mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2026-10-21 03:03:50 +00:00
sqlmap 0.6.3-rc4: minor enhancement to be able to specify extra HTTP headers
by providing option --headers. By default Accept, Accept-Language and Accept-Charset headers are set. Added support to get the injection payload prefix and postfix from user. Minor bug fix to exclude image files when parsing (-l) proxies log files. Minor code adjustments. Updated documentation.
This commit is contained in:
Bernardo Damele
parent
15542d2772
commit
9dbad512f1
15 changed files with 365 additions and 232 deletions
|
|
@ -27,10 +27,11 @@ sqlmap (0.6.3-1) stable; urgency=low
|
|||
* Minor enhancemet to support also --regexp, --excl-str and --excl-reg
|
||||
options rather than only --string when comparing HTTP responses page
|
||||
content;
|
||||
* Minor enhancement to be able to specify extra HTTP headers by providing
|
||||
option --headers. By default Accept, Accept-Language and Accept-Charset
|
||||
headers are set;
|
||||
* Minor improvement to be able to provide CU (as current user) as user
|
||||
value (-U) when enumerating users privileges or users passwords;
|
||||
* Minor improvement to set by default in all HTTP requests the standard
|
||||
client HTTP headers (Accept, Accept-Encoding, etc);
|
||||
* Minor improvements to sqlmap Debian package files: sqlmap uploaded
|
||||
to official Debian project repository, on queue at the moment;
|
||||
* Minor improvement to use Python psyco (http://psyco.sourceforge.net/)
|
||||
|
|
|
|||
117
doc/README.html
117
doc/README.html
|
|
@ -377,6 +377,7 @@ Options:
|
|||
--referer=REFERER HTTP Referer header
|
||||
--user-agent=AGENT HTTP User-Agent header
|
||||
-a USERAGENTSFILE Load a random HTTP User-Agent header from file
|
||||
--headers=HEADERS Extra HTTP headers '\n' separated
|
||||
--auth-type=ATYPE HTTP Authentication type, value: Basic or Digest
|
||||
--auth-cred=ACRED HTTP Authentication credentials, value: name:password
|
||||
--proxy=PROXY Use a HTTP proxy to connect to the target url
|
||||
|
|
@ -386,8 +387,14 @@ Options:
|
|||
|
||||
Injection:
|
||||
-p TESTPARAMETER Testable parameter(s)
|
||||
--string=STRING String to match in page when the query is valid
|
||||
--dbms=DBMS Force back-end DBMS to this value
|
||||
--prefix=PREFIX Injection payload prefix string
|
||||
--postfix=POSTFIX Injection payload postfix string
|
||||
--string=STRING String to match in page when the query is valid
|
||||
--regexp=REGEXP Regexp to match in page when the query is valid
|
||||
--excl-str=ESTRING String to be excluded before calculating page hash
|
||||
--excl-reg=EREGEXP Regexp matches to be excluded before calculating page
|
||||
hash
|
||||
|
||||
Techniques:
|
||||
These options can be used to test for specific SQL injection technique
|
||||
|
|
@ -1263,11 +1270,66 @@ back-end DBMS: MySQL >= 5.0.0
|
|||
</P>
|
||||
|
||||
|
||||
<H3>String match</H3>
|
||||
<H3>Force the database management system name</H3>
|
||||
|
||||
<P>Option: <CODE>--string</CODE></P>
|
||||
<P>Option: <CODE>--dbms</CODE></P>
|
||||
|
||||
<P>By default the distinction of a True query by a False one (basic concept
|
||||
<P>By default sqlmap automatically detects the web application's back-end
|
||||
database manangement system.
|
||||
At the moment the fully supported database management system are four:</P>
|
||||
<P>
|
||||
<UL>
|
||||
<LI>MySQL</LI>
|
||||
<LI>Oracle</LI>
|
||||
<LI>PostgreSQL</LI>
|
||||
<LI>Microsoft SQL Server</LI>
|
||||
</UL>
|
||||
</P>
|
||||
|
||||
<P>It is possible to force the name if you already know it so that sqlmap
|
||||
will skip the fingerprint with an exception for MySQL to only identify if
|
||||
it is MySQL < 5.0 or MySQL >= 5.0.
