Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit bb9079a

Browse files
bdamelebdamele
committed
Minor documentation adjustments
1 parent 94c79e3 commit bb9079a

4 files changed

Lines changed: 103 additions & 90 deletions

File tree

‎doc/README.html‎

Lines changed: 60 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,16 @@ <H2><A NAME="toc4">4.</A> <A HREF="README.html#s4">License and copyright</A></H2
3737
<H2><A NAME="toc5">5.</A> <A HREF="README.html#s5">Usage</A></H2>
3838

3939
<UL>
40-
<LI><A NAME="toc5.1">5.1</A> <A HREF="README.html#ss5.1">Target</A>
41-
<LI><A NAME="toc5.2">5.2</A> <A HREF="README.html#ss5.2">Request</A>
42-
<LI><A NAME="toc5.3">5.3</A> <A HREF="README.html#ss5.3">Injection</A>
43-
<LI><A NAME="toc5.4">5.4</A> <A HREF="README.html#ss5.4">Techniques</A>
44-
<LI><A NAME="toc5.5">5.5</A> <A HREF="README.html#ss5.5">Fingerprint</A>
45-
<LI><A NAME="toc5.6">5.6</A> <A HREF="README.html#ss5.6">Enumeration</A>
46-
<LI><A NAME="toc5.7">5.7</A> <A HREF="README.html#ss5.7">File system access</A>
47-
<LI><A NAME="toc5.8">5.8</A> <A HREF="README.html#ss5.8">Operating system access</A>
48-
<LI><A NAME="toc5.9">5.9</A> <A HREF="README.html#ss5.9">Miscellaneous</A>
40+
<LI><A NAME="toc5.1">5.1</A> <A HREF="README.html#ss5.1">Output verbosity</A>
41+
<LI><A NAME="toc5.2">5.2</A> <A HREF="README.html#ss5.2">Target</A>
42+
<LI><A NAME="toc5.3">5.3</A> <A HREF="README.html#ss5.3">Request</A>
43+
<LI><A NAME="toc5.4">5.4</A> <A HREF="README.html#ss5.4">Injection</A>
44+
<LI><A NAME="toc5.5">5.5</A> <A HREF="README.html#ss5.5">Techniques</A>
45+
<LI><A NAME="toc5.6">5.6</A> <A HREF="README.html#ss5.6">Fingerprint</A>
46+
<LI><A NAME="toc5.7">5.7</A> <A HREF="README.html#ss5.7">Enumeration</A>
47+
<LI><A NAME="toc5.8">5.8</A> <A HREF="README.html#ss5.8">File system access</A>
48+
<LI><A NAME="toc5.9">5.9</A> <A HREF="README.html#ss5.9">Operating system access</A>
49+
<LI><A NAME="toc5.10">5.10</A> <A HREF="README.html#ss5.10">Miscellaneous</A>
4950
</UL>
5051
<P>
5152
<H2><A NAME="toc6">6.</A> <A HREF="README.html#s6">Disclaimer</A></H2>
@@ -399,6 +400,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
399400
Options:
400401
--version show program's version number and exit
401402
-h, --help show this help message and exit
403+
-v VERBOSE Verbosity level: 0-5 (default 1)
402404

403405
Target:
404406
At least one of these options has to be specified to set the source to
@@ -502,7 +504,6 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
502504
Miscellaneous:
503505
--eta Retrieve each query output length and calculate the
504506
estimated time of arrival in real time
505-
-v VERBOSE Verbosity level: 0-5 (default 1)
506507
--update Update sqlmap to the latest stable version
507508
-s SESSIONFILE Save and resume all data retrieved on a session file
508509
--save Save options on a configuration INI file
@@ -512,35 +513,9 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
512513
</P>
513514

514515

515-
<H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Target</A>
516+
<H2><A NAME="ss5.1">5.1</A> <A HREF="#toc5.1">Output verbosity</A>
516517
</H2>
517518

