Updated documentation based upon recent developments

doc/README.sgml

@@ -138,14 +138,14 @@ in the following section to go ahead with the exploiting.
 <sect1>Techniques
 
 <p>
-sqlmap implements two techniques to exploit a SQL injection vulnerability:
+sqlmap implements three techniques to exploit a SQL injection
+vulnerability:
 
 <itemize>
-<item><bf>Blind SQL injection</bf>, also known as <bf>Inferential Blind SQL
-injection</bf> in this implementation: sqlmap appends to the affected
-parameter in the HTTP request, a syntatically valid SQL statement string
-containing a <tt>SELECT</tt> sub-statement, or any other SQL statement
-whose the user want to retrieve the output.
+<item><bf>Inferential Blind SQL injection</bf>: sqlmap appends to the
+affected parameter in the HTTP request, a syntatically valid SQL statement
+string containing a <tt>SELECT</tt> sub-statement, or any other SQL
+statement whose the user want to retrieve the output.
 For each HTTP response, by making a comparison based upon HTML page
 content hashes, or string matches, with the original request, the tool
 determines the output value of the statement character by character.
@@ -153,13 +153,13 @@ The bisection algorithm implemented in sqlmap to perform this technique
 is able to fetch each output character with at maximum seven HTTP
 requests.
 This is sqlmap default SQL injection technique.
-<item><bf>Inband SQL injection</bf>, also known as <bf>Full UNION query SQL
-injection</bf>: sqlmap appends to the affected parameter in the HTTP
-request, a syntatically valid SQL statement string starting with a
-<tt>UNION ALL SELECT</tt>. This techique is useful if the web application
-page passes the output of the <tt>SELECT</tt> statement to a <tt>for</tt>
-cycle, or similar, so that each line of the query output is printed on the
-page content.
+<item><bf>UNION query (inband) SQL injection</bf>, also known as <bf>Full
+UNION query SQL injection</bf>: sqlmap appends to the affected parameter
+in the HTTP request, a syntatically valid SQL statement string starting
+with a <tt>UNION ALL SELECT</tt>. This techique is useful if the web
+application page passes the output of the <tt>SELECT</tt> statement to a
+<tt>for</tt> cycle, or similar, so that each line of the query output is
+printed on the page content.
 sqlmap is also able to exploit <bf>Partial UNION query SQL injection</bf>
 vulnerabilities which occur when the output of the statement is not cycled
 in a for construct whereas only the first entry output is displayed.
@@ -167,6 +167,15 @@ This technique is much faster if the target url is affected by because
 in a single HTTP response it returns the whole query output or a entry
 per each response within the page content.
 This SQL injection technique is an alternative to the first one.
+<item><bf>Stacked queries support</bf>, also known as <bf>multiple
+statements support</bf>: sqlmap tests if the web application supports
+stacked queries then, in case it does support, it appends to the affected
+parameter in the HTTP request, a semi-colon (<tt>;</tt>) followed by the
+SQL statement to be executed. This technique is useful if to run SQL
+statements other than <tt>SELECT</tt> like, for instance, <em>data
+definition</em> or <em>data manipulation</em> statements possibly leading
+to file system read and write access and operating system command
+execution depending on the underlying back-end database management system.
 </itemize>
 
 It is strongly recommended to run at least once sqlmap with the
@@ -199,16 +208,17 @@ database management system name if you already know it. sqlmap is also able
 to fingerprint the web server operating system, the web application
 technology and, in some circumstances, the back-end DBMS operating system.
 
-<item>Full support for two SQL injection techniques: <bf>blind SQL
-injection</bf> and <bf>inband SQL injection</bf>. sqlmap can also test for
-<bf>Time based blind SQL injection</bf>.
+<item>Full support for three SQL injection techniques: <bf> inferential
+blind SQL injection</bf>, <bf>UNION query (inband) SQL injection</bf> and
+<bf>stacked queries (multiple statements) support</bf>. sqlmap can also
+test for <bf>time based blind SQL injection</bf>.
 
 <item>Options to retrieve on all four back-end database management system
 <bf>banner</bf>, <bf>current user</bf>, <bf>current database</bf>,
 enumerate <bf>users</bf>, <bf>users password hashes</bf>, <bf>users
 privileges</bf>, <bf>databases</bf>, <bf>tables</bf>, <bf>columns</bf>,
 dump <bf>tables entries</bf>, dump <bf>whole database management
-system</bf> and run your <bf>own SQL <tt>SELECT</tt> statement</bf>.
+system</bf> and run your <bf>own SQL statement</bf>.
 
 <item>If the back-end database management system is MySQL it is also
 possible to <bf>read a specific file content</bf> from the ile system and,
@@ -416,7 +426,7 @@ Options:
   Enumeration:
     These options can be used to enumerate the back-end database
     management system information, structure and data contained in the
-    tables. Moreover you can run your own SQL SELECT queries.
+    tables. Moreover you can run your own SQL statements.
 
     -b, --banner        Retrieve DBMS banner
     --current-user      Retrieve DBMS current user
@@ -437,7 +447,7 @@ Options:
     --exclude-sysdbs    Exclude DBMS system databases when enumerating tables
     --start=LIMITSTART  First table entry to dump
     --stop=LIMITSTOP    Last table entry to dump
-    --sql-query=QUERY   SQL SELECT query to be executed
+    --sql-query=QUERY   SQL statement to be executed
     --sql-shell         Prompt for an interactive SQL shell
 
   File system access:
@@ -3310,7 +3320,9 @@ considered a system database because some database administrators use it
 as a users' database.
 
 
-<sect2>Run your own SQL SELECT statement
+<sect2>Run your own SQL statement
+
+<!-- TODO: improve -->
 
 <p>
 Options: <tt>--sql-query</tt> and <tt>--sql-shell</tt>