|
||||
To avoid also this check you can provide instead <CODE>MySQL 4</CODE> or
|
||||
<CODE>MySQL 5</CODE>.</P>
|
||||
<P>Example on a <B>PostgreSQL 8.2.7</B> target:</P>
|
||||
<P>
|
||||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 2 \
|
||||
--dbms "PostgreSQL"
|
||||
|
||||
[...]
|
||||
[hh:mm:31] [DEBUG] skipping to test for MySQL
|
||||
[hh:mm:31] [DEBUG] skipping to test for Oracle
|
||||
back-end DBMS: PostgreSQL
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
|
||||
<P>In case you provide <CODE>--fingerprint</CODE> together with <CODE>--dbms</CODE>,
|
||||
sqlmap will only perform the extensive fingerprint for the specified
|
||||
database management system, read the following section for further
|
||||
details.</P>
|
||||
|
||||
<P>Note that this option is <B>not</B> mandatory and it is strongly
|
||||
recommended to use it <B>only if you are absolutely sure</B> about the
|
||||
back-end database management system. If you do not know it, let sqlmap
|
||||
automatically identify it for you.</P>
|
||||
|
||||
|
||||
<H3>Custom injection payload</H3>
|
||||
|
||||
<P>Options: <CODE>--prefix</CODE> and <CODE>--postfix</CODE></P>
|
||||
|
||||
<P>TODO</P>
|
||||
|
||||
|
||||
<H3>Page comparison</H3>
|
||||
|
||||
<P>Options: <CODE>--string</CODE> and <CODE>--regexp</CODE></P>
|
||||
|
||||
<P>TODO
|
||||
By default the distinction of a True query by a False one (basic concept
|
||||
for standard blind SQL injection attacks) is done comparing injected pages
|
||||
content MD5 hash with the original not-injected page content MD5. Not
|
||||
always this concept works because sometimes the page content changes at
|
||||
|
|
@ -1410,53 +1472,6 @@ content that changes itself at each refresh without modifying the user's
|
|||
input</EM>.</P>
|
||||
|
||||
|
||||
<H3>Force the database management system name</H3>
|
||||
|
||||
<P>Option: <CODE>--dbms</CODE></P>
|
||||
|
||||
<P>By default sqlmap automatically detects the web application's back-end
|
||||
database manangement system.
|
||||
At the moment the fully supported database management system are four:</P>
|
||||
<P>
|
||||
<UL>
|
||||
<LI>MySQL</LI>
|
||||
<LI>Oracle</LI>
|
||||
<LI>PostgreSQL</LI>
|
||||
<LI>Microsoft SQL Server</LI>
|
||||
</UL>
|
||||
</P>
|
||||
|
||||
<P>It is possible to force the name if you already know it so that sqlmap
|
||||
will skip the fingerprint with an exception for MySQL to only identify if
|
||||
it is MySQL < 5.0 or MySQL >= 5.0.
|
||||
To avoid also this check you can provide instead <CODE>MySQL 4</CODE> or
|
||||
<CODE>MySQL 5</CODE>.</P>
|
||||
<P>Example on a <B>PostgreSQL 8.2.7</B> target:</P>
|
||||
<P>
|
||||
<BLOCKQUOTE><CODE>
|
||||
<PRE>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 2 \
|
||||
--dbms "PostgreSQL"
|
||||
|
||||
[...]