518-
<P>At least one of these options has to be specified to set the source to get
519-
target urls from.</P>
520-
521-
<H3>Target URL</H3>
522-
523-
<P>Option: <CODE>-u</CODE> or <CODE>--url</CODE></P>
524-
525-
<P>To run sqlmap on a single target URL.</P>
526-
527-
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
528-
<P>
529-
<BLOCKQUOTE><CODE>
530-
<PRE>
531-
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
532-
533-
[...]
534-
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
535-
web application technology: PHP 5.2.6, Apache 2.2.9
536-
back-end DBMS: MySQL >= 5.0.0
537-
</PRE>
538-
</CODE></BLOCKQUOTE>
539-
</P>
540-
541-
542-
<H3>Target URL and verbosity</H3>
543-
544519
<P>Option: <CODE>-v</CODE></P>
545520

546521
<P>Verbose options can be used to set the verbosity level of output messages.
@@ -762,6 +737,33 @@ <H3>Target URL and verbosity</H3>
762737
</P>
763738

764739

740+
<H2><A NAME="ss5.2">5.2</A> <A HREF="#toc5.2">Target</A>
741+
</H2>
742+
743+
<P>At least one of these options has to be specified to set the source to get
744+
target urls from.</P>
745+
746+
<H3>Target URL</H3>
747+
748+
<P>Option: <CODE>-u</CODE> or <CODE>--url</CODE></P>
749+
750+
<P>To run sqlmap on a single target URL.</P>
751+
752+
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
753+
<P>
754+
<BLOCKQUOTE><CODE>
755+
<PRE>
756+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
757+
758+
[...]
759+
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
760+
web application technology: PHP 5.2.6, Apache 2.2.9
761+
back-end DBMS: MySQL >= 5.0.0
762+
</PRE>
763+
</CODE></BLOCKQUOTE>
764+
</P>
765+
766+
765767
<H3>Parse targets from Burp or WebScarab logs</H3>
766768

767769
<P>Option: <CODE>-l</CODE></P>
@@ -903,7 +905,7 @@ <H3>Load options from a configuration INI file</H3>
903905
the provided configuration file.</P>
904906

905907

906-
<H2><A NAME="ss5.2">5.2</A> <A HREF="#toc5.2">Request</A>
908+
<H2><A NAME="ss5.3">5.3</A> <A HREF="#toc5.3">Request</A>
907909
</H2>
908910

909911
<P>These options can be used to specify how to connect to the target url.</P>
@@ -1367,7 +1369,7 @@ <H3>Seconds to wait before timeout connection</H3>
13671369
10.5 means ten seconds and a half.</P>
13681370

13691371

1370-
<H2><A NAME="ss5.3">5.3</A> <A HREF="#toc5.3">Injection</A>
1372+
<H2><A NAME="ss5.4">5.4</A> <A HREF="#toc5.4">Injection</A>
13711373
</H2>
13721374

13731375
<P>These options can be used to specify which parameters to test for, provide
@@ -1573,9 +1575,9 @@ <H3>Custom injection payload</H3>
15731575
</CODE></BLOCKQUOTE>
15741576
</P>
15751577

1576-
<P>In this simple example sqlmap could detect the SQL injection and exploit it
1577-
without need to provide a custom injection payload, but sometimes on real
1578-
world application it is necessary to provide a custom injection payload.</P>
1578+
<P>In this simple example, sqlmap could detect the SQL injection and exploit
1579+
it without need to provide a custom injection payload, but sometimes in
1580+
the real world application it is necessary to provide it.</P>
15791581

15801582

15811583
<H3>Page comparison</H3>
@@ -1799,7 +1801,7 @@ <H3>Exclude specific page content</H3>
17991801
stability test.</P>
18001802

18011803

1802-
<H2><A NAME="ss5.4">5.4</A> <A HREF="#toc5.4">Techniques</A>
1804+
<H2><A NAME="ss5.5">5.5</A> <A HREF="#toc5.5">Techniques</A>
18031805
</H2>
18041806

18051807
<H3>Test for stacked queries (multiple statements) support</H3>
@@ -1928,11 +1930,16 @@ <H3>Test for Time based blind SQL injection</H3>
19281930
[...]
19291931
back-end DBMS: Microsoft SQL Server 2005
19301932

