|
| 1 | +sqlmap (0.6.1-1) stable; urgency=low |
| 2 | + |
| 3 | + * Major bug fix to blind SQL injection bisection algorithm to handle an |
| 4 | + exception; |
| 5 | + * Written a Metasploit 3 auxiliary module to run sqlmap; |
| 6 | + * Implemented possibility to test for and inject also on LIKE |
| 7 | + statements; |
| 8 | + * Implemented --start and --stop options to set the first and the last |
| 9 | + table entry to dump; |
| 10 | + * Added non-interactive/batch-mode (--batch) option to make it easy to |
| 11 | + wrap sqlmap in Metasploit and any other tool; |
| 12 | + * Minor enhancement to save also the length of query output in the |
| 13 | + session file when retrieving the query output length for ETA or for |
| 14 | + resume purposes. TODO: fix for ETA |
| 15 | + |
| 16 | + -- Bernardo Damele A. G. < [email protected]> Fri, 10 Oct 2008 10:00:00 +0100 |
| 17 | + |
| 18 | + |
| 19 | +sqlmap (0.6-1) stable; urgency=low |
| 20 | + |
| 21 | + * Complete code refactor and many bugs fixed; |
| 22 | + * Added multithreading support to set the maximum number of concurrent |
| 23 | + HTTP requests; |
| 24 | + * Implemented SQL shell (--sql-shell) functionality and fixed SQL query |
| 25 | + (--sql-query, before called -e) to be able to run whatever SELECT |
| 26 | + statement and get its output in both inband and blind SQL injection |
| 27 | + attack; |
| 28 | + * Added an option (--privileges) to retrieve DBMS users privileges, it |
| 29 | + also notifies if the user is a DBMS administrator; |
| 30 | + * Added support (-c) to read options from configuration file, an example |
| 31 | + of valid INI file is sqlmap.conf and support (--save) to save command |
| 32 | + line options on a configuration file; |
| 33 | + * Created a function that updates the whole sqlmap to the latest stable |
| 34 | + version available by running sqlmap with --update option; |
| 35 | + * Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.) |
| 36 | + installation binary packages; |
| 37 | + * Created sqlmap .exe (Windows) portable executable; |
| 38 | + * Save a lot of more information to the session file, useful when |
| 39 | + resuming injection on the same target to not loose time on identifying |
| 40 | + injection, UNION fields and back-end DBMS twice or more times; |
| 41 | + * Improved automatic check for parenthesis when testing and forging SQL |
| 42 | + query vector; |
| 43 | + * Now it checks for SQL injection on all GET/POST/Cookie parameters then |
| 44 | + it lets the user select which parameter to perform the injection on in |
| 45 | + case that more than one is injectable; |
| 46 | + * Implemented support for HTTPS requests over HTTP(S) proxy; |
| 47 | + * Added a check to handle NULL or not available queries output; |
| 48 | + * More entropy (randomStr() and randomInt() functions in |
| 49 | + lib/core/common.py) in inband SQL injection concatenated query and in |
| 50 | + AND condition checks; |
| 51 | + * Improved XML files structure; |
| 52 | + * Implemented the possibility to change the HTTP Referer header; |
| 53 | + * Added support to resume from session file also when running with |
| 54 | + inband SQL injection attack; |
| 55 | + * Added an option (--os-shell) to execute operating system commands if |
| 56 | + the back-end DBMS is MySQL, the web server has the PHP engine active |
| 57 | + and permits write access on a directory within the document root; |
| 58 | + * Added a check to assure that the provided string to match (--string) |
| 59 | + is within the page content; |
| 60 | + * Fixed various queries in XML file; |
| 61 | + * Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted |
| 62 | + the library to parse it; |
| 63 | + * Fixed password fetching function, mainly for Microsoft SQL Server and |
| 64 | + reviewed the password hashes parsing function; |
| 65 | + * Major bug fixed to avoid tracebacks when the testable parameter(s) is |
| 66 | + dynamic, but not injectable; |
| 67 | + * Enhanced logging system: added three more levels of verbosity to show |
| 68 | + also HTTP sent and received traffic; |
| 69 | + * Enhancement to handle Set-Cookie from target url and automatically |
| 70 | + re-establish the Session when it expires; |
| 71 | + * Added support to inject also on Set-Cookie parameters; |
| 72 | + * Implemented TAB completion and command history on both --sql-shell and |
| 73 | + --os-shell; |