|
||||
[hh:mm:31] [DEBUG] skipping to test for MySQL
|
||||
[hh:mm:31] [DEBUG] skipping to test for Oracle
|
||||
back-end DBMS: PostgreSQL
|
||||
</PRE>
|
||||
</CODE></BLOCKQUOTE>
|
||||
</P>
|
||||
|
||||
<P>In case you provide <CODE>--fingerprint</CODE> together with <CODE>--dbms</CODE>,
|
||||
sqlmap will only perform the extensive fingerprint for the specified
|
||||
database management system, read the following section for further
|
||||
details.</P>
|
||||
|
||||
<P>Note that this option is <B>not</B> mandatory and it is strongly
|
||||
recommended to use it <B>only if you are absolutely sure</B> about the
|
||||
back-end database management system. If you do not know it, let sqlmap
|
||||
automatically identify it for you.</P>
|
||||
|
||||
|
||||
<H2><A NAME="ss5.4">5.4</A> <A HREF="#toc5.4">Techniques</A>
|
||||
</H2>
|
||||
|
||||
|
|
|
|||
BIN
doc/README.pdf
BIN
doc/README.pdf
Binary file not shown.
121
doc/README.sgml
121
doc/README.sgml
|
|
@ -335,6 +335,7 @@ Options:
|
|||
--referer=REFERER HTTP Referer header
|
||||
--user-agent=AGENT HTTP User-Agent header
|
||||
-a USERAGENTSFILE Load a random HTTP User-Agent header from file
|
||||
--headers=HEADERS Extra HTTP headers '\n' separated
|
||||
--auth-type=ATYPE HTTP Authentication type, value: Basic or Digest
|
||||
--auth-cred=ACRED HTTP Authentication credentials, value: name:password
|
||||
--proxy=PROXY Use a HTTP proxy to connect to the target url
|
||||
|
|
@ -344,8 +345,14 @@ Options:
|
|||
|
||||
Injection:
|
||||
-p TESTPARAMETER Testable parameter(s)
|
||||
--string=STRING String to match in page when the query is valid
|
||||
--dbms=DBMS Force back-end DBMS to this value
|
||||
--prefix=PREFIX Injection payload prefix string
|
||||
--postfix=POSTFIX Injection payload postfix string
|
||||
--string=STRING String to match in page when the query is valid
|
||||
--regexp=REGEXP Regexp to match in page when the query is valid
|
||||
--excl-str=ESTRING String to be excluded before calculating page hash
|
||||
--excl-reg=EREGEXP Regexp matches to be excluded before calculating page
|
||||
hash
|
||||
|
||||
Techniques:
|
||||
These options can be used to test for specific SQL injection technique
|
||||
|
|
@ -1205,12 +1212,71 @@ back-end DBMS: MySQL >= 5.0.0
|
|||
</verb></tscreen>
|
||||
|
||||
|
||||
<sect2>String match
|
||||
<sect2>Force the database management system name
|
||||
|
||||
<p>
|
||||
Option: <tt>--string</tt>
|
||||
Option: <tt>--dbms</tt>
|
||||
|
||||
<p>
|
||||
By default sqlmap automatically detects the web application's back-end
|
||||
database manangement system.
|
||||
At the moment the fully supported database management system are four:
|
||||
|
||||
<itemize>
|
||||
<item>MySQL
|
||||
<item>Oracle
|
||||
<item>PostgreSQL
|
||||
<item>Microsoft SQL Server
|
||||
</itemize>
|
||||
|
||||
<p>
|
||||
It is possible to force the name if you already know it so that sqlmap
|
||||
will skip the fingerprint with an exception for MySQL to only identify if
|
||||
it is MySQL < 5.0 or MySQL >= 5.0.
|
||||
To avoid also this check you can provide instead <tt>MySQL 4</tt> or
|
||||
<tt>MySQL 5</tt>.
|
||||
|
||||
Example on a <bf>PostgreSQL 8.2.7</bf> target:
|
||||
|
||||
<tscreen><verb>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 2 \
|
||||
--dbms "PostgreSQL"
|
||||
|
||||
[...]
|
||||
[hh:mm:31] [DEBUG] skipping to test for MySQL
|
||||
[hh:mm:31] [DEBUG] skipping to test for Oracle
|
||||
back-end DBMS: PostgreSQL
|
||||
</verb></tscreen>
|
||||
|
||||
<p>
|
||||
In case you provide <tt>--fingerprint</tt> together with <tt>--dbms</tt>,
|
||||
sqlmap will only perform the extensive fingerprint for the specified
|
||||
database management system, read the following section for further
|
||||
details.