1931-
[15:32:59] [INFO] testing time based blind sql injection on parameter 'name' with AND condition syntax
1932-
[15:32:59] [WARNING] the parameter 'name' is not affected by a time based blind sql injection with AND condition syntax
1933-
[15:32:59] [INFO] testing time based blind sql injection on parameter 'name' with stacked query syntax
1934-
[15:33:13] [INFO] the parameter 'name' is affected by a time based blind sql injection with stacked query syntax
1935-
time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'PmrXn'='PmrXn'
1933+
[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with AND
1934+
condition syntax
1935+
[hh:mm:59] [WARNING] the parameter 'name' is not affected by a time based blind sql
1936+
injection with AND condition syntax
1937+
[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with stacked
1938+
query syntax
1939+
[hh:mm:13] [INFO] the parameter 'name' is affected by a time based blind sql injection with
1940+
stacked query syntax
1941+
time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND
1942+
'PmrXn'='PmrXn'
19361943
</PRE>
19371944
</CODE></BLOCKQUOTE>
19381945
</P>
@@ -2159,7 +2166,7 @@ <H3>Use the UNION query SQL injection</H3>
21592166
page content.</P>
21602167

21612168

2162-
<H2><A NAME="ss5.5">5.5</A> <A HREF="#toc5.5">Fingerprint</A>
2169+
<H2><A NAME="ss5.6">5.6</A> <A HREF="#toc5.6">Fingerprint</A>
21632170
</H2>
21642171

21652172
<H3>Extensive database management system fingerprint</H3>
@@ -2472,7 +2479,7 @@ <H3>Extensive database management system fingerprint</H3>
24722479
<A HREF="http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx">SQLSecurity.com site</A> and outputs it to the XML versions file.</P>
24732480

24742481

2475-
<H2><A NAME="ss5.6">5.6</A> <A HREF="#toc5.6">Enumeration</A>
2482+
<H2><A NAME="ss5.7">5.7</A> <A HREF="#toc5.7">Enumeration</A>
24762483
</H2>
24772484

24782485
<H3>Banner</H3>
@@ -3749,7 +3756,7 @@ <H3>Run your own SQL SELECT statement</H3>
37493756
entries and goes on.</P>
37503757

37513758

3752-
<H2><A NAME="ss5.7">5.7</A> <A HREF="#toc5.7">File system access</A>
3759+
<H2><A NAME="ss5.8">5.8</A> <A HREF="#toc5.8">File system access</A>
37533760
</H2>
37543761

37553762
<H3>Read a specific file content</H3>
@@ -3793,7 +3800,7 @@ <H3>Read a specific file content</H3>
37933800
</P>
37943801

37953802

3796-
<H2><A NAME="ss5.8">5.8</A> <A HREF="#toc5.8">Operating system access</A>
3803+
<H2><A NAME="ss5.9">5.9</A> <A HREF="#toc5.9">Operating system access</A>
37973804
</H2>
37983805

37993806
<H3>Prompt for an interactive operating system shell</H3>
@@ -3831,7 +3838,7 @@ <H3>Prompt for an interactive operating system shell</H3>
38313838
functionalities of SQL shell in terms of TAB completion and history support.</P>
38323839

38333840

3834-
<H2><A NAME="ss5.9">5.9</A> <A HREF="#toc5.9">Miscellaneous</A>
3841+
<H2><A NAME="ss5.10">5.10</A> <A HREF="#toc5.10">Miscellaneous</A>
38353842
</H2>
38363843

38373844
<H3>Estimated time of arrival</H3>

‎doc/README.pdf‎

1.57 KB
Binary file not shown.

‎doc/README.sgml‎

Lines changed: 42 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ Usage: sqlmap.py [options]
356356
Options:
357357
--version show program's version number and exit
358358
-h, --help show this help message and exit
359+
-v VERBOSE Verbosity level: 0-5 (default 1)
359360

360361
Target:
361362
At least one of these options has to be specified to set the source to
@@ -459,42 +460,14 @@ Options:
459460
Miscellaneous:
460461
--eta Retrieve each query output length and calculate the
461462
estimated time of arrival in real time
462-
-v VERBOSE Verbosity level: 0-5 (default 1)
463463
--update Update sqlmap to the latest stable version
464464
-s SESSIONFILE Save and resume all data retrieved on a session file
465465
--save Save options on a configuration INI file
466466
--batch Never ask for user input, use the default behaviour
467467
</verb></tscreen>
468468

