smart``` for conducting through tests only in case of positive heuristic(s).

* Added switch ```--check-waf``` for checking of existence of WAF/IPS/IDS protection.

* Added switch ```--schema``` to enumerate DBMS schema: shows all columns of all databases' tables.

* Added switch ```--count``` to count the number of entries for a specific table or all database(s) tables.

* Support to directly connect to the database without passing via a SQL injection, option ```-d```.

* Extended old ```--dump -C``` functionality to be able to search for specific database(s), table(s) and column(s), option ```--search```.

* Added support to tamper injection data with option ```--tamper```.

* Added support to use persistent HTTP(s) connection for speed improvement, switch ```--keep-alive```.

* Implemented HTTP(s) proxy authentication support, option ```--proxy-cred```.

* Support to replicate the back-end DBMS tables structure and entries in a local SQLite 3 database, switch ```--replicate```.

* Support to parse and test forms on target url, switch ```--forms```.

* Added switches to brute-force tables names and columns names with a dictionary attack, ```--common-tables``` and ```--common-columns```. Useful for instance when system table ```information_schema``` is not available on MySQL.

* Basic support for REST-style URL parameters by using the asterisk (```*```) to mark where to test for and exploit SQL injection.

* Added safe URL feature, ```--safe-url``` and ```--safe-freq```.

* Added switch ```--text-only``` to strip from the HTTP response body the HTML/JS code and compare pages based only on their textual content.

* Support to enumerate and dump all databases' tables containing user provided column(s) by specifying for instance ```--dump -C user,pass```. Useful to identify for instance tables containing custom application credentials.

* Support to parse ```-C``` (column name(s)) when fetching columns of a table with ```--columns```: it will enumerate only columns like the provided one(s) within the specified table.

* Enhanced ```--priv-esc``` to rely on new Metasploit Meterpreter's 'getsystem' command to elevate privileges of the user running the back-end DBMS instance to SYSTEM on Windows.

* Automatic support in ```--os-pwn``` to use the web uploader/backdoor to upload and execute the Metasploit payload stager when stacked queries SQL injection is not supported, for instance on MySQL/PHP and MySQL/ASP, but there is a writable folder within the web server document root.

* Fixed web backdoor functionality for ```--os-cmd```, ```--os-shell``` and ```--os-pwn``` useful when web application does not support stacked queries.

* Added support to properly read (```--read-file```) also binary files via PostgreSQL by injecting sqlmap new ```sys_fileread()``` user-defined function.

* Support for NTLM authentication via python-ntlm third party library, http://code.google.com/p/python-ntlm/, ```--auth-type NTLM```.

* Support to automatically decode ```deflate```, ```gzip``` and ```x-gzip``` HTTP responses.

* Support for Certificate authentication, ```--auth-cert``` option added.

* Added support for regular expression based scope when parsing Burp or Web Scarab proxy log file (```-l```), ```--scope```.

* Added option ```-r``` to load a single HTTP request from a text file.

* Added switch ```--ignore-proxy``` to ignore the system default HTTP proxy.

* Added support to ignore Set-Cookie in HTTP responses, ```--drop-set-cookie```.

* Added support to specify which Google dork result page to parse, ```--gpage``` to be used together with ```-g```.

* Major bug fix and enhancements to the multi-threading (```--threads```) functionality.

* Refactored ```--update``` to use ```python-svn``` third party library if available or ```svn``` command to update sqlmap to the latest development version from subversion repository.