|
||||
|
||||
<p>
|
||||
Note that this option is <bf>not</bf> mandatory and it is strongly
|
||||
recommended to use it <bf>only if you are absolutely sure</bf> about the
|
||||
back-end database management system. If you do not know it, let sqlmap
|
||||
automatically identify it for you.
|
||||
|
||||
|
||||
<sect2>Custom injection payload
|
||||
|
||||
<p>
|
||||
Options: <tt>--prefix</tt> and <tt>--postfix</tt>
|
||||
|
||||
<p>
|
||||
TODO
|
||||
|
||||
|
||||
<sect2>Page comparison
|
||||
|
||||
<p>
|
||||
Options: <tt>--string</tt> and <tt>--regexp</tt>
|
||||
|
||||
<p>
|
||||
TODO
|
||||
By default the distinction of a True query by a False one (basic concept
|
||||
for standard blind SQL injection attacks) is done comparing injected pages
|
||||
content MD5 hash with the original not-injected page content MD5. Not
|
||||
|
|
@ -1354,55 +1420,6 @@ content that changes itself at each refresh without modifying the user's
|
|||
input</em>.
|
||||
|
||||
|
||||
<sect2>Force the database management system name
|
||||
|
||||
<p>
|
||||
Option: <tt>--dbms</tt>
|
||||
|
||||
<p>
|
||||
By default sqlmap automatically detects the web application's back-end
|
||||
database manangement system.
|
||||
At the moment the fully supported database management system are four:
|
||||
|
||||
<itemize>
|
||||
<item>MySQL
|
||||
<item>Oracle
|
||||
<item>PostgreSQL
|
||||
<item>Microsoft SQL Server
|
||||
</itemize>
|
||||
|
||||
<p>
|
||||
It is possible to force the name if you already know it so that sqlmap
|
||||
will skip the fingerprint with an exception for MySQL to only identify if
|
||||
it is MySQL < 5.0 or MySQL >= 5.0.
|
||||
To avoid also this check you can provide instead <tt>MySQL 4</tt> or
|
||||
<tt>MySQL 5</tt>.
|
||||
|
||||
Example on a <bf>PostgreSQL 8.2.7</bf> target:
|
||||
|
||||
<tscreen><verb>
|
||||
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 2 \
|
||||
--dbms "PostgreSQL"
|
||||
|
||||
[...]
|
||||
[hh:mm:31] [DEBUG] skipping to test for MySQL
|
||||
[hh:mm:31] [DEBUG] skipping to test for Oracle
|
||||
back-end DBMS: PostgreSQL
|
||||
</verb></tscreen>
|
||||
|
||||
<p>
|
||||
In case you provide <tt>--fingerprint</tt> together with <tt>--dbms</tt>,
|
||||
sqlmap will only perform the extensive fingerprint for the specified
|
||||
database management system, read the following section for further
|
||||
details.
|
||||
|
||||
<p>
|
||||
Note that this option is <bf>not</bf> mandatory and it is strongly
|
||||
recommended to use it <bf>only if you are absolutely sure</bf> about the
|
||||
back-end database management system. If you do not know it, let sqlmap
|
||||
automatically identify it for you.
|
||||
|
||||
|
||||
<sect1>Techniques
|
||||
|
||||
<sect2>Test for Time Based blind SQL injection
|
||||
|
|
|
|||
|
|
@ -108,6 +108,9 @@ Richard Safran <allapplyhere@yahoo.com>
|
|||
Tomoyuki Sakurai <cherry@trombik.org>
|
||||
for submitting to the FreeBSD project the sqlmap 0.5 port
|
||||
|
||||
Philippe A. R. Schaeffer <schaeff@compuphil.de>
|
||||
for reporting a minor bug
|
||||
|
||||
Sven Schluter <sschlueter@netzwerk.cc>
|
||||
for providing with a patch for waiting a number of seconds between
|
||||
each HTTP request
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue