CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-20 18:54:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Updated packaging scripts, site and finalized the documentation to release version 0.6.4

Browse source
This commit is contained in:
Bernardo Damele 2009-02-03 15:38:40 +00:00
parent 770e000cb4
commit b12d955274
5 changed files with 37 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

24
doc/README.sgml
View file

@ -4,7 +4,7 @@
<title>sqlmap user's manual
<author>by <htmlurl url="mailto:bernardo.damele@gmail.com" name="Bernardo Damele A. G.">
<date>version 0.6.4, DDth of MMM 2009
<date>version 0.6.4, 3rd of February 2009
<abstract>
This document is the user's manual to use <htmlurl url="http://sqlmap.sourceforge.net" name="sqlmap">.
Check the project <htmlurl url="http://sqlmap.sourceforge.net" name="homepage">
@ -362,7 +362,7 @@ $ python sqlmap.py -h
sqlmap/0.6.4 coded by Bernardo Damele A. G. <bernardo.damele@gmail.com>
and Daniele Bellucci <daniele.bellucci@gmail.com>
Usage: sqlmap.py [options]
Options:
@ -3698,7 +3698,8 @@ back-end DBMS: PostgreSQL
sql> SELECT COUNT(name) FROM users
[10:11:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
[10:11:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) FROM users
[10:11:59] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32))
FROM users
[10:11:59] [INFO] retrieved: 4
[10:11:59] [INFO] performed 13 queries in 0 seconds
SELECT COUNT(name) FROM users: '4'
@ -3706,19 +3707,30 @@ SELECT COUNT(name) FROM users: '4'
sql> INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell');
[10:12:35] [INFO] testing stacked queries support on parameter 'id'
[10:12:40] [INFO] the web application supports stacked queries on parameter 'id'
[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell');'
[10:12:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users (id, name, surname)
VALUES (5, 'from', 'sql shell');'
[10:12:40] [INFO] done
sql> SELECT COUNT(name) FROM users
[10:12:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
[10:12:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32)) FROM users
[10:12:53] [INFO] query: SELECT COALESCE(CAST(COUNT(name) AS CHARACTER(10000)), CHR(32))
FROM users
[10:12:53] [INFO] retrieved: 5
[10:12:54] [INFO] performed 20 queries in 0 seconds
SELECT COUNT(name) FROM users: '5'
</verb></tscreen>
<p>
TODO
As you can see from this last example, when the user provides a SQL
statement other than <tt>SELECT</tt>, sqlmap recognizes it, tests if the
web application supports stacked queries and in case it does, it executes
the provided SQL statement in a multiple statement.
<p>
Beware that some web application technologies do not support stacked
queries on specific database management systems. For instance, PHP does not
support stacked queries when the back-end DBMS is MySQL, but it does
support when the back-end DBMS is PostgreSQL.
<sect1>File system access