CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-07-03 06:51:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Updated Usage (markdown)

Miroslav Stampar 2026-06-30 20:47:17 +02:00
parent e1ea816c0f
commit ab64bc79a4
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Usage.md

@ -1114,7 +1114,7 @@ Besides classic SQL injection, sqlmap can also detect and exploit several other
* `--xpath`: XPath injection
* `--ssti`: server-side template injection
Each of these techniques is self-contained: it confirms the injection and extracts what that particular vector can reach, so the SQL enumeration options (e.g. `--banner`, `--dbs`, `--tables` and `--dump`) do not apply and are ignored. For server-side template injection, `--ssti-query` evaluates a single expression and `--ssti-shell` opens an interactive expression shell, while `--os-cmd` and `--os-shell` run operating system commands through the template engine where it allows it. As with SQL injection, these techniques honor `--level` (for instance, `Cookie` parameters are only tested from `--level 2`).
Each of these techniques is self-contained: it confirms the injection and extracts what that particular vector can reach, so the SQL enumeration options (e.g. `--banner`, `--dbs`, `--tables` and `--dump`) do not apply and are ignored. For server-side template injection, where the engine allows it, `--os-cmd` and `--os-shell` run operating system commands through the template engine. As with SQL injection, these techniques honor `--level` (for instance, `Cookie` parameters are only tested from `--level 2`).
### Seconds to delay the DBMS response for time-based blind SQL injection