469469

470-
<sect1>Target
471-
472-
<p>
473-
At least one of these options has to be specified to set the source to get
474-
target urls from.
475-
476-
<sect2>Target URL
477-
478-
<p>
479-
Option: <tt>-u</tt> or <tt>--url</tt>
480-
481-
<p>
482-
To run sqlmap on a single target URL.
483-
484-
<p>
485-
Example on a <bf>MySQL 5.0.67</bf> target:
486-
487-
<tscreen><verb>
488-
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
489-
490-
[...]
491-
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
492-
web application technology: PHP 5.2.6, Apache 2.2.9
493-
back-end DBMS: MySQL >= 5.0.0
494-
</verb></tscreen>
495-
496-
497-
<sect2>Target URL and verbosity
470+
<sect1>Output verbosity
498471

499472
<p>
500473
Option: <tt>-v</tt>
@@ -709,6 +682,33 @@ Content-Type: text/html
709682
</verb></tscreen>
710683

711684

685+
<sect1>Target
686+
687+
<p>
688+
At least one of these options has to be specified to set the source to get
689+
target urls from.
690+
691+
<sect2>Target URL
692+
693+
<p>
694+
Option: <tt>-u</tt> or <tt>--url</tt>
695+
696+
<p>
697+
To run sqlmap on a single target URL.
698+
699+
<p>
700+
Example on a <bf>MySQL 5.0.67</bf> target:
701+
702+
<tscreen><verb>
703+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1"
704+
705+
[...]
706+
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
707+
web application technology: PHP 5.2.6, Apache 2.2.9
708+
back-end DBMS: MySQL >= 5.0.0
709+
</verb></tscreen>
710+
711+
712712
<sect2>Parse targets from Burp or WebScarab logs
713713

714714
<p>
@@ -1513,9 +1513,9 @@ SELECT * FROM users WHERE id=('1') AND 7433=7433 AND ('test'='test') LIMIT 0, 1
15131513
</verb></tscreen>
15141514

15151515
<p>
1516-
In this simple example sqlmap could detect the SQL injection and exploit it
1517-
without need to provide a custom injection payload, but sometimes on real
1518-
world application it is necessary to provide a custom injection payload.
1516+
In this simple example, sqlmap could detect the SQL injection and exploit
1517+
it without need to provide a custom injection payload, but sometimes in
1518+
the real world application it is necessary to provide it.
15191519

15201520

15211521
<sect2>Page comparison
@@ -1864,11 +1864,16 @@ $ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" \
18641864
[...]
18651865
back-end DBMS: Microsoft SQL Server 2005
18661866

1867-
[15:32:59] [INFO] testing time based blind sql injection on parameter 'name' with AND condition syntax
1868-
[15:32:59] [WARNING] the parameter 'name' is not affected by a time based blind sql injection with AND condition syntax
1869-
[15:32:59] [INFO] testing time based blind sql injection on parameter 'name' with stacked query syntax
1870-
[15:33:13] [INFO] the parameter 'name' is affected by a time based blind sql injection with stacked query syntax
1871-
time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'PmrXn'='PmrXn'
1867+
[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with AND
1868+
condition syntax
1869+
[hh:mm:59] [WARNING] the parameter 'name' is not affected by a time based blind sql
1870+
injection with AND condition syntax
1871+
[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with stacked
1872+
query syntax
1873+
[hh:mm:13] [INFO] the parameter 'name' is affected by a time based blind sql injection with
1874+
stacked query syntax
1875+
time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND
1876+
'PmrXn'='PmrXn'
18721877
</verb></tscreen>
18731878

18741879

‎doc/THANKS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ Giorgio Fedon <[email protected]>
3636
Ivan Giacomelli <[email protected]>
3737
for reporting a bug
3838
for suggesting a minor enhancement
39+
for reviewing the documentation
3940

4041
Davide Guerri <[email protected]>
4142
for suggesting an enhancement

0 commit comments

Comments
 (0)