| 74 | + * Renamed some command line options; |
| 75 | + * Added a conversion library; |
| 76 | + * Added code schema and reminders for future developments; |
| 77 | + * Added Copyright comment and $Id$ svn property to all Python files; |
| 78 | + * Updated the command line layout and help messages; |
| 79 | + * Updated some docstrings; |
| 80 | + * Updated documentation files. |
| 81 | + |
| 82 | + -- Bernardo Damele A. G. < [email protected]> Mon, 1 Sep 2008 10:00:00 +0100 |
| 83 | + |
| 84 | + |
| 85 | +sqlmap (0.5-1) stable; urgency=low |
| 86 | + |
| 87 | + * Added support for Oracle database management system |
| 88 | + * Extended inband SQL injection functionality (--union-use) to all |
| 89 | + other possible queries since it only worked with -e and --file on |
| 90 | + all DMBS plugins; |
| 91 | + * Added support to extract database users password hash on Microsoft |
| 92 | + SQL Server; |
| 93 | + * Added a fuzzer function with the aim to parse HTML page looking |
| 94 | + for standard database error messages consequently improving |
| 95 | + database fingerprinting; |
| 96 | + * Added support for SQL injection on HTTP Cookie and User-Agent headers; |
| 97 | + * Reviewed HTTP request library (lib/request.py) to support the |
| 98 | + extended inband SQL injection functionality. Splitted getValue() |
| 99 | + into getInband() and getBlind(); |
| 100 | + * Major enhancements in common library and added checkForBrackets() |
| 101 | + method to check if the bracket(s) are needed to perform a UNION query |
| 102 | + SQL injection attack; |
| 103 | + * Implemented --dump-all functionality to dump entire DBMS data from |
| 104 | + all databases tables; |
| 105 | + * Added support to exclude DBMS system databases' when enumeration |
| 106 | + tables and dumping their entries (--exclude-sysdbs); |
| 107 | + * Implemented in Dump.dbTableValues() method the CSV file dumped data |
| 108 | + automatic saving in csv/ folder by default; |
| 109 | + * Added DB2, Informix and Sybase DBMS error messages and minor |
| 110 | + improvements in xml/errors.xml; |
| 111 | + * Major improvement in all three DBMS plugins so now sqlmap does not |
| 112 | + get entire databases' tables structure when all of database/table/ |
| 113 | + column are specified to be dumped; |
| 114 | + * Important fixes in lib/option.py to make sqlmap properly work also |
| 115 | + with python 2.5 and handle the CSV dump files creation work also |
| 116 | + under Windows operating system, function __setCSVDir() and fixed |
| 117 | + also in lib/dump.py; |
| 118 | + * Minor enhancement in lib/injection.py to randomize the number |
| 119 | + requested to test the presence of a SQL injection affected parameter |
| 120 | + and implemented the possibilities to break (q) the for cycle when |
| 121 | + using the google dork option (-g); |
| 122 | + * Minor fix in lib/request.py to properly encode the url to request |
| 123 | + in case the "fixed" part of the url has blank spaces; |
| 124 | + * More minor layout enhancements in some libraries; |
| 125 | + * Renamed DMBS plugins; |
| 126 | + * Complete code refactoring, a lot of minor and some major fixes in |
| 127 | + libraries, many minor improvements; |
| 128 | + * Updated all documentation files. |
| 129 | + |
| 130 | + -- Bernardo Damele A. G. < [email protected]> Sun, 4 Nov 2007 20:00:00 +0100 |
| 131 | + |
| 132 | + |
| 133 | +sqlmap (0.4-1) stable; urgency=low |
| 134 | + |
| 135 | + * Added DBMS fingerprint based also upon HTML error messages parsing |
| 136 | + defined in lib/parser.py which reads an XML file defining default |
| 137 | + error messages for each supported DBMS; |
| 138 | + * Added Microsoft SQL Server extensive DBMS fingerprint checks based |
| 139 | + upon accurate '@@version' parsing matching on an XML file to get also |
| 140 | + the exact patching level of the DBMS; |
| 141 | + * Added support for query ETA (Estimated Time of Arrival) real time |
| 142 | + calculation (--eta); |
| 143 | + * Added support to extract database management system users password |
| 144 | + hash on MySQL and PostgreSQL (--passwords); |
| 145 | + * Added docstrings to all functions, classes and methods, consequently |
| 146 | + released the sqlmap development documentation |
| 147 | + <http://sqlmap.sourceforge.net/dev/>; |
| 148 | + * Implemented Google dorking feature (-g) to take advantage of Google |
| 149 | + results affected by SQL injection to perform other command line |
| 150 | + argument on their DBMS; |
| 151 | + * Improved logging functionality: passed from banal 'print' to Python |
| 152 | + native logging library; |
| 153 | + * Added support for more than one parameter in '-p' command line |
| 154 | + option; |
| 155 | + * Added support for HTTP Basic and Digest authentication methods |
| 156 | + (--basic-auth and --digest-auth); |
| 157 | + * Added the command line option '--remote-dbms' to manually specify |
| 158 | + the remote DBMS; |
| 159 | + * Major improvements in union.UnionCheck() and union.UnionUse() |
| 160 | + functions to make it possible to exploit inband SQL injection also |
| 161 | + with database comment characters ('--' and '#') in UNION SELECT |
| 162 | + statements; |
| 163 | + * Added the possibility to save the output into a file while performing |
| 164 | + the queries (-o OUTPUTFILE) so it is possible to stop and resume the |
| 165 | + same query output retrieving in a second time (--resume); |
| 166 | + * Added support to specify the database table column to enumerate |
| 167 | + (-C COL); |
| 168 | + * Added inband SQL injection (UNION SELECT) support (--union-use); |
| 169 | + * Complete code refactoring, a lot of minor and some major fixes in |
| 170 | + libraries, many minor improvements; |
| 171 | + * Reviewed the directory tree structure; |
| 172 | + * Splitted lib/common.py: inband injection functionalities now are |
| 173 | + moved to lib/union.py; |
| 174 | + * Updated documentation files. |
| 175 | + |
| 176 | + -- Bernardo Damele A. G. < [email protected]> Fri, 15 Jun 2007 20:00:00 +0100 |
| 177 | + |
| 178 | + |
| 179 | +sqlmap (0.3-1) stable; urgency=low |
| 180 | + |
| 181 | + * Added module for MS SQL Server; |
| 182 | + * Strongly improved MySQL dbms active fingerprint and added MySQL |
| 183 | + comment injection check; |
| 184 | + * Added PostgreSQL dbms active fingerprint; |
| 185 | + * Added support for string match (--string); |
| 186 | + * Added support for UNION check (--union-check); |
| 187 | + * Removed duplicated code, delegated most of features to the engine |
| 188 | + in common.py and option.py; |
| 189 | + * Added support for --data command line argument to pass the string |
| 190 | + for POST requests; |
| 191 | + * Added encodeParams() method to encode url parameters before making |
| 192 | + http request; |
| 193 | + * Many bug fixes; |
| 194 | + * Rewritten documentation files; |
| 195 | + * Complete code restyling. |
| 196 | + |
| 197 | + -- Bernardo Damele A. G. < [email protected]> Sat, 20 Jan 2007 20:00:00 +0100 |
| 198 | + |
| 199 | + |
| 200 | +sqlmap (0.2-1) stable; urgency=low |
| 201 | + |
| 202 | + * complete refactor of entire program; |
| 203 | + * added TODO and THANKS files; |
| 204 | + * added some papers references in README file; |
| 205 | + * moved headers to user-agents.txt, now -f parameter specifies a file |
| 206 | + (user-agents.txt) and randomize the selection of User-Agent header; |
| 207 | + * strongly improved program plugins (mysqlmap.py and postgres.py), |
| 208 | + major enhancements: |
| 209 | + * improved active mysql fingerprint check_dbms(); |
| 210 | + * improved enumeration functions for both databases; |
| 211 | + * minor changes in the unescape() functions; |
| 212 | + * replaced old inference algorithm with a new bisection algorithm. |
| 213 | + * reviewed command line parameters, now with -p it's possible to |
| 214 | + specify the parameter you know it's vulnerable to sql injection, |
| 215 | + this way the script won't perform the sql injection checks itself; |
| 216 | + removed the TOKEN parameter; |
| 217 | + * improved Common class, adding support for http proxy and http post |
| 218 | + method in hash_page; |
| 219 | + * added OptionCheck class in option.py which performs all needed checks |
| 220 | + on command line parameters and values; |
| 221 | + * added InjectionCheck class in injection.py which performs check on |
| 222 | + url stability, dynamics of parameters and injection on dynamic url |
| 223 | + parameters; |
| 224 | + * improved output methods in dump.py; |
| 225 | + * layout enhancement on main program file (sqlmap.py), adapted to call |
| 226 | + new option/injection classes and improvements on catching of |
| 227 | + exceptions. |
| 228 | + |
| 229 | + -- Bernardo Damele A. G. < [email protected]> Wed, 13 Dec 2006 20:00:00 +0100 |
0 